Re: [RFC] [VOTE] Deprecations for PHP 8.4

From: Date: Tue, 30 Jul 2024 19:15:30 +0000
Subject: Re: [RFC] [VOTE] Deprecations for PHP 8.4
References: 1 2 3 4 5 6 7 8 9 10  Groups: php.internals 
Request: Send a blank email to [email protected] to get a copy of this message 
Hi

On 7/26/24 19:33, Rowan Tommins [IMSoP] wrote:

On Fri, 26 Jul 2024, at 15:20, Larry Garfield wrote:

One thing to remind people about, the deprecations for md5(), sha1(),
and uniqid() explicitly say they cannot be outright removed before PHP
10.  That's at least 6 years away.  That gives a loooooong time for
documentation, tutorials, instructions, and code to be updated.


It also gives a loooooong time for us to update that documentation *before* we start raising deprecation notices, so that there's a chance for someone to actually know what they're supposed to do about it.


Part of the motivation of the deprecation (and my argument against the addition of a standalone sha256() function) is simplifying the documentation: Everything needs to be written down in multiple different places, any changes to hash_file() will likely also need to be applied to md5_file() and sha1_file() - and then it will need to be translated.

Given that the md5(), sha1(), md5_file(), and sha1_file() functions are not part of the hash extension, it's also much harder for the user to discover the incremental hashing functionality provided by hash_init().

It's much much easier to keep the documentation in a good shape if there is a single place.

--------------

I did some updates to the documentation before this RFC went to vote, though (and did additional ones in response to this discussion). Here are my PRs: https://github.com/php/doc-en/pulls?q=is%3Apr+author%3ATimWolla+hash+is%3Aclosed

To summarize the changes:

- I've completely rewritten the documentation of hash_equals().
- I updated the examples for the hash_*() functions to use 'sha256' and to be synchronized across the different functions to showcase how the different functions all result in the same output, given the same input.
- I cleaned up the "See Also" section to make the references from md5()/sha1() to hash() a "one-way street". Once you discovered the hash() functions, you shouldn't need md5() and sha1().
- I've removed the broken algorithms from the $algo parameter explanation, leaving only 'sha256' as the opinionated example (already merged, but not yet deployed).

Best regards
Tim Düsterhus

Thread (97 messages)

« previous php.internals (#124689) next »