Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124591
Message-ID: <68ba999c63215204227eae87af69572d25e6b1b8.camel@ageofdream.com>
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
To: internals@lists.php.net
Date: Thu, 25 Jul 2024 13:28:51 -0400
In-Reply-To: <95147d9d-d6e8-4396-bf0b-409c33679f90@bastelstu.be>
References: 
	<USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
	 <1a88918e-e808-d778-45e1-53797660e093@php.net>
	 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
	 <95147d9d-d6e8-4396-bf0b-409c33679f90@bastelstu.be>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.46.4-2 
Precedence: bulk
MIME-Version: 1.0
From: lists@ageofdream.com (Nick Lockheart)

On Thu, 2024-07-25 at 17:33 +0200, Tim D=C3=BCsterhus wrote:
>=20
> As an example, using md5_file() to implement a cache buster is fine,
> but a less-experienced developer may believe that md5_file() uniquely
> identifies the file contents and use it in a way where strong=20
> collision-resistance against an adversary is required.
>=20
> I'm positive that even existing projects written by experienced=20
> developers would benefit from re-checking if their use of MD5 and
> SHA-1 is actually safe instead of assuming that this is the case,
> when the specific functionality has been untouched for the last 10
> years.

Isn't the philosophy of open source software "tools, not policy"?

I'm in the process of refactoring an old framework and I just found a
use of sha1(). It's being used to generate a unique resource lock. It
doesn't need to be secure, just a fast and random UID.