Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:79555
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <5487E91D.6070602@fedoraproject.org>
References: <CAPKwhwsOZiGPkvEtXYCBX3dJP3SJ=PTrwqRtQWVzX3SegK6jsg@mail.gmail.com>
	<5487E91D.6070602@fedoraproject.org>
Date: Thu, 11 Dec 2014 17:53:37 +1100
Message-ID: <CAEZPtU5M78QUK7AWd+499wgRgBUY306_-8sprd=C2Y=r4vchZw@mail.gmail.com>
To: Remi Collet <remi@fedoraproject.org>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] libmcrypt: abandonware?
From: pierre.php@gmail.com (Pierre Joye)

hi Remi,

On Wed, Dec 10, 2014 at 5:33 PM, Remi Collet <remi@fedoraproject.org> wrote=
:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Le 05/12/2014 17:17, Scott Arciszewski a =C3=A9crit :
>> Hi PHP Internals,
>>
>> I've been trying to get in contact with the maintainers of
>> libmcrypt, but every response I've gotten was, "Oh, I haven't been
>> a part of that for years."
>>
>> http://sourceforge.net/projects/mcrypt/files/Libmcrypt/
>>
>> The last update to libmcrypt was in 2007. There are bug fixes in
>> their issue tracker collecting dust.
>
> Having a dead upstream for crypto API is a critical issue :(
>
> FYI some downstream (ex RHEL) don't even provide this library.
> Already too much crypto libraries, and it will be a mess to provide a
> dead project in an Enterprise distribution.
>
> So php/mcrypt also not available.
>
> But most applications. which use it, usually have alternative, and
> make it optional (ex phpMyAdmin 4.3 now even use openssl as first choice)=
.
>
> We probably have enough crypto API in PHP, and we probably should mark
> this one as deprecated / unmaintained in 5.x, and move it to PECL (7.x).

I think it is yet another candidate for removal, like imap. It could
became even more critical if some serious flaws will be found in
libmcrypt and never get fixed.

Cheers,
--=20
Pierre

@pierrejoye | http://www.libgd.org