Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124660
Content-Type: text/plain;
	charset=utf-8
Precedence: bulk
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.8\))
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
In-Reply-To: <38920A4B-790D-48C7-B2F6-C49D3F506232@rwec.co.uk>
Date: Sat, 27 Jul 2024 23:54:10 -0400
Cc: PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <951AA94A-8C07-446E-925C-15BB97F146A4@newclarity.net>
References: <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
 <c03eb187-bd21-4a4b-9faf-8d0243eaa994@varteg.nz>
 <aa6bc7aa-28d9-40ca-974f-65075adb6199@rwec.co.uk>
 <3563cf9b-8eab-4c82-b525-a5d2f9a767bb@varteg.nz>
 <38920A4B-790D-48C7-B2F6-C49D3F506232@rwec.co.uk>
To: "Rowan Tommins [IMSoP]" <imsop.php@rwec.co.uk>,
 Morgan <weedpacket@varteg.nz>
From: mike@newclarity.net (Mike Schinkel)

> On Jul 27, 2024, at 8:36 AM, Rowan Tommins [IMSoP] =
<imsop.php@rwec.co.uk> wrote:
> On 27 July 2024 00:58:17 BST, Morgan <weedpacket@varteg.nz> wrote:
>>=20
>> I'm not talking about the MD5 or SHA1 algorithms or whether they =
should or shouldn't be used. I'm just talking about the functions =
themselves. md5(), md5_file(), sha1(), and sha1_file(). They only exist =
because there wasn't the generic hash algorithm extension when they were =
created.
>=20
> I understand what is being claimed (and you're not the only one =
claiming it), I'm just not convinced it's true. I think they have =
standalone functions for the same reason we added str_contains and =
str_starts_with - because it's convenient to have straightforward =
functions for common use cases.
>=20
> The hash() function is like a 60-piece set of interchangeable =
screwdriver heads, which only professionals and enthusiasts need; md5() =
and sha1() are like the flat-head and Phillips screwdrivers that =
everyone has in a drawer somewhere.
>=20
> The thing that always surprises me is that PHP *doesn't* have a =
standalone function for SHA-256, which is the only other I've ever used.=20=

>=20
> To continue the analogy, we're missing a Pozidriv screwdriver, so =
people are misusing the Phillips one. The RFC is suggesting that we take =
away their flat-head and Phillips screwdrivers, and leave them with the =
60-piece set, and no instructions.=20
>=20
> My suggestion is we instead give them a Pozidriv screwdriver, and =
write some tips on how to use it correctly.=20

I rise in support of this mindset. =20

Some of us like to draw inspiration from other languages, and in that =
vein one of the things that makes Go such a joy to program in is the =
fact the Go team continues to add "convenience" functions with every new =
6 month release.=20

Many (all?) of the functions the Go team adds could have been written in =
"userland" but they represent such common use-cases that the Go team =
decided to make them easy and obvious. They even soft deprecate =
functions and structs that are not ideal and replace them with ones with =
better names and better signatures. If Go had started with the string =
and array functions PHP has today they would almost certainly replaced =
them by now, ~15 years into Go's tenure.

It is a shame that PHP's culture is so hostile towards adding =
functionality that could also be added in userland, especially when that =
functionality would simplify and standardize algorithms that are =
non-obvious and/or too easy to implement incorrectly. If the PHP culture =
embraced moving common use-cases into core it would make PHP much more =
pleasurable to program in and make it much less likely that PHP programs =
would have bugs and/or security vulnerabilities.

> On Jul 27, 2024, at 6:14 PM, Morgan <weedpacket@varteg.nz> wrote:
> Why a SHA2 algorithm? Why not a SHA3 one? How about standalone =
functions for both, and then when SHA4 comes along (as it inevitably =
will) another standalone function for one of its variants?

Yes. Yes, And Yes.

And ideally within a `\PHP` namespace. =20

-Mike

P.S. But as we know a standardized `\PHP` namespace is apparently never =
going to happen although for the life of me I still cannot understand =
why not =E2=80=94 and I was here during the voting down of that RFC ~4 =
years ago =E2=80=94 given how so many other languages had done the =
equivalent.