Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124564
Precedence: bulk
MIME-Version: 1.0
References: <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
In-Reply-To: <1a88918e-e808-d778-45e1-53797660e093@php.net>
Date: Tue, 23 Jul 2024 20:58:56 -0700
Message-ID: <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
To: Derick Rethans <derick@php.net>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000b42f27061df64cec"
From: sarkedev@gmail.com (Peter Stalman)

--000000000000b42f27061df64cec
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Jul 22, 2024 at 9:06=E2=80=AFAM Derick Rethans <derick@php.net> wro=
te:

> - Deprecate md5(), sha1(), md5_file(), and sha1_file() (just says "large
>   impact")


About 1.2 million.
https://github.com/search?q=3D%28md5+OR+md5_file+OR+sha1+OR+sha1_file%29+la=
nguage%3APHP+&type=3Dcode

The proposed deprecation of these functions in PHP due to their
cryptographic insecurities seems to overlook their valid non-cryptographic
applications. If we consider the context, the scope of cryptographic usage
is already quite specific. We're talking about end users who are rolling
their own security implementations and are unaware of the security risks
but somehow know how to use these functions without reading the
documentation and warnings.

The number of people who fall into this specific category is quite small.
Yet, this change is being proposed for their sake. It's important to note
that these same users could/will easily make other security mistakes
regardless of this deprecation.

On the other hand, who will be impacted by these deprecations? Potentially
everyone, as these are included in many projects and in many vendor
packages.  It's busy work for the people who aren't affected.  Sure,
eventually, it will all be sorted out as CI warnings slowly subside because
of this.

Reasons such as GIT and most cloud storages using these functions should be
enough to spare them. Example: https://rclone.org/overview/

The point is that there are several reasons in 2024 to use md5 and sha1.
Granted hashing passwords isn't one, but we're past that as a community
already. And for the few that aren't, I'd argue there is no saving.

Thanks,
Peter

--000000000000b42f27061df64cec
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Mon, Jul 22, 2024 at 9:06=E2=80=AFAM D=
erick Rethans &lt;<a href=3D"mailto:derick@php.net">derick@php.net</a>&gt; =
wrote:</div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" st=
yle=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padd=
ing-left:1ex">
- Deprecate md5(), sha1(), md5_file(), and sha1_file() (just says &quot;lar=
ge <br>
=C2=A0 impact&quot;)</blockquote><div><br></div><div>About 1.2 million.</di=
v><div><a href=3D"https://github.com/search?q=3D%28md5+OR+md5_file+OR+sha1+=
OR+sha1_file%29+language%3APHP+&amp;type=3Dcode">https://github.com/search?=
q=3D%28md5+OR+md5_file+OR+sha1+OR+sha1_file%29+language%3APHP+&amp;type=3Dc=
ode</a><br><p>The proposed deprecation of these functions in PHP due to the=
ir cryptographic insecurities seems to overlook their valid non-cryptograph=
ic applications. If we consider the context, the scope of cryptographic usa=
ge is already quite specific. We&#39;re talking about end users who are rol=
ling their own security implementations and are unaware of the security ris=
ks but somehow know how to use these functions without reading the document=
ation and warnings.</p><p>The number of people who fall into this specific =
category is quite small. Yet, this change is being proposed for their sake.=
 It&#39;s important to note that these same users could/will easily make ot=
her security mistakes regardless of this deprecation.</p><p>On the other ha=
nd, who will be impacted by these deprecations? Potentially everyone, as th=
ese are included in many projects and in many vendor packages.=C2=A0 It&#39=
;s busy work for the people who aren&#39;t affected.=C2=A0 Sure, eventually=
, it will all be sorted out as CI warnings slowly subside because of this.<=
/p><p>Reasons such as GIT and most cloud storages using these functions sho=
uld be enough to spare them. Example:=C2=A0<a href=3D"https://rclone.org/ov=
erview/">https://rclone.org/overview/</a></p><p>The point is that there are=
 several reasons in 2024 to use md5 and sha1. Granted hashing passwords isn=
&#39;t one, but we&#39;re past that as a community already. And for the few=
 that aren&#39;t, I&#39;d argue there is no saving.</p><p>Thanks,<br>Peter<=
/p></div></div></div>

--000000000000b42f27061df64cec--