Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124595
Date: Thu, 25 Jul 2024 18:22:17 -0400
To: =?utf-8?Q?Rowan_Tommins_=5BIMSoP=5D?= <imsop.php@rwec.co.uk>
Cc: Internals <internals@lists.php.net>
Message-ID: <47EDE48C-5462-4043-9F3C-CCCD22FE4718@edison.tech>
In-Reply-To: <aa6bc7aa-28d9-40ca-974f-65075adb6199@rwec.co.uk>
References: <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
 <c03eb187-bd21-4a4b-9faf-8d0243eaa994@varteg.nz>
 <aa6bc7aa-28d9-40ca-974f-65075adb6199@rwec.co.uk>
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="66a2d019_6b8b4567_60ee"
From: mike@newclarity.net (Mike Schinkel)

--66a2d019_6b8b4567_60ee
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

     
 

 
 
 
>  
> On Jul 25, 2024 at 5:35 PM,  <Rowan Tommins [IMSoP] (mailto:imsop.php@rwec.co.uk)>  wrote:
>    Rather than force people to use functions that we acknowledge are hard  
>  
>  
>  to use, surely the logical thing is to make the "right" code *easy* to use? Which means if we want people to use SHA-256, let's add a sha256() function to make it easy. This is what password_hash() and password_verify() did right: the functionality was already there in crypt(), but it's hard to use, and harder to use correctly. Providing clearer functions, even though they do the same thing, helps new developers "fall into the pit of success". 
>
>  
 
 
 
 
 

 Yes!    1000% *THIS*.    

 
-Mike
 

 
>  
>  
>  The hash() function isn't quite as confusing as crypt(), but according to the manual, it currently supports 60 different algorithms, most of which I have never heard of. I'm aware that "sha256" is better than "sha1", but should I be aiming higher, and using "sha384", or maybe one of the four flavours of "sha3"? Then there's the fun-sounding "whirlpool", the faintly rude-sounding "snefru", and a bewildering fifteen flavours of "haval". A new user being told "don't use sha1(), use hash() and pick from this list" is more likely to say "ah, there's sha1, jolly good" than spend an afternoon reading cryptography journals. There's no pit of success to fall into. Regards, -- Rowan Tommins [IMSoP] 
>
>  
 
     
--66a2d019_6b8b4567_60ee
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<html><body><div id=3D=22edo-message=22><div></div></div><div id=3D=22edo=
-original=22><blockquote type=3D=22cite=22 style=3D=22margin:1ex 0 0 0; h=
eight: min-content; border-left:1px =23ccc solid;padding-left:0.5ex;=22><=
div>On Jul 25, 2024 at 5:35 PM, &lt;<a href=3D=22mailto:imsop.php=40rwec.=
co.uk=22>Rowan Tommins =5BIMSoP=5D</a>&gt; wrote:<br><span style=3D=22-we=
bkit-tap-highlight-color: transparent; text-align: inherit; background-co=
lor: inherit;=22>Rather than force people to use functions that we acknow=
ledge are hard&nbsp;</span><br></div><div><pre class=3D=22edo-pre=22>to u=
se, surely the logical thing is to make the =22right=22 code *easy* to us=
e=3F

Which means if we want people to use SHA-256, let's add a sha256() =20
function to make it easy.

This is what password=5Fhash() and password=5Fverify() did right: the =20
functionality was already there in crypt(), but it's hard to use, and =20
harder to use correctly. Providing clearer functions, even though they =20
do the same thing, helps new developers =22fall into the pit of success=22=
.</pre></div></blockquote><div id=3D=22edo-meta=22><div id=3D=22edo-signa=
ture=22 style=3D=22font-family: sans-serif, &quot;Helvetica Neue&quot;, H=
elvetica, Arial;=22></div></div><div id=3D=22edo-original=22><br>Yes=21 &=
nbsp;1000% *THIS*.&nbsp;</div><div id=3D=22edo-original=22><br></div><div=
 id=3D=22edo-original=22>-Mike</div><div id=3D=22edo-original=22><br></di=
v><blockquote type=3D=22cite=22 style=3D=22margin:1ex 0 0 0; height: min-=
content; border-left:1px =23ccc solid;padding-left:0.5ex;=22><div><pre cl=
ass=3D=22edo-pre=22>The hash() function isn't quite as confusing as crypt=
(), but according =20
to the manual, it currently supports 60 different algorithms, most of =20
which I have never heard of. I'm aware that =22sha256=22 is better than =20
=22sha1=22, but should I be aiming higher, and using =22sha384=22, or may=
be one =20
of the four flavours of =22sha3=22=3F Then there's the fun-sounding =20
=22whirlpool=22, the faintly rude-sounding =22snefru=22, and a bewilderin=
g =20
fifteen flavours of =22haval=22.

A new user being told =22don't use sha1(), use hash() and pick from this =
=20
list=22 is more likely to say =22ah, there's&nbsp;sha1, jolly good=22 tha=
n spend an =20
afternoon reading cryptography journals. There's no pit of success to =20
fall into.


Regards,

-- =20
Rowan Tommins
=5BIMSoP=5D
</pre></div></blockquote></div></body></html>
--66a2d019_6b8b4567_60ee--