Re: Re: [RFC] Distrust SHA-1 Certificates
| From: | Sara Golemon | Date: | Mon, 03 Jul 2017 17:24:34 +0000 |
| Subject: | Re: Re: [RFC] Distrust SHA-1 Certificates | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-99723@lists.php.net to get a copy of this message | ||
On Mon, Jul 3, 2017 at 1:12 PM, Niklas Keller <me@kelunik.com> wrote:
> Additionally there will be two INI options
> which are only added to PHP 7.1 and 7.0 to allow people to immediately
> upgrade to secure defaults without any risk of breaking other apps.
>
I understand what you're going for there, but it's just a bit weird to
have that INI option exist for a weird pair of version ranges and not
forward. I'd say keep the INI in 7.2 and (perhaps) mark them
deprecated. There's no sense making that upgrade path unreasonably
difficult.
-Sara