Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:126359
Feedback-ID: ifab94697:Fastmail
Precedence: bulk
MIME-Version: 1.0
Date: Sun, 09 Feb 2025 11:03:55 +0100
To: internals@lists.php.net
Message-ID: <4e41929c-fbd8-44f3-b72d-1b4e6526d001@app.fastmail.com>
Subject: [PHP-DEV] bcrypt warning on long passwords
Content-Type: multipart/alternative;
 boundary=d2d71ed964ff4327971f092425053967
From: rob@bottled.codes ("Rob Landers")

--d2d71ed964ff4327971f092425053967
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hello internals,

I saw the following on hacker-news the other day: https://news.ycombinat=
or.com/item?id=3D42955176

In the article it talks about how many implementations do not emit a war=
ning, and PHP is one of them (though the author didn't cover php explici=
tly).

You can see this play out here: https://3v4l.org/8ih6O

Since adding a warning here would be a BC break, does this need an RFC? =
I'd be happy to implement this and write the RFC if necessary.

=E2=80=94 Rob
--d2d71ed964ff4327971f092425053967
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><title></title><style type=3D"text/css">p.Mso=
Normal,p.MsoNoSpacing{margin:0}</style></head><body><div>Hello internals=
,<br></div><div><br></div><div>I saw the following on hacker-news the ot=
her day:&nbsp;<a href=3D"https://news.ycombinator.com/item?id=3D42955176=
">https://news.ycombinator.com/item?id=3D42955176</a><br></div><div><br>=
</div><div>In the article it talks about how many implementations do not=
 emit a warning, and PHP is one of them (though the author didn't cover =
php explicitly).<br></div><div><br></div><div>You can see this play out =
here:&nbsp;<a href=3D"https://3v4l.org/8ih6O">https://3v4l.org/8ih6O</a>=
<br></div><div><br></div><div>Since adding a warning here would be a BC =
break, does this need an RFC? I'd be happy to implement this and write t=
he RFC if necessary.</div><div><br></div><div id=3D"sig121229152">=E2=80=
=94 Rob<br></div></body></html>
--d2d71ed964ff4327971f092425053967--