Post

PHP's default password hash only reads the first 72 bytes of your password. Last week's plan to refuse longer ones split the list. This week, a fix that breaks nothing arrived, borrowed from a Python library. https://youtu.be/HHhoh-7H37A #PHP #PHPInternals #PHP87

Top story: Sjoerd Langkemper set aside his RFC to throw on bcrypt passwords past 72 bytes and proposed PASSWORD_BCRYPT_SHA256: opt-in, no BC break, Passlib-compatible. @timwolla.bsky.social suggested it and Anton Smirnov loves it. Jeff Dafoe had to force password resets over the old limit.

Two votes are open after 7 straight episodes with none. @nicksdot.dev's RFC to end PEAR's endorsement was 26–0 at recording (closes Oct 19). Weilin Du's IntlRelativeDateTimeFormatter is back with @timwolla.bsky.social's enum design: 7–0, Tim included (closes Oct 22).

Io\Terminal v0.4 dropped its interfaces: @timwolla.bsky.social argued the real boundary is the stream, not the terminal, and Bob Weinand agreed. Larry Garfield sketched tests with in-memory streams, and Pratik Bhujel is heading toward a vote.

@mnapoli.bsky.social's RFC puts FPM inside the php binary: on Lambda, 18% smaller, 25% faster cold start. @timwolla.bsky.social sees no drawbacks, Ayesh Karunaratne flagged a -F clash, Larry Garfield fears locking in FPM, and @nicolasgrekas.bsky.social and Jakub Zelenka want FPM to embed the CLI.

Ilia ran Jakub Zelenka's IO Hooks branch, found crashes under Fibers, and would make hooked calls opt-in. Jakub: fixable, not a design issue. Edmond Dantes: "now we have both halves: Scheduler + IO Hooks."