Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124687
Message-ID: <3625ee68-da2b-4887-b8a2-a20ec65844e3@bastelstu.be>
Date: Tue, 30 Jul 2024 21:00:05 +0200
Precedence: bulk
MIME-Version: 1.0
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
To: "Rowan Tommins [IMSoP]" <imsop.php@rwec.co.uk>,
 PHP internals <internals@lists.php.net>
References: <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
 <95147d9d-d6e8-4396-bf0b-409c33679f90@bastelstu.be>
 <CAPrKfG4TijmZ_N9512_Fk9MBUNg=E6PjNTy-bCbV8CAj9_wX8A@mail.gmail.com>
 <6c0baa01-68e5-4d74-bc4e-d6830ab5076d@bastelstu.be>
 <825ca9ca-68c9-4073-9864-ed10d3dacaa7@app.fastmail.com>
Content-Language: en-US
In-Reply-To: <825ca9ca-68c9-4073-9864-ed10d3dacaa7@app.fastmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=C3=BCsterhus?=)

Hi

On 7/26/24 15:13, Rowan Tommins [IMSoP] wrote:
> On Fri, 26 Jul 2024, at 12:58, Tim Düsterhus wrote:
>> I think you are expecting a little too much from a beginner that is
>> following "the modern PHP tutorial" if you expect them to critically
>> question whether the tutorial is actually good or not. They are likely
>> already struggling with syntax and explaining the difference between
>> "if" and "while". You wouldn't believe how often I've heard the term
>> "if-Schleife" (if loop) in German.
> 
> I think you are expecting a little too much from a beginner if you think they will see the message "md5() is deprecated", and research up to date advice on hashing algorithms, rather than asking ChatGPT how to make the code work, and replacing it with "hash('md5', ...)".

I am not expecting that from a beginner. I am expecting two things:

1. That the beginner switches to a tutorial that does not emit any error 
messages or warnings, because they realize that the tutorial is not as 
good as it claims to be.

2. That (1) leads to the outdated tutorials falling out of favor with 
regards to search engines or alternatively that the outdated tutorials 
are updated to no longer be outdated.

>> CRC32 does not claim to be a cryptographically secure hash algorithm.
>> Its use case is completely different.
> 
> As an inexperienced user looking at the PHP manual for hash() and hash_algos(), how would I know that? It's right there in the list, just after something called "adler32".
> 

I expect the inexperienced user to look at existing tutorials or code 
snippets, rather than the reference documentation: If they are 
inexperienced, they would not even know what to look for in the 
documentation.

That also ties into (1): I hope that the deprecation results in better 
tutorials / making bad tutorials less attractive.

Of course that doesn't mean we shouldn't improve the documentation, and 
I'm seeing that Christoph and Jim already started doing so.

>> I'm seeing the sarcasm indicator, but I'm compelled to point out that
>> SHA-256 and SHA-512 are both SHA-2. If one is broken, it is likely that
>> the other is as well.
> 
> Again, you know that, but do the users you're trying to help by deprecating sha1()? I'm a reasonably experienced developer, and I have no idea why SHA-512 would exist if it's not in some way "better" than SHA-256.
>

See above. Also: Really any choice from the SHA-2 or SHA-3 family is 
better than both MD5 and SHA-1 and I would expect users to generally 
gravitate towards things they have heard about before and you really 
need to try hard not to have heard about SHA-256 before. Wikipedia is 
also helpful regarding this topic.

Best regards
Tim Düsterhus