Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:105540
To: Peter Kokot <peterkokot@gmail.com>
Cc: "G. P. B." <george.banyard@gmail.com>,
 PHP Internals List <internals@lists.php.net>
References: <CAFPFaMJEn=gjk5jAAxR2bF=4Mt3r0FJCm6mbOCReOmyybtAkkg@mail.gmail.com>
 <49A4B76C-4C62-4CBE-BA20-FBE56CA29AB0@cschneid.com>
 <CADyq6sL7m=A=pA1rNBg_CFOoMtfCZn50AfALh9jtLHvn9NRzmw@mail.gmail.com>
 <609E93CF-099B-446C-AD28-04F1D802C9F0@cschneid.com>
 <000401d4fac8$ae592cf0$0b0b86d0$@roze.lv>
 <CAJHtznz-Dm7ft6qJ6Y6sjnaL4G0cwVVJyakxr_zprhxQzqUkVg@mail.gmail.com>
 <CAFPFaML4QTbtJXLuheGwTTT204vY40TeT5TLEX22oYTNrNJ8Qg@mail.gmail.com>
 <CAJHtznwnbM54uAzStVfAOjUTgEoDr8XpOFCYdVjgrtZfFgrSJw@mail.gmail.com>
 <CAFPFaM+EGh6zZgSdDXo06wdY==Fujm1JFWFO88EmvggC-fdFJA@mail.gmail.com>
 <CAJHtznztD-UOSoeSApvTMidNo6z20MUWNNBRUW84_JxM0fRq-g@mail.gmail.com>
 <alpine.DEB.2.21.1904301800070.9606@singlemalt.home.derickrethans.nl>
 <CAJHtznzSOo1Xbmu3N9C_GEo6woDC0STVR_nVjUCusT65dfPe=A@mail.gmail.com>
 <CAAfnsFWogfyZ=X07EOAZ6V4vSKw89K01WGnddRF=zRP9-FBsdg@mail.gmail.com>
 <961cee8e-8185-b7b2-2b51-838946d2c7d2@gmail.com>
 <CAAfnsFUhMKf1YYuT1eCF65yfX+FjNAcr_MyAiPM-fiPawTKDLQ@mail.gmail.com>
Openpgp: preference=signencrypt
Autocrypt: addr=smalyshev@gmail.com; prefer-encrypt=mutual; keydata=
 mQMuBE9mqaARCACFSqcGmNunkjQQu3X+yXnTmFeEkvM4JXZTOBdR8aEevNGmmFEfyvjaDjWi
 9hcwp4E/lYtC+P7VsVjM1OSX9eq0jC/lGL0ZyRXek+mNy0n5H1NSuTpf9Y18LMqhc4G+RU+L
 cNiZ9K0DJuOOvNLPxW7OHZguxb3wdKPXNVa2jyRfJAKm2uaJJMT1mTmFT9a0Q8SKr+mUrrJk
 uG0H2o6SzrKt8Wwoint1eh67zVsJaJtQFchnEZnlawIcqP2yC4nLGR3MkubowxoEBYCZet18
 aHVVRbvpG2Qtob8Lu5xrsGbmXymTkHTdpvkfcJFADa8MzOL90zOxXwbGfbIZOlh5En8jAQCX
 lfnx2eQL3BSW/6XANa51dbWiEp1d1BAkpGKtZvlk0Qf+M9WAi+9aXMe3xP5krxtgnRNUf2WN
 6Zdy2MxL1RRJCFbytLhl0ronC49BsGYVGshdEH8xhBbiIOJKuVZ/DTl9bEm7P9c7CC7iJyVC
 khUAhouH6xzZQNLR+RU+QebYzXypVfl99Qk7EdMmr/WAZCHLuvanyqepC5EBsa3VnAfQemSN
 oBeGBKWWLiOsPjvS72+y1z4RUMAfXHn4l/sFMt8zt7/74AmJPwZquV41p4mPO12V4+xPyc6R
 sB84sfsk2QVivU8w8AkvGQeYjXoz7Iwao95+fWteVzZ36KRQvUckP8pGjHlDXnHxJ0HI1I/k
 OBZSjwRwUf0dd73y6erPhbLk+gf+NdI3H9KGJBzG5/rVyWKwUeQ9d5ud4jTJRkQGvAP5pg76
 vEa9dogbpe4W5Z+0BfbiJSnQmQWSHiZddj/t33ptbup44Ck6ZTgdlmFYMLF1hR47PIZTDKER
 EuKYGci/vq8snZvEJP9YCw/TtiHcMdrMKcY/+Lp8lQO0GHLPB9glVhnC0db6l1Xpg1CMI8/R
 ozBMcij30EgATggC/y2zbiqAFoS9FN9nXPbe4phStqABEyeZ+nXudt7PUYTjVgcrqo8bHZCi
 sBobWC7OnKyUzxVxzUeuPkIfmZuzkLaMw2McQdvwwsNvQ0DzaLP30c1Xsm/7EIYJcOWpzlVJ
 5QrdmE0/BbQyU3RhbmlzbGF2IE1hbHlzaGV2IChQSFAga2V5KSA8c21hbHlzaGV2QGdtYWls
 LmNvbT6IegQTEQgAIgUCT2aqtAIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQL3lW
 vF2gS12XMwD9HuRIolSwIK77u8EY461y2u6sbX36n5/uo/LDQuxoi3sA/0MvpnvzOhv9Iufv
 vsZEj3E7i3h+iD5648YMwfTFCij+uQINBE9mqaAQCADfZPMpjZkkGZj3BY/7ApoLq4mwqzbh
 +CpLXwNn20tFNvSXfb8RdeXvVEb7Scx+W9qYpiaun2iXJgCVH8fgpZpR856ulT1q6uCG++CX
 ubEvip/eJkZl93/84h04KQJwsgOrAh0Om3OePRn8Pr+++0LNS0EL8uX/YHeTOGOnnmTqYTey
 SBVFdov6L4mepddfjekicKQqhL7mZh/xuq29JijT0uNNX8v4vDWQDu5dlAcdd+uB3gcXMD/P
 ginD11zp+6wtrWCm/+yBqpvDwXQX5PGUnwvbRfl7Ay3MmwmoXiecZMg0dwTSc7e0lhB4HGRH
 ZdBMJB4rHUVGdzqujK/ctOvrAAMFB/0Utb76Qe6sCMlHxVAmeE/fbo7Pi05btZ/x01r67dHf
 aMSP0riCKJ7M0OW+jAXtu9+z/BVnYisW67WWfxl2cS5tZDgiHgJARXWUOO72+sScHP8KQmTl
 1z16gyKbwY3SmyBkwcpOL35nhUWNLy93syPoY6sZUTikr2bZYukHDQ33XBPs4e6MbWKfsa9q
 aVmnlOF3k5UqChjutfHaEa4Q7VP4wBIpphHBi9MI16oJIzzBPbGl2uoedjwiZ6QeQZnSuOVY
 ZxU2d3lRA8PrtfFN1VSlpEm/VcAvtieHUYWHN0wOu+cp3Slr5XJVNjTjJhl28SlinMME54mK
 AGf2Ldr/dRwXiGEEGBEIAAkFAk9mqaACGwwACgkQL3lWvF2gS126EQD/VVd3FgjLKglClRQP
 zdfU847tqDK4zJjbmRv5vLLwoE0A+wbrQs7jVGU3NrS0AIl5vUmewpp2BKzSkepy23nWmejw
Message-ID: <e4ffda5e-fe34-aab2-d97e-0f6b5ce9f83a@gmail.com>
Date: Wed, 1 May 2019 00:42:25 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0)
 Gecko/20100101 Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <CAAfnsFUhMKf1YYuT1eCF65yfX+FjNAcr_MyAiPM-fiPawTKDLQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecate PHP's short open tags
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> Every app will have different things to fix. So saying that this
> particular change will break the internet is not realistic without any
> numbers. If PHP is on a course to fix the BC break strategy then good

