Slashdot Mirror
PHP Becomes First Programming Language To Add 'Modern' Cryptography Library In Its Core (bleepingcomputer.com)
An anonymous reader writes from a report via BleepingComputer: The PHP team has unanimously voted to integrate the Libsodium library in the PHP core, and by doing so, becoming the first programming language to support a modern cryptography library by default. Developers approved a proposal with a vote of 37 to 0 and decided that Libsodium will be added to the upcoming PHP 7.2 release that will be launched towards the end of 2017. Scott Arciszewski, the cryptography expert who made the proposal, says that by supporting modern crypto in the PHP core, the PHP team will force the WordPress team to implement better security in its CMS, something they avoided until now. Additionally, it will allow PHP and CMS developers to add advanced cryptography features to their apps that run on shared hosting providers, where until now they weren't able to install custom PHP extensions to support modern cryptography. Other reasons on why he made the proposal are detailed here. Arciszewski also says that PHP is actually "the first" programming language to support a "modern" cryptography library in its core, despite Erlang and Go including similar libraries, which he claims are not as powerful and up-to-date as PHP's upcoming Libsodium implementation.
Any language where the default equality comparison operator is *true* given two string-type variables with values "0E54321" and "0E12345" is not a cryptographically secure language. In fact there is a nonzero chance of the default equality operator returning true between two different MD5 or SHA256 hashes if they happen to fall into a hexadecimal form that is all digits except for one E or F.
Anyone who claims that PHP is somehow more secure as a language because it has added *new optional library calls* without doing anything about the fundamental language defects is demented.
Arciszewski also says that PHP is actually "the first" programming language to support a "modern" cryptography library in its core, despite Erlang and Go including similar libraries, which he claims are not as powerful and up-to-date as PHP's upcoming Libsodium implementation.
So it's the first to support a modern cryptography library, as long as you define "modern" to mean "the one that we're using."
It's easy to be first to do something if you place enough arbitrary restrictions on what that something is.
How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
they will reinvent the function prototype so it wont look like or behave like any of the other functions in the language so you'll still spend all you time looking up whether to camel case or underscore or to swap the parameter order versus the legacy functions. Even though it is "by default" they will still make you recompile from source to get it to work and it will still get hacked by a script kiddy who will just alter the source on the production server. *shudder* :-) JAVA RULES! *mic drop*
... and the Go people... and Java... and Ruby....zzzz
Maybe a new way to screw up typecasting? I know you're good for it, PHP.
I'll stick to every other language that has had libsodium bindings for a while now.
Your hair look like poop, Bob! - Wanker.
... let's get proper multibyte support.
For those who don't know, libsodium is a C library that PHP will be utilizing. It is not a PHP library.
I got tired of script kiddies banging down my PHP/MySQL servers. I'm using Pelican (Python) to convert my websites into static websites. With nothing to hack, script kiddies go away.
PHP, the "Speak 'n Spell" of programming languages.... More marketing fluff.
BULLSHIT! BULLSHIT! BULLSHIT!
PHP is one of the programming languages, which load all stuff into the core (which can be quite a disadvantage), but other languages use a library by a single include. So what? .so file, which can be loaded, but isn't required to be used. So the "core" is relative as well. Actually its a bundled module.
And even php has it into a
So PHP are proud to be the first to make a braindead decision that everyone else has been smart enough to realise this is something that is best kept as a loadable module or to use the baked in libraries of the various OS's. PHP isn't exactly known for its security to start with.
.... a kitchen sink into the core, they could have instead done a *sane* way to include additional modules.
Perl and Python for example have no problem loading user-specific or script-specific modules, not like the "system wide or nothing" approach of PHP. ( which of course doesn't work with shared hosting. )
I remember when Java was the first language to do this. Shortly after that, C# was the first language to do this. Now PHP is the first language to do this. So who will be the next one to do it first?
Shared hosting, HAHAHAHAHA. This fucking deadpan joke from the last decade is hilarious.
News Flash. Some program links with a library! Wow!! What a brilliant innovation!
As much as I love/hate using PHP, this is something that should have existed in PHP as of version 5.0
The one piece of software where I actually use crypto in php, requires using language extensions that may get depreciated, so how do we prevent that? By not updating PHP.
And that is the problem with Wordpress. People who run it, always get burned by hacking at least once, and by having their theme or plugins get broken by a wordpress core update. The lack of encryption in PHP core, is the same problem Wordpress has with the lack of MySQLi support until it was dragged kicking and screaming to update, because in turn PHP depreciated the MySQL library. Wordpress also should have had caching built in and turned on by default, because that is something that nobody knows how to setup properly, or even install, so the average Wordpress site on a bulk hosting system like Dreamhost, runs extremely slow, and takes up extremely large amounts of CPU time and Memory. Then Dreamhost suggest upgrading to a VPS instead of... installing an opcode cache (Which is insecure on bulk hosts.)
