Newsgroups: php.doc,php.internals
Path: news.php.net
Xref: news.php.net php.doc:969386564 php.internals:98854
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.218.44 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXaNECDwA8vwqZwvzM=pZYciLPbX9dOr62duZpg43CzSrg@mail.gmail.com>
References: <CAGa2bXbUYDgJxmmZfuS5ZbWCLjq0QPpDioM-zkU9j7EHA-D_ag@mail.gmail.com>
 <CAGa2bXYFw6Uz9cLFM1QT9ULak9uJcM4mr0R59TEa0eYf-tAm+Q@mail.gmail.com>
 <CAGa2bXYnDgvsWi4kCdajnnQ-psCPThpLu3_EK_DprLWsX+UZ2A@mail.gmail.com>
 <CAL=_i_n4KSfx=TGMjTnjjszaNzVqT=V=GPZFyiLYFuzb8RxCgQ@mail.gmail.com>
 <CAGa2bXZ6JMKWsY=Cea-=V=g09jdTQGDOg7TtJrf6_higU0KW3Q@mail.gmail.com>
 <1924612862.1298112.1492071094545.JavaMail.zimbra@pieterhordijk.com>
 <CAGa2bXYR5ssff9YXUYGcsriTWJfYEf-2OkTXAxnb536HPhBjpA@mail.gmail.com>
 <CAF+90c81-1gA9-3UfwN6ohcu587He22wN9ekMiDsbNkyYmmZmw@mail.gmail.com>
 <690015854.1384408.1492163148986.JavaMail.zimbra@pieterhordijk.com>
 <CAGa2bXY2kwasyH4GwoSfSr6XcMcg1jukcMXOEUPvBg8pLCbDkg@mail.gmail.com>
 <CAGa2bXa+wfcVbeX32t8kOiL7Bz1dBnvwweSwoLETpEiw=rTyoA@mail.gmail.com>
 <CANUQDCgHLQVzY08CtS_QA6vsao+hpejKGAuyB1eETEcEmpcxhg@mail.gmail.com> <CAGa2bXaNECDwA8vwqZwvzM=pZYciLPbX9dOr62duZpg43CzSrg@mail.gmail.com>
Date: Sun, 23 Apr 2017 01:24:22 +0300
Message-ID: <CAPhkiZzXjfEZ_gDnCXd-ivoDQJ5rp3vuOb5yfjzX_7nnca6nEw@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Niklas Keller <me@kelunik.com>, Pieter Hordijk <info@pieterhordijk.com>, 
	Joe Watkins <pthreads@pthreads.org>, internals <internals@lists.php.net>, 
	phpdoc <phpdoc@lists.php.net>, Nikita Popov <nikita.ppv@gmail.com>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][VOTE] Improve hash_hkdf() parameter
From: narf@devilix.net (Andrey Andreev)

Hi,

On Sat, Apr 22, 2017 at 10:37 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi Niklas,
>
> On Sun, Apr 23, 2017 at 4:32 AM, Niklas Keller <me@kelunik.com> wrote:
>>
>>
>> What the... there were multiple concerns regarding the changes already.
>> I'm hereby expressing another strong -1 on these.
>
>
> Instead of posting your feeling, please post logic behind your idea.
> Most of the changes are based on what is _written_ in the RFC 5869
>
> I'm a bit tired with arguments without valid logic.

You're tired? Yasuo, the reason why you're not receiving replies
unless you say "I'll commit in a few days if there are no more
comments" is because everybody is tired of talking to you.

If you want examples, search GitHub for PHP code utilizing HKDF - you
will see that most projects use it without a salt, including
https://github.com/defuse/php-encryption - pretty much the best PHP
userspace crypto library today. And I'm only saying "most" because I
can't be bothered to go through literally all of them; I've found NONE
that do use the salt.
You will also find zero projects using it for CSRF protection.

The vote ended with 1 Yes (you) and 14 No; not a single person has
agreed with you so far, and most have explicitly stated strong
disagreement with your proposed changes. Yet you insist on pushing
your *personal opinion*, ignoring everybody else and acting as if ~80
mails haven't already been exchanged.

How is it even possible that you still believe that everybody is wrong
and you alone are right? Give it up already.

Cheers,
Andrey.