Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:123836
Message-ID: <38872be3-149d-42f3-a115-8e4409778d0a@bastelstu.be>
Date: Tue, 25 Jun 2024 20:15:31 +0200
Precedence: bulk
MIME-Version: 1.0
Subject: Re: [PHP-DEV] [RFC] Deprecations for PHP 8.4
To: Derick Rethans <derick@php.net>, Marco Pivetta <ocramius@gmail.com>
Cc: "Gina P. Banyard" <internals@gpb.moe>,
 PHP internals <internals@lists.php.net>, timwolla@php.net
References: <bw20I5b7ly3lSbI-2Bv3kfrfTVJbDo5RhwBiQa1PEwuLjprDJWptPajLiaialj1RLVKu7z1j0MofJUhhRVtzT_5i2E11oKeQx_VMUxnKhUE=@gpb.moe>
 <CADyq6sLuz3430TRMu8cSh5_x57UBaWA8v4sr_c+OgUSjn-otBQ@mail.gmail.com>
 <a503f9ff-739f-a1c4-f85f-1896acffa1c0@php.net>
Content-Language: en-US
In-Reply-To: <a503f9ff-739f-a1c4-f85f-1896acffa1c0@php.net>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=C3=BCsterhus?=)

Hi

On 6/25/24 17:49, Derick Rethans wrote:
> These functions are indeed often used. The documentation for uniqid has
> some nice big warnings too. It can be used in situations, where it is
> OK.

Yes, the RFC acknowledges that.

> Replacing the algorithm underneath uniqid can (and perhaps should) be
> looked at.

As explained in the RFC: The behavior is unfixable, because uniqid() is 
documented to be time-based. Changing the output format would be a much 
bigger breaking change than deprecating the function and letting users 
make an educated decision when choosing an alternative.

> For the md5 and sha1 functions. Although these algorithms are not useful
> for "verifying the authenticity of a a payload", that doesn't mean they
> can't be used outside of that use case.

See my reply to Robert. The algorithms themselves are not going away. At 
least not as part of this RFC.

> I understand the reasons why you want to "nudge" people to no longer use
> these "unsafe" functions, but IMO, in this case, it's not worth the
> BC issues.
> 

For both uniqid() and the md5()/sha1() section, the RFC specifically 
acknowledges that there is a vast collection of code using it and for 
this reason specifically defines an indefinite deprecation period (with 
a guarantee that indefinite is at least 5 years / until PHP 10).

Please keep in mind that a deprecation is not an error, not a removal 
and not a change in behavior. Users will be able to migrate on their own 
pace and for both uniqid() and md5()/sha1() there is a drop-in 
replacement provided in the RFC that is guaranteed to work with PHP 7.4+.

Best regards
Tim Düsterhus