Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124613
Feedback-ID: id5114917:Fastmail
User-Agent: Cyrus-JMAP/3.11.0-alpha0-582-g5a02f8850-fm-20240719.002-g5a02f885
Precedence: bulk
MIME-Version: 1.0
Message-ID: <825ca9ca-68c9-4073-9864-ed10d3dacaa7@app.fastmail.com>
In-Reply-To: <6c0baa01-68e5-4d74-bc4e-d6830ab5076d@bastelstu.be>
References: 
 <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
 <95147d9d-d6e8-4396-bf0b-409c33679f90@bastelstu.be>
 <CAPrKfG4TijmZ_N9512_Fk9MBUNg=E6PjNTy-bCbV8CAj9_wX8A@mail.gmail.com>
 <6c0baa01-68e5-4d74-bc4e-d6830ab5076d@bastelstu.be>
Date: Fri, 26 Jul 2024 14:13:10 +0100
To: "PHP internals" <internals@lists.php.net>
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
Content-Type: text/plain;charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: imsop.php@rwec.co.uk ("Rowan Tommins [IMSoP]")

On Fri, 26 Jul 2024, at 12:58, Tim D=C3=BCsterhus wrote:
> I think you are expecting a little too much from a beginner that is=20
> following "the modern PHP tutorial" if you expect them to critically=20
> question whether the tutorial is actually good or not. They are likely=20
> already struggling with syntax and explaining the difference between=20
> "if" and "while". You wouldn't believe how often I've heard the term=20
> "if-Schleife" (if loop) in German.

I think you are expecting a little too much from a beginner if you think=
 they will see the message "md5() is deprecated", and research up to dat=
e advice on hashing algorithms, rather than asking ChatGPT how to make t=
he code work, and replacing it with "hash('md5', ...)".


> CRC32 does not claim to be a cryptographically secure hash algorithm.=20
> Its use case is completely different.

As an inexperienced user looking at the PHP manual for hash() and hash_a=
lgos(), how would I know that? It's right there in the list, just after =
something called "adler32".


> I'm seeing the sarcasm indicator, but I'm compelled to point out that=20
> SHA-256 and SHA-512 are both SHA-2. If one is broken, it is likely tha=
t=20
> the other is as well.

Again, you know that, but do the users you're trying to help by deprecat=
ing sha1()? I'm a reasonably experienced developer, and I have no idea w=
hy SHA-512 would exist if it's not in some way "better" than SHA-256.


Regards,
--=20
Rowan Tommins
[IMSoP]