Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91679
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: unknown (pb1.pair.com: domain php.net does not designate 66.111.4.27 as permitted sender)
Message-ID: <1458063647.1202380.549998114.3D69249B@webmail.messagingengine.com>
To: Ferenc Kovacs <tyra3l@gmail.com>,
 Scott Arciszewski <scott@paragonie.com>
Cc: PHP Internals <internals@lists.php.net>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"
Date: Tue, 15 Mar 2016 12:40:47 -0500
In-Reply-To: <CAH-PCH6gygwqcUGfV4G8aqYKysBmLqnuEjV3A2MJNWjQesprbA@mail.gmail.com>
References: <CAKws9z3rUE5+v+H_odY98=SKRvtwjLCtd1XHbhkHtxpC_G=PZA@mail.gmail.com>
 <CAH-PCH5zvY_im+zh6cjUjGYZo+fk2ubeg2LWe1pUM_fHf+2JnA@mail.gmail.com>
 <CAKws9z0dra7Mz7HnZ3RCqJ3b=7Ob9OSj__fe3CUEE5QhK1N8ZQ@mail.gmail.com>
 <CAH-PCH6gygwqcUGfV4G8aqYKysBmLqnuEjV3A2MJNWjQesprbA@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC][VOTE] Deprecate then Remove Mcrypt
From: willfitch@php.net (Will Fitch)



On Tue, Mar 15, 2016, at 12:18 PM, Ferenc Kovacs wrote:
> On Tue, Mar 15, 2016 at 6:13 PM, Scott Arciszewski <scott@paragonie.com>
> wrote:
>=20
> > On Tue, Mar 15, 2016 at 1:09 PM, Ferenc Kovacs <tyra3l@gmail.com> wrote:
> >
> >>
> >>
> >> On Tue, Mar 15, 2016 at 5:11 PM, Scott Arciszewski <scott@paragonie.co=
m>
> >> wrote:
> >>
> >>> Hi PHP team,
> >>>
> >>> I've opened the vote on https://wiki.php.net/rfc/mcrypt-viking-funeral
> >>> which aims to deprecate ext/mcrypt in PHP 7.1 then remove it in 7.1+1
> >>> (i.e.
> >>> make it only installable via PECL).
> >>>
> >>> In the interim, I'll be developing a (MIT licensed) decryption-only
> >>> userland implementation of the mcrypt ciphers so people can migrate t=
heir
> >>> code towards something better.
> >>>
> >>> This vote is opened on March 15th, 2016 and will close March 22th at
> >>> 17:00
> >>> UTC.
> >>>
> >>> (Sidenote: Apologies for the brief unannounced hiatus from participat=
ing
> >>> here.)
> >>>
> >>> Scott Arciszewski
> >>> Chief Development Officer
> >>> Paragon Initiative Enterprises <https://paragonie.com>
> >>>

In the RFC:

"Removal from core: The following major/minor version (7.2.0 or 8.0.0)"

and then

"Vote =E2=80=9CYes=E2=80=9D to raise an E_DEPRECATED notice in PHP 7.1 when=
 any mcrypt
function is used and to remove the extension from core in 7.1+1."

Which one is it? I feel removing at 7.2 would be too soon.  I agree that
the abandonware is a nuisance, but many developers using ext/mcrypt have
no idea of this.  Raising an E_DEPRECATED in the next 7.1.x, then
removing in 7.2 is just too soon.=20=20


> >>
> >> hi,
> >>
> >> first some formalities:
> >> please make sure to follow the process stated at
> >> https://wiki.php.net/rfc/voting
> >> New RFCs first should be proposed for discussion and it would require a
> >> bit of vetting before it can be moved to the voting phase.
> >> I can see your thread "mcrypt extermination plan" but I can't find any
> >> mail linking to the rfc page before this one instantly moving it into
> >> voting phase.
> >> I would suggest cancelling the vote and waiting a bit(I would say 2
> >> weeks) for any discussion/feedback on the rfc itself.
> >> Personally I also don't like going with the minimal one week voting
> >> period as it is too easy for somebody to miss the chance to vote becau=
se of
> >> vacation or just a busy week.
> >> =E2=80=8B=E2=80=8B
> >>
> >> I also wanted to mention that some of unsupported ciphers listed under
> >> https://wiki.php.net/rfc/mcrypt-viking-funeral#backward_incompatible_c=
hanges
> >> can in fact be supported by openssl as it(openssl) allows the usage of
> >> plugable engines.
> >> --
> >> Ferenc Kov=C3=A1cs
> >> @Tyr43l - http://tyrael.hu
> >>
> >
> >
> >
> > https://wiki.php.net/rfc/mcrypt-viking-funeral?do=3Drevisions <- already
> > been under discussion for a while
> >
> > =E2=80=8B> =E2=80=8BI also wanted to mention that some of unsupported c=
iphers listed
> > under
> > https://wiki.php.net/rfc/mcrypt-viking-funeral#backward_incompatible_ch=
anges
> >  can in fact be supported by openssl as it(openssl) allows the usage of
> > plugable engines.
> >
> > Can be supported !=3D=3D is currently supported out of the box.
> >
> > Scott Arciszewski
> > Chief Development Officer
> > Paragon Initiative Enterprises <https://paragonie.com/>
> > =E2=80=8B
> >
> >
> sure, but I still think that it would worth mentioning the possibility
> instead of stating that there is no migration path available for those
> ciphers.
>=20
> --=20
> Ferenc Kov=C3=A1cs
> @Tyr43l - http://tyrael.hu