Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125285
Content-Type: multipart/alternative;
 boundary="------------qoSYRzYofZ17SuENyaf0kt7X"
Message-ID: <1c2cb0d4-ecf2-41c7-9f31-e90f1bee3805@scriptfusion.com>
Date: Mon, 26 Aug 2024 19:39:52 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] [RFC] Default expression
To: internals@lists.php.net
References: <0c8ed5d6-5507-4c41-8d7f-05d14ba8aa4c@scriptfusion.com>
 <0cfd3a28-3cb0-4478-85fb-cf086d8e5c66@app.fastmail.com>
 <3e0d031e-256f-47cd-9a2b-dcdc760f5498@scriptfusion.com>
 <e2cd7203-8a25-494d-9c9d-b8abad02c8e8@rwec.co.uk>
 <6afeb23a-867f-457d-9b13-fdf5af02c31e@scriptfusion.com>
 <F374AE89-A6E4-4C40-9C33-6569D47589ED@rwec.co.uk>
 <928d6c8c-c969-4d55-82ff-5da8fc3d3035@scriptfusion.com>
 <73301950-03e7-4f3c-9fab-402645f77272@gmx.de>
 <e2b64837-2a28-4968-bce3-bbc06165d2bd@scriptfusion.com>
 <bcfa8d1f-8a2f-4c39-bf5d-a85f0ba4e20e@app.fastmail.com>
 <CAJmjfvXkZsWUK3aGY+EM+3T52ezbdttJ2FSCoxh9t=wyHZCgMw@mail.gmail.com>
 <a6d8a65c-7fd1-4246-bb14-b50fe3645bb1@app.fastmail.com>
 <CAJp_myV3Riup2DyDWjgpHypDE6qP03Ogzdr6mZo6wWUmCtx16g@mail.gmail.com>
Content-Language: en-GB
In-Reply-To: <CAJp_myV3Riup2DyDWjgpHypDE6qP03Ogzdr6mZo6wWUmCtx16g@mail.gmail.com>
From: bilge@scriptfusion.com (Bilge)

This is a multi-part message in MIME format.
--------------qoSYRzYofZ17SuENyaf0kt7X
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 26/08/2024 19:11, Matthew Weier O'Phinney wrote:
>
>
> On Mon, Aug 26, 2024, 12:02 PM Larry Garfield <larry@garfieldtech.com> 
> wrote:
>
>     I recognize that "limiting the allowed expression structures
>     arbitrarily is way harder than it sounds" is a valid argument as
>     well.  At the same time, John C has offered some valid examples of
>     cases where it would open up additional footguns, and we want to
>     minimize those in general.  Those shouldn't be ignored, either.
>
This seems like a valid and balanced position from Larry.
>
> IF it's possible to accomplish, I think it's better to identify the 
> "leaving this open will create WTF situations" than to prematurely 
> lock _everything_ down up front.
>
> There's been a few good lists about the cool things this could enable, 
> demonstrating the value; maybe now we should focus on the "we 
> absolutely shouldn't enable" pieces to allow for broader consensus.

I like this approach. I'm still not sure I'd want to pursue adding 
exclusions, but if we can identify something that's obviously bad and/or 
dangerous then we can consider that short list for exclusion. That is 
much more compelling than starting out by banning everything and 
arbitrarily whitelisting those things someone personally has a use for.

Cheers,
Bilge

--------------qoSYRzYofZ17SuENyaf0kt7X
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">On 26/08/2024 19:11, Matthew Weier
      O'Phinney wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAJp_myV3Riup2DyDWjgpHypDE6qP03Ogzdr6mZo6wWUmCtx16g@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="auto">
        <div><br>
          <br>
          <div class="gmail_quote">
            <div dir="ltr" class="gmail_attr">On Mon, Aug 26, 2024,
              12:02 PM Larry Garfield &lt;<a
                href="mailto:larry@garfieldtech.com"
                moz-do-not-send="true" class="moz-txt-link-freetext">larry@garfieldtech.com</a>&gt;
              wrote:<br>
            </div>
            <br>
          </div>
        </div>
        <div dir="auto">
          <div class="gmail_quote">
            <blockquote class="gmail_quote"
style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I
              recognize that "limiting the allowed expression structures
              arbitrarily is way harder than it sounds" is a valid
              argument as well.  At the same time, John C has offered
              some valid examples of cases where it would open up
              additional footguns, and we want to minimize those in
              general.  Those shouldn't be ignored, either.<br>
            </blockquote>
          </div>
        </div>
      </div>
    </blockquote>
    This seems like a valid and balanced position from Larry.<br>
    <blockquote type="cite"
cite="mid:CAJp_myV3Riup2DyDWjgpHypDE6qP03Ogzdr6mZo6wWUmCtx16g@mail.gmail.com">
      <div dir="auto">
        <div dir="auto"><br>
        </div>
        <div dir="auto">IF it's possible to accomplish, I think it's
          better to identify the "leaving this open will create WTF
          situations" than to prematurely lock _everything_ down up
          front. </div>
        <div dir="auto"><br>
        </div>
        <div dir="auto">There's been a few good lists about the cool
          things this could enable, demonstrating the value; maybe now
          we should focus on the "we absolutely shouldn't enable" pieces
          to allow for broader consensus. <br>
        </div>
      </div>
    </blockquote>
    <p>I like this approach. I'm still not sure I'd want to pursue
      adding exclusions, but if we can identify something that's
      obviously bad and/or dangerous then we can consider that short
      list for exclusion. That is much more compelling than starting out
      by banning everything and arbitrarily whitelisting those things
      someone personally has a use for.</p>
    <p>Cheers,<br>
      Bilge<br>
    </p>
  </body>
</html>

--------------qoSYRzYofZ17SuENyaf0kt7X--