[PHP-DEV] RFC karma Request

2021-04-23 Thread Saif Eddin Gmati
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hello Internals, I'm requesting karma to open an RFC for sealed classes feature. wiki username: azjezz -BEGIN PGP SIGNATURE- Version: ProtonMail wsFzBAEBCAAGBQJggxwSACEJELAOCkaz8cFXFiEEOazMpP0wDQTIQG6zsA4K RrPxwVdBzBAAg7C5m8vqTasy5vnYE3bzb

Re: [PHP-DEV] Binary (un)safety of password_hash() used with PASSWORD_BCRYPT

2021-04-23 Thread Sara Golemon
On Fri, Apr 23, 2021 at 2:41 PM Niklas Keller wrote: > People might remember the approach incorrectly or have a similar idea > themselves and make mistakes in their own version of such code. > > While I agree in principle that this is possibly true and a good justification for adding guard rails,

Re: [PHP-DEV] Binary (un)safety of password_hash() used with PASSWORD_BCRYPT

2021-04-23 Thread Sara Golemon
On Fri, Apr 23, 2021 at 2:56 PM Kamil Tekiela wrote: > We can also consider switching the default to Argon2id. > As Scott says the NUL byte truncation is not a bug in PHP, but a bug in > the algorithm. I don't know the exact specification but maybe we should > leave the current implementation as

[PHP-DEV] Re: RFC karma Request

2021-04-23 Thread Christoph M. Becker
On 23.04.2021 at 21:12, Saif Eddin Gmati wrote: > I'm requesting karma to open an RFC for sealed classes feature. > > wiki username: azjezz RFC karma granted. Best of luck with the RFC! :) Christoph -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: https://www.php.

Re: [PHP-DEV] Binary (un)safety of password_hash() used with PASSWORD_BCRYPT

2021-04-23 Thread Kamil Tekiela
We can also consider switching the default to Argon2id. As Scott says the NUL byte truncation is not a bug in PHP, but a bug in the algorithm. I don't know the exact specification but maybe we should leave the current implementation as is?

Re: [PHP-DEV] Binary (un)safety of password_hash() used with PASSWORD_BCRYPT

2021-04-23 Thread Niklas Keller
Sara Golemon schrieb am Fr., 23. Apr. 2021, 00:21: > On Thu, Apr 22, 2021 at 3:27 PM Niklas Keller wrote: > >> Do you have a link to places where frameworks are doing this? I built a > >> contrived example which I think summarizes the behavior you described > here: > >> https://3v4l.org/6tunp >

[PHP-DEV] Case folding with following whitespace in MIME headers

2021-04-23 Thread Christoph M. Becker
Hi all, while working on a fix[1] for bug #80259[2], I noticed that iconv_mime_decode() and mb_decode_mimeheader() collapse all whitespace after a case folding marker (CRLF) to a single space[3]. This appears to be in violation of RFC 5322, section 2.2.3: | Unfolding is accomplished by simply re

[PHP-DEV] Re: [8.1] Release Manager Voting Opens

2021-04-23 Thread Sara Golemon
On Mon, Apr 12, 2021 at 2:40 PM Sara Golemon wrote: > As stated last week, the vote for your PHP 8.1 Release Managers opens > today. > > Now, if fact. > > Please take your newly reset authentication credentials over to > https://wiki.php.net/todo/php81 and place your ranked votes. > > A quick rem