I think, though, that reasonable people can -- and do -- disagree about what "within reason" means.

Absolutely, which is where my next questions come from.

    I'm not convinced that it's an improvement over, say, multiple rounds of a sha algorithm.

Sure, for this conversation feel free to replace "bcrypt" with "configurable rounds of SHA1".

    More importantly, I'm not clear on exactly how big a deal this is.

I agree here.

Yes, bcrypt is better.

Is it "better enough" to warrant backwards-incompatible changes? Maybe not.

I'm not clear on Django's database-compatibility policy though. Are databases created with Django 1.X guaranteed to work with Django 1.Y (where Y < X)? If not, then there are no problems. If so, then you're right, a backwards incompatible change like this is not trivial.

Maybe I completely missed this in the docs.

    At the very least there should be some "I don't care about data portability" flag you can set to turn on bcrupt support.

This goes back to my question about databases working with older versions of Django. Did I miss an important part of the docs?

    A pure-Python bcrypt implementation would certainly help. But I certainly am not going to rewrite bcrypt -- I know enough about crypto to know that I shouldn't be allowed with a thousand miles of writing an algorithm by hand. And frankly there aren't any active committers I'd trust to write such an implementation. It would have to come from a pretty unimpeachable source, wouldn't you agree?

This is the first argument that really convinces me. If you need to support Windows and don't have anyone you trust to write a real crypt implementation in pure Python, that kind of kills the idea in its tracks.

A third-party app usable by non-Windows-users seems like the best option.

    I hope that helps; it's late and I've had a long day. Please ask if I'm not being clear.

Definitely. Thanks for taking the time to answer.