Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82191
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.50 as permitted sender)
Message-ID: <54D7EFF3.8070408@gmail.com>
Date: Sun, 08 Feb 2015 15:23:31 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Tom Worster <fsb@thefsb.org>, Derick Rethans <derick@php.net>, 
 php-internals <internals@lists.php.net>
References: <D0FCED17.5D2CB%fsb@thefsb.org> <B36498AB-D50F-4718-8C13-A4957078BCA3@php.net> <D0FCFD05.5D2E3%fsb@thefsb.org>
In-Reply-To: <D0FCFD05.5D2E3%fsb@thefsb.org>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Remove mycrypt. Vote ends Monday
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> On 2/8/15, 11:38 AM, "Derick Rethans" <derick@php.net> wrote:
>>
>> Btw, I only voted no because I don't think we should just remove it.  A
>> reimplementation of its APIs on top of eg. Open SSL makes sense. And that
>> I'd vote yes for.
> 
> This idea makes me nervous. It doesn't sound at all easy and will take a
> lot of time and effort. Commitment to maintaining a security lib over long
> term is a big deal.

The better alternative you proposing is having no mcrypt extension at
all in core. Which means the users have three choices:

1. Rewrite all their code to a different API (with accompanying costs in
development, QA, stability, maintenance of code base now having two
APIs, etc.)
2. Do not upgrade to PHP 7
3. Use the same extension from PECL

Option 1 however is very expensive, so it is unlikely most of the users
will choose it.

Both options 2 and 3 make the security situation for an average user
worse, as not upgrading means eventually falling out of supported
versions - and we're doing *very bad* in this regard, over 46% of the
users run EOLed versions now and less than 1% run current stable - and
running PECL one means most core devs will pay next to zero attention to
it.

-- 
Stas Malyshev
smalyshev@gmail.com