I am not saying it will break the internet. Nobody does. What I am
saying it creates a huge and serious risk (both operational and
security) for people upgrading, and I am not sure why it is being
dismissed roughly as "well, BC happens, what you gonna do..." In my
opinion, it's not a kind of issue one should be dismissing. It's not a
regular low-grade BC break, it's a serious and dangerous one. Probably
one of the most dangerous - in its current state, as voted - among all
present in the release.

> even this discussion. Because, from what I think here more is that
> we're discussing how to keep the short tags forever and how to remove
> them as soon as possible. There is a difference in what people want

I don't think dealing in absolutes here is helpful. There are more
options than "ASAP" and "never". And I feel that the RFC as-is have not
considered them thoroughly enough - otherwise I can not see how the
issue of spilling out the source has not been handled.

> removing the tags in the first place. I haven't seen any step forward
> from this point yet and what kind of a different removal strategy
> (compared to Nikita's suggestion) would work.

Whatever removal strategy there is, it should not be "let's switch the
default in 7.4, remove the whole token completely in 8.0 and let people
that have <? in their code have it spilled out like groceries from a
torn paperbag".

I personally think that whatever meager benefit we get from the removal
at the end (?xml thing? ridiculously narrow use case. parser
simplification? by removing one tag out of dozens? minuscule. etc.) but
if there are so many people that hate it, well, we can go ahead and work
on removal. But not in the way that creates problems much worse than the
current state.

> I haven't seen code with short tags for such a long time now that this
> is for me a problem on a scale of a fly. Because we've simply upgraded

You must realize you haven't seen 99.999% of existing PHP code, and
that's probably if you look at a lot of code? Massive amounts of code
are not public. Massive amounts of code are using old library versions
and old dependencies, a lot of them not easily upgradable to latest
versions because the surrounding code is old too and newest versions
break it.

The fact that you personally haven't seen such code and it's not a
problem for *you* doesn't mean a lot if you purport to take
responsibility over the needs of millions of PHP users. Voting on RFC
should not be an expression of a personal opinion and only it, if it is
we have a grotesque situation where personal whims of barely 50 random
people decide things for millions. This can only work if each of these
people realizes the responsibility inherent in the decisions being taken
and considers the impact that their vote would have not only for their
personal needs, but for other users too.

> know and probably won't understand fully. But, also at least now this
> discussion and also RFC brought this thing out - short open tags
> shouldn't be used anymore in any case. :) Because obviously a very

There's a very big distance from recommending not using short tags to
removing short tags from the parser. We've just voted for covering this
distance in two releases. I think this would be a costly mistake. There
are ways of doing it properly - Nikita's proposal could be one of them.
-- 
Stas Malyshev
smalyshev@gmail.com