Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124584
Message-ID: <c03eb187-bd21-4a4b-9faf-8d0243eaa994@varteg.nz>
Date: Thu, 25 Jul 2024 10:01:15 +1200
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
To: internals@lists.php.net
References: <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
Content-Language: en-GB
In-Reply-To: <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
From: weedpacket@varteg.nz (Morgan)

On 2024-07-24 15:58, Peter Stalman wrote:
> On Mon, Jul 22, 2024 at 9:06 AM Derick Rethans <derick@php.net 
> <mailto:derick@php.net>> wrote:
> 
>     - Deprecate md5(), sha1(), md5_file(), and sha1_file() (just says
>     "large
>        impact")
> 
> 
> About 1.2 million.
> https://github.com/search?q=%28md5+OR+md5_file+OR+sha1+OR+sha1_file%29+language%3APHP+&type=code <https://github.com/search?q=%28md5+OR+md5_file+OR+sha1+OR+sha1_file%29+language%3APHP+&type=code>
> 
> 
> On the other hand, who will be impacted by these deprecations? 
> Potentially everyone, as these are included in many projects and in many 
> vendor packages.  It's busy work for the people who aren't affected.  
> Sure, eventually, it will all be sorted out as CI warnings slowly 
> subside because of this.
> 
> Reasons such as GIT and most cloud storages using these functions should 
> be enough to spare them. Example: https://rclone.org/overview/ 
> <https://rclone.org/overview/>
> 
> The point is that there are several reasons in 2024 to use md5 and sha1. 
> Granted hashing passwords isn't one, but we're past that as a community 
> already. And for the few that aren't, I'd argue there is no saving.
> 
And they would still be available as hash("md5") and hash("sha1"); the 
only reason they're called out as their own distinct functions today is 
historical inertia.