Hi Matt, have you read Graeber's "Bullshit Jobs: A Theory" yet? It has an interesting perspective on what drives the trend to minimize pay for writers.
This was striking for me because I immediately thought that all the stuff I've authored for salt, ansible, grunt, etc. is duct tape. And I hated doing that work. I always did.
It's necessary and necessarily complex but a lot of the complexity is because fitting all this stuff together is going to be a mess no matter what. We can argue about better and worse approaches to managing the complexities (micro-services, whatever) but it's still complex and I resent that.
cweagans is right. PHP is deeply unfashionable, ridiculous even to some programmers using other langauges. But quietly, somewhere out of sight, it has been enjoying something of a renaissance in recent years. Generally I'm pleased with changes in the culture, tools, standards and even in the language. But just can't get behind this decision to keep mcrypt.
It appears those with a vote regard adoption of PHP 7 as the higher priority and therefore compat with existing code using mcrypt must be ensured. http://news.php.net/php.internals/82191
it's mostly good. NIST abolished their algo for pasword entropy estimation some time ago. i do not much like any password strength tests, most of which rate any number of terrible passwords as strong. as such i think they give a false sense of security. maybe consider cracklib.
as DenisM said, always use SSL for all traffic if security matters and don't trust SO for security advice.