Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124680
Feedback-ID: id5114917:Fastmail
Date: Mon, 29 Jul 2024 23:04:35 +0100
To: internals@lists.php.net
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
User-Agent: K-9 Mail for Android
In-Reply-To: <5a032505-e654-414d-ac00-5c9f2a17495f@varteg.nz>
References: <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe> <1a88918e-e808-d778-45e1-53797660e093@php.net> <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com> <c03eb187-bd21-4a4b-9faf-8d0243eaa994@varteg.nz> <aa6bc7aa-28d9-40ca-974f-65075adb6199@rwec.co.uk> <3563cf9b-8eab-4c82-b525-a5d2f9a767bb@varteg.nz> <38920A4B-790D-48C7-B2F6-C49D3F506232@rwec.co.uk> <951AA94A-8C07-446E-925C-15BB97F146A4@newclarity.net> <c51d4933-15e2-4525-853f-fc41d7865139@varteg.nz> <CD092393-CDC4-4536-85F1-9324C664C316@rwec.co.uk> <5a032505-e654-414d-ac00-5c9f2a17495f@varteg.nz>
Message-ID: <A612CECC-1DB3-454F-8700-C98B24EED9ED@rwec.co.uk>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: imsop.php@rwec.co.uk ("Rowan Tommins [IMSoP]")



On 29 July 2024 21:00:37 BST, Morgan <weedpacket@varteg=2Enz> wrote:

>That still doesn't protect md5() and sha1() from deprecation; if there is=
 a PHP-mandated default hash algorithm that gets its own name, then users s=
hould be encouraged to use that one, which means not leaving the others lyi=
ng around to for it to hide among=2E Anyone who needs to continue to suppor=
t the old algorithms can =2E=2E=2E use hash()=2E

Absolutely=2E If someone wants to write a proposal to do that, I'd probabl=
y be willing to support it=2E Until then, there's no reason to disrupt user=
s of the existing functions, when there's no clear message of what they are=
 doing wrong=2E


>When it comes to advice about which to use, that seems less the purview o=
f a PHP reference manual for the function, and more something like
>https://csrc=2Enist=2Egov/projects/hash-functions

If hash() exists only as a function for power users who already know somet=
hing about the subject, then yes, maybe=2E If we're telling everyone to loo=
k it up when they thought they were going to use sha1(), then we need to gi=
ve them something to read when they get there=2E

Regards,
Rowan Tommins
[IMSoP]