Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124631
Message-ID: <3563cf9b-8eab-4c82-b525-a5d2f9a767bb@varteg.nz>
Date: Sat, 27 Jul 2024 11:58:17 +1200
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
To: internals@lists.php.net
References: <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
 <c03eb187-bd21-4a4b-9faf-8d0243eaa994@varteg.nz>
 <aa6bc7aa-28d9-40ca-974f-65075adb6199@rwec.co.uk>
Content-Language: en-GB
In-Reply-To: <aa6bc7aa-28d9-40ca-974f-65075adb6199@rwec.co.uk>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
From: weedpacket@varteg.nz (Morgan)

On 2024-07-26 09:34, Rowan Tommins [IMSoP] wrote:
> On 24/07/2024 23:01, Morgan wrote:
>> And they would still be available as hash("md5") and hash("sha1"); the 
>> only reason they're called out as their own distinct functions today 
>> is historical inertia. 
> 
> 
> I don't agree that the reasons for including standalone functions are 
> "historical". The RFC itself gives a good reason for having such functions:
> 

By "historical" I mean just md5() was in PHP in version 3, sha1() was 
added in 4.3, and hash() (via PECL) in 5.1.2. md5(), md5_file(), sha1(), 
and sha1_file() could have been deprecated when hash() became a core PHP 
extension in version 7, and now (or when looking at targeting 9) would 
have been about when we'd be discussing removing them.

I'm not talking about the MD5 or SHA1 algorithms or whether they should 
or shouldn't be used. I'm just talking about the functions themselves. 
md5(), md5_file(), sha1(), and sha1_file(). They only exist because 
there wasn't the generic hash algorithm extension when they were created.

Why do they get this special treatment today?

(PS: crc32b also implemented via hash() as well as having its own function.)

> 
> A new user being told "don't use sha1(), use hash() and pick from this 
> list" is more likely to say "ah, there's sha1, jolly good" than spend an 
> afternoon reading cryptography journals. There's no pit of success to 
> fall into.
> 
A new user skimming through the list of string functions is likely to 
see see "md5()" there and think "ah, there's a hash function, jolly good".