Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90266
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.44 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAAyV7nEF83hPdYMcQi5M9Ze7dCNgqeTSq8S9y28knNxOEq=9Pw@mail.gmail.com>
References: <CAKws9z1g24rD=t92+9xKtO=3PuwQ3_N=L36gmVMqCC84CoqipQ@mail.gmail.com>
	<CAEZPtU7-Lk=jGsTQgRZOvBpcPPgdX3V-23=3_k9CXbmxU77V1A@mail.gmail.com>
	<CAKws9z248Kj=0qTLPZik0Ki1_zGPq+4fr6HQi_keeVCso1S4eQ@mail.gmail.com>
	<CAEZPtU7NpPWn0MsXjbFw9gNvRxm98XkHFk=RvQ1v0hRqcdGS3w@mail.gmail.com>
	<CAAyV7nEF83hPdYMcQi5M9Ze7dCNgqeTSq8S9y28knNxOEq=9Pw@mail.gmail.com>
Date: Thu, 7 Jan 2016 23:33:42 +0700
Message-ID: <CAEZPtU5igmYOf9fnMnKFZ1uO9KQk0Zn4F66fmPDR5r99zAiUbg@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>
Cc: Scott Arciszewski <scott@paragonie.com>, PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] Libsodium
From: pierre.php@gmail.com (Pierre Joye)

On Thu, Jan 7, 2016 at 11:30 PM, Anthony Ferrara <ircmaxell@gmail.com> wrote:
> Pierre,
>
>>> Even if we axe mcrypt and in with a net-gain of 0 extensions, you'd
>>> see it as a risk?
>>
>> Except that we already refused to kill mcrypt, and it is not like I
>> did not try to convince us to kill it.
>
> We decided not to kill it for 7.0. That doesn't mean it got a permanent buy...

It is pretty much a 7.x permanent buy, yes. And that's why we pushed
hard to kill it before. Unless we consider killing extensions in minor
releases a non BC break ;-)

>>> Let me state this clearly: I'm personally not going to bother pushing
>>> for a pluggable crypto API if the only option is to use OpenSSL and
>>> all its legacy cruft. I especially don't have lukewarm feelings
>>> towards RSA or ECDSA, which are your only real options with it.
>>>
>>> I feel that it simply would not be a worthwhile use of my time to do
>>> so. If Internals decides "no libsodium" but "yes pluggable crypto
>>> API", you'll have to find someone else to spearhead it.
>>
>> Sorry, my point was not clear.
>>
>> I do like the concept of a pluggable crypto API. Very much. I said it
>> before and I say it again. I love the concept and will do what I can
>> to support it :)
>>
>> What I do not like too much is the addition of an extension with
>> (relatively) low level functions for one specific library. It does not
>> really matter how good is this specific library, I simply do not see
>> such addition as a good strategic move.
>
> I agree with you in principle, but in this particular case I think
> that there's enough justification considering how measurably bad
> mcrypt is, and how little some people trust openssl. That leaves no
> room in core. So in this case I think it *may* be worth it to add it.

If the pluggable API one won't show up before 7.2/3, yes. If we
potentially can sort it out for 7.1/2/3, then no.

Cheers,
-- 
Pierre

@pierrejoye | http://www.libgd.org