On: Custodians of PHP vote to keep a crypto lib abandoned in 2003 in PHP 7

[thefsb]

It appears those with a vote regard adoption of PHP 7 as the higher priority and therefore compat with existing code using mcrypt must be ensured. http://news.php.net/php.internals/82191

[jessaustin → thefsb]

I haven't used php, but the situation described at that link is codependence.

  a: "Most of our users don't care about security."
  b: "OK then they can continue using old broken versions."
  a: "No, then they won't be secure! Therefore it must be easy to upgrade."
  b: "How?"
  a: "By not making the proposed security improvements."

This seems like a recipe for losing any users that do care about security, which is not a viable strategy over the long term.