News for hackers. Stuff that matters.

A comment on Custodians of PHP vote to keep a crypto lib abandoned in 2003 in PHP 7.

Re:Custodians of PHP vote to keep a crypto lib abandoned in ... by thefsb on Tuesday February 10, 2015 @12:08PM (#9028405)
It appears those with a vote regard adoption of PHP 7 as the higher priority and therefore compat with existing code using mcrypt must be ensured. http://news.php.net/php.internals/82191
[ Parent | on HN ]
Re:Custodians of PHP vote to keep a crypto lib abandoned in ... by jessaustin on Tuesday February 10, 2015 @12:15PM (#9028454)
I haven't used php, but the situation described at that link is codependence.

  a: "Most of our users don't care about security."
  b: "OK then they can continue using old broken versions."
  a: "No, then they won't be secure! Therefore it must be easy to upgrade."
  b: "How?"
  a: "By not making the proposed security improvements."
This seems like a recipe for losing any users that do care about security, which is not a viable strategy over the long term.
[ Parent | on HN ]