Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91853
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain paragonie.com designates 209.85.218.48 as permitted sender)
MIME-Version: 1.0
Date: Tue, 22 Mar 2016 13:00:58 -0400
Message-ID: <CAKws9z0ahvvd8z=Y5nSH8EmZPgA-6VMmOMsrc-SZSaPGb28Y-g@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113d76f43d691a052ea628c6
Subject: [RFC][VOTE] Deprecate then Remove Mcrypt Closed (23-6)
From: scott@paragonie.com (Scott Arciszewski)

--001a113d76f43d691a052ea628c6
Content-Type: text/plain; charset=UTF-8

Hi all,

https://wiki.php.net/rfc/mcrypt-viking-funeral

The tally of closing (2016-03-22T17:00:00) is 23 Yes, 6 No. This is a 79.3%
favorable response, which exceeds the 2/3 majority by a significant margin.

Thanks to everyone who voted or participated in this discussion.

I've heard and respect some of the objections raised by folks who voted No,
but moving this liability out of the core into PECL as soon as possible is
not only a good move for the security of PHP applications, but now we know
it's the choice the community wants.

As promised, I'll get the E_DEPRECATED patch written soon.

Additionally, I will have a decrypt-only mcrypt polyfill project written
hopefully before 7.1.0-alpha but definitely before 7.1.0. This will allow
people to migrate towards something better, e.g.
openssl_encrypt()/openssl_decrypt().

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>

--001a113d76f43d691a052ea628c6--