Archive
security
-
Upgrading to Symfony 6: the deprecations bill comes due
We went 4.4 LTS to 5.4 to 6.0 in six weeks. Clearing 214 deprecation messages on 5.4 was the actual work; the version bump took an afternoon. Notes on the security rewrite and two removals we missed.
-
PHP 7.2, libsodium, and the password hashing we finally fixed
A users table with md5 and salted sha1 in one column. Why PHP 7.2 does not let you bulk convert any of it, why Argon2i needed a build flag we did not have, and the rehash-on-login code that works.