Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124605
Message-ID: <89096756-9f50-4b10-9630-d3b18e4b9c29@gmx.de>
Date: Fri, 26 Jul 2024 13:11:39 +0200
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
Content-Language: de-DE
To: "Gina P. Banyard" <internals@gpb.moe>, Peter Stalman <sarkedev@gmail.com>
Cc: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>,
 Derick Rethans <derick@php.net>, PHP internals <internals@lists.php.net>
References: <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
 <95147d9d-d6e8-4396-bf0b-409c33679f90@bastelstu.be>
 <CAPrKfG4TijmZ_N9512_Fk9MBUNg=E6PjNTy-bCbV8CAj9_wX8A@mail.gmail.com>
 <CAPrKfG7Hi0SGbLA31V-9KjHM50QaX+Q=PptuO4+VMOrz7d9eBA@mail.gmail.com>
 <G9IiDe18a2ZhrXPA-zljNZsawKCZxlTn2ACfJpM32scdRkRflZ2rM6Ra8z88ZYDczomex4pffxZMpVhEjdB74YQXXNyqJkd7rQdDGA14HC0=@gpb.moe>
In-Reply-To: <G9IiDe18a2ZhrXPA-zljNZsawKCZxlTn2ACfJpM32scdRkRflZ2rM6Ra8z88ZYDczomex4pffxZMpVhEjdB74YQXXNyqJkd7rQdDGA14HC0=@gpb.moe>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
UI-OutboundReport: notjunk:1;M01:P0:6Ucx5SngoEo=;WvBMxazf5bSdpdCidTwKgoj8tz1
 JSVdUcLMTAEfe/lLRLA0h0g5fs0lLsvggHVzEuQ0OEtOhrMDoCc0c9lQKAYCFTDUPFDlP0ZJP
 dZ/kBxELpbOgPqEUPLr1LivuGAaUbNK08xZDngrqefdeg7eSE8AmU+nRqPW6lRFbp4mmwr02A
 RUk3G16WfeQTAqVJGpKoomWC3zVHAO+8yn8GSXzo5AJ/jgQO5rb0U5GU18QaDRQ96VJJYz3kM
 1QVjxyH/LFRRQPDDYp4H7drs8YFa7B8nKWDpUtNxd/kN3AuZwXSGz8Q0rcPEdqg0KGSHaObeF
 gyFACTZflnaJ23NYGc4g37Q3PM2GaYSCCf5YPpbTpRCKXOzHiQkxMQOj4pU1xm4aUeXmch4mi
 +rAkBgIaSEh5bO/7LJEhYQSyQswQO+UaD+2hT2j1G4nwMyUoME4DmJKq4q9f9yUWrJ9u+1coF
 cV3wJeoxC++9Qhnoi2cVbpfAVFxYXVZkF4RNLE0B7DGD80/WB8EYiygWN51GdGQyz20V1fxof
 kjeWYuYWEIfyrPZoS+Su0ulw599Wkukqq+RnfKXJ7+U2BHb3yWHG2QW+cWSh+kIShsA5riDjF
 M4ybr9HFWnhsXGkZcQ+brf4xCaMN0IRoBwEREAOTv4X9c7vT9pRMcKcQzT8YbLeOihZyh4oCS
 XpjhCYGnJ55swNyLUlI6B55VIl4YoZDa2vLtxYqtdw9A4esjl2oTwRWiG24qYVMWVI+Dqv5wV
 ea83ZAWhezO9i0+fnoc4irfQgK+ehNUQRxwV0Vsls9PvrjRvxBqClOMmLtJVDJcah1YOtf1ME
 gYA0go8IEe1KWD+34qsRuxGJeEEkxABfItoC/wCndfw9I=
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 26.07.2024 at 12:03, Gina P. Banyard wrote:

> Stephen Rees-Carter, a security expert that has performed countless security audits on Wordpress and Laravel websites, would like to disagree with the fact that it is not enough of a good reason. [1]
> A warning on a documentation page is useless, as nobody is forced to read it.

Right, but even a deprecation notice is likely to be ignored by those
(either use the shut-up operator, or use hash("md5), or maybe a polyfill
to support old PHP versions), so the deprecation wouldn't help in such
cases.

(I've recently seen a new release of a software which still uses
<https://www.openwall.com/phpass/>.  Apparently, the notice to prefer
the password_*() API has been ignored or overlooked.)

On the other hand, I'm quite confident that a deprecation could be
useful for some developers, who would at least reconsider the use of
md5/sha1 hashes, but just have overlooked this; although some static
analysis should report respective issues.  However, there is certainly
code without any static analysis, where at least this discussion appears
to be helpful, e.g. our php-sdk-binary-tools might reconsider their use
of md5() and md5(uniqid())[2].

Note that I'm not against these deprecations, but I'm also not strongly
in favor.  I see valid arguments from both proponents and opponents.

> [1] https://x.com/valorin/status/1816593881791860963

[2] <https://github.com/php/php-sdk-binary-tools/issues/21>

Cheers,
Christoph