Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:107450
MIME-Version: 1.0
References: <5d976928.1c69fb81.db3a8.78daSMTPIN_ADDED_MISSING@mx.google.com>
In-Reply-To: <5d976928.1c69fb81.db3a8.78daSMTPIN_ADDED_MISSING@mx.google.com>
Date: Wed, 9 Oct 2019 10:11:17 +0200
Message-ID: <CAF+90c-a26cJMFYmwGk0kuSPXPZzaN2HCH+x9eGaeb8e8MC8ZQ@mail.gmail.com>
To: Mark Randall <marandall@php.net>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000004b1f7f059475d538"
Subject: Re: [PHP-DEV] [RFC] Deprecate Backtick Operator (V2)
From: nikita.ppv@gmail.com (Nikita Popov)

--0000000000004b1f7f059475d538
Content-Type: text/plain; charset="UTF-8"

On Fri, Oct 4, 2019 at 5:45 PM Mark Randall <marandall@php.net> wrote:

> Hi Internals,
>
> I put forward the following RFC "Deprecate Backtick Operator (V2)" for
> discussion.
>
> https://wiki.php.net/rfc/deprecate-backtickTrying to drag every single
> discussion to the meta level is exactly what is causing these unnecessary,
> time wasting discussions. This is a small proposal with a limited number of
> arguments for and against, and it's unfortunate that your participation in
> the discussion has once again -operator-v2
> <https://wiki.php.net/rfc/deprecate-backtick-operator-v2>
>
> I believe it is at least worth a discussion as to the pros and cons of
> deprecating this functionality, especially in light of the existence of
> better described and more well-known functions exhibiting identical
> behaviour.
>
> This RFC only covers the issuing a deprecation notice, and its complete
> removal would be contained within a separate RFC.
>

My 2c on this proposal: I think the primary motivation for me here would be
the security aspect...

On one hand, the existence of the backtick operator in PHP borders on
criminal negligence, because it exposes the **single most dangerous**
operation in the entire language in a way that looks innocuous, is easy to
confuse with a string literal and that the majority of PHP programmers are
not aware of. This looks like a great way to slip a nice RCE vulnerability
past code review ;)

On the other hand, I have seen no evidence of backticks actually causing
security issues in practice. I guess it doesn't because it's not a feature
you'll end up using accidentally, and it does not seem like attempts at
inserting backdoors into open-source projects by 3rd party contributors are
common. Is anyone aware of specific security incidents that can be
attributed to the backtick operator?

Meta: Wow, do we really need to drag every single discussion that contains
the word "deprecation" up to the meta level? This is a really simple
proposal, with a very limited set of arguments for and against. I hope we
can consider the proposal on its merits (or non-merits) rather than turning
it into some kind of proxy war. Yes, "it breaks backwards compatibility for
questionable benefit" is an argument against this proposal, it is even a
*very good* argument against it, but it's also no mandate to shut down the
discussion entirely.

Nikita

--0000000000004b1f7f059475d538--