Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71899
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.174 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAH8Mpn=3D7bSWQicgaRPKBtriqkk08p8Jh0+ud6N8BEbJXAu7w@mail.gmail.com>
References: <CAH8MpnmVnYiw7nJ11v+h=31+p+HBopBjJ80afpZkW-bW1LJb2A@mail.gmail.com>
 <CALwr1GnCqXZUk5zDfmtBa8cqmZS9qiGxVtc0JAbpShsJPodhtw@mail.gmail.com>
 <CAH8Mpn=1OMhKjMPAFGQ6hF309zFN4=ZFMZc06ZQvT8S2vX4hJw@mail.gmail.com>
 <824758DB-57D8-4B4B-BECD-E1F12531FDE0@rouvenwessling.de> <CAH8Mpn=3D7bSWQicgaRPKBtriqkk08p8Jh0+ud6N8BEbJXAu7w@mail.gmail.com>
Date: Sat, 1 Feb 2014 06:47:50 +0900
Message-ID: <CAGa2bXaKiKzQvEpb-8Y0YtXip4TGwNXsErkwEgOrocyP7WHa8w@mail.gmail.com>
To: Daniel Lowrey <rdlowrey@gmail.com>
Cc: =?UTF-8?Q?Rouven_We=C3=9Fling?= <me@rouvenwessling.de>, 
	=?UTF-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0117769184770404f14b2250
Subject: Re: [PHP-DEV] Improved TLS Defaults
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e0117769184770404f14b2250
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Daniel,

On Fri, Jan 31, 2014 at 2:17 AM, Daniel Lowrey <rdlowrey@gmail.com> wrote:

> On Thu, Jan 30, 2014 at 12:11 PM, Rouven We=C3=9Fling <me@rouvenwessling.=
de
> >wrote:
>
> >
> > On 30.01.2014, at 04:15, Daniel Lowrey <rdlowrey@gmail.com> wrote:
> >
> >  As I mentioned in the updated RFC
> > text I think it makes sense to deprecate the specific wrappers in 5.6 a=
nd
> > look to remove them in 5.7 as they're really unnecessary in light of th=
e
> > ability to specify flags for the specific individual protocols you wish
> to
> > use on a given stream.
> >
> >
> > Please don't. By deprecating in 5.6 and removing in 5.7 (which would be
> > faster than anything before) you'd royally screw everyone skipping a
> > version - something that gets increasingly likely with the faster relea=
se
> > cycle.
> >
> > I'd suggest deprecating them now with this RFC and remove it in PHP 6, =
if
> > PHP6 doesn't come around they could still be removed in a future RFC.
> >
> > Best regards
> > Rouven
> >
>
> Sounds good to me. Will update the RFC for deprecation of the sslv2:// an=
d
> sslv3:// stream wrappers in 5.6 with removal planned for PHP 6.
>

I agree that obsolete protocol should be deprecated.
However, removal is totally different. I would like to have *long* period
before
removing any feature from PHP whenever it is possible. It could be used as
toy
for security experiments as well as for incredibly old internal servers
never updated.
 Perhaps, remove them for PHP 7 or even 8?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e0117769184770404f14b2250--