Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121970
Reply-To: Dennis Snell <dennis.snell@automattic.com>
Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.200.91.1.1\))
In-Reply-To: <CAGgaK7+w_zdp30Pi5nJ-y+GPEkfc2xHfFUW+DwdpNtY8iPjMHg@mail.gmail.com>
Date: Sat, 9 Dec 2023 16:31:59 +0100
Cc: Internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <1BF39851-A294-44D9-827F-933B00807441@automattic.com>
References: <CAGgaK7+w_zdp30Pi5nJ-y+GPEkfc2xHfFUW+DwdpNtY8iPjMHg@mail.gmail.com>
To: Max Semenik <maxsem.wiki@gmail.com>
Subject: Re: [RFC][Discussion] NotSerializable attribute
From: internals@lists.php.net ("Dennis Snell via internals")

Max, I love this idea.

Would it make sense to flip the design though and add `#[Serializable]` =
with a new `php.ini` setting?

I=E2=80=99m thinking that almost every class I use, if not every single =
class, should not be serialized.
If PHP had a flag to say =E2=80=9Cprevent all classes from =
serializing=E2=80=9D then I could toggle that flag and
avoid changing every single one of the potentially thousands of classes =
in my codebase, and
I wouldn=E2=80=99t have to worry about ensuring that everyone creating a =
new class remembers to add
this attribute.

For existing sites with serializable classes we can leave the default of =
this new flag to the
permissive legacy behavior: every class is serializable. However, if you =
are willing and have
vetted your code you can flip that flag and now _unless_ you explicitly =
declare serializability
support, your classes don=E2=80=99t serialize or unserialize.

That could point to a future where _no_ class serializes _unless_ it =
implements `__sleep()`
and `__wakeup()` or `Serializable`, which seems quite reasonable in my =
mind as a tradeoff
between explicitness and surprise.

Warmly,
Dennis Snell

> On Dec 9, 2023, at 1:30=E2=80=AFPM, Max Semenik =
<maxsem.wiki@gmail.com> wrote:
>=20
> Hi, I'd like to propose a new attribute, #[NotSerializable]. This
> functionality is already available for internal classes - userspace =
should
> benefit from it, too.
>=20
> The RFC: https://wiki.php.net/rfc/not_serializable
> Proposed implementation: https://github.com/php/php-src/pull/12788
>=20
> Please let me know what you think.
>=20
> --=20
> Best regards,
> Max Semenik
>=20
> --0000000000006c4879060c12de83--
>=20