Doesn't Java have a cryptographic library in the language? So is PHP really first?
Yet another feature that PHP can't manage properly.
I'm torn on the idea of having one particular crypto implementation having first class citizen status in the language. It should help adoption and alleviate deployment headaches, but if that library turns out to have problems or just becomes obsolete it's even more of a hassle to work around it. Crypto algorithms are unusual in computer science in that they come with use-by dates. Most algorithms are timeless, but crypto changes constantly. What are the odds that in 5 years this becomes "that thing you shouldn't use but everybody uses it anyway because it's the default and its built in"?
I read the internet for the articles.
I'm smiling while I read this.
Every single bit of this news is sooo PHP and one of the reasons this awkward mess of a PL is so successful.
They find something new or something they need and bolt it on. Just like that. End of story. A vote on the core team, a little coding and *BAM* PHP has a new inner API function with what has to be the most over-the-top all-out-PHP-style name for an inner API function ever - sodium_crypto_box_keypair_from_secretkey_and_publickey($ecdh_secret, $ecdh_public); (seriously, this is no joke).
Totally LOL. Takes the cake for inner function names ten times over, even by PHP standards, which is quite a stunt. And right away PHP has up-to-date hard crypto that even a simpleton can use.
You have to hand it to the PHP crew - they actually get shit done, no matter what. :-)
We suffer more in our imagination than in reality. - Seneca
My beloved Monte https://monte.rtfd.org/ beat PHP to this by a wide stretch. While it's true that PHP is a big established language, that doesn't mean that they get to claim sudden leaps in innovation which didn't happen. I've tweeted at the author of the blog post https://twitter.com/corbinsimpson/status/834175224736157696 with timestamped commits from the Monte codebase.
~ C.
...which effectively prevents me from updating it. Great choice for a security library guys.
Is there also a "less than and of the same type" operator? Or is calling strcmp() the best practice for this?
And how is that different than simply #including a crypto library, which has the added bonus that you can pick any number of crypto libraries.
I can see three ways to proceed:
A built-in crypto library This runs at full speed and is available by default to the shared hosting customer. An add-on crypto library compiled to native code and distributed as a PHP extension This runs at full speed but requires the shared hosting customer to convince the hosting provider to install it. An add-on crypto library written in pure PHP This is available by default to the shared hosting customer but can run unacceptably slowly due to interpreter overhead.PHP... <vomits> <tries_hard_not_to_throw_up_again> <fails_miserably>
IMHO whoever uses PHP already (masochists) will keep using it but I doubt building crypto capabilities into the language will attract significantly more new coders to it.
"...man, you guys must have some serious technical debt"
I built a startup's entire stack on PHP back in the 2003-2006 time, now I look back and SMH at the foolishness. If you want a quick'n'weakly-typed language (which I often do), Python beats the crap out of PHP, as well as being ten times more readable.
[FrLz]
All they way back to .NET Framework 1.1....
https://msdn.microsoft.com/en-us/library/system.security.cryptography(v=vs.71).aspx
The cryptography algorithms are the easy part. The vary hard part is protecting keys so I hope someone provides plenty of examples of how to do that properly. I hope they don't go down the Java route of showing how to use the functions without proper key management.
...where AES will somehow be a valid value for both mode and algorithm (which will silently override to "NULL" if plaintext starts with a zero or the letter "p").
Dewey, what part of this looks like authorities should be involved?
In my opinion, dynamic languages should require, or at least encourage, one to specify what comparison type to use rather than rely on parameter (operand) analysis. The hard part is coming up with a nice syntax for such. I've had various discussion groups consider different suggestions, and found no consensus.
In the shorter term, one can roll their own functions and hope staff coders follow along. Example:
Table-ized A.I.
there is still have a shit ton (and by that I mean billions of lines of code) written 3+ decades ago running in production, you are fucking delusional if you think shared hosting is going to be any different to any other system, it doesn't matter that the world has mostly moved on there will be a fuckton of shared hosting for decades to come.
FYI Golang has a "modern" cryptography library in its core. PHP in 21th century. What a lunacy.
I'm intrigued how adding crypto support to php will somehow make Wordpress more secure, or how the php team will "force them to implement better security".
I use php regularly and don't really have any problem with it, I think it's a perfectly good language for the odd web app. I'm not a fan of Wordpress though. The way they expose everything, hundreds if not thousands of utilities and functions in the global namespace is a complete mess. I also don't see how they can have a system designed specifically to allow idiot end users to update the entire codebase by clicking a button, which requires the web app itself to have full write access to all source files, including adding third party plugins, and somehow think that it will ever be secure
When you get that I might be interested.
What in the world does crypo have to do with SQL injection and web client ability to rewrite server code ?