Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125583
Precedence: bulk
MIME-Version: 1.0
References: <A247BB36-9FD1-4AAF-AAB8-82DBD9DE3550@newclarity.net>
 <CA697780-BC2D-4054-A9FD-523E08236732@rwec.co.uk> <8D420123-4ECF-48FD-A9C3-F80C60457A37@newclarity.net>
 <CA+Jpajkx0OraH7GQyB5gECtPOo2JP=RzuSwqfv4AZGY+a+ryPw@mail.gmail.com> <AACF228F-53D3-480F-9127-77FBC4AE6A84@newclarity.net>
In-Reply-To: <AACF228F-53D3-480F-9127-77FBC4AE6A84@newclarity.net>
Date: Tue, 17 Sep 2024 14:57:18 +0200
Message-ID: <CAGnYymDhy1dov+4HcFWhAx1Ga9bXR=Urew9RbN5KEXcgHmk=Ew@mail.gmail.com>
Subject: Re: [PHP-DEV] Zephir, and other tangents
To: Mike Schinkel <mike@newclarity.net>
Cc: Hammed Ajao <hamiegold@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000064ac9b0622503bba"
From: adam.zielinski@automattic.com (Adam Zielinski)

--00000000000064ac9b0622503bba
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

> To summarize, I think PHP would benefit from:
>
> 1. Adding WASM for simple low-level extensibility that could run on
> shared hosts for things that are just not possible in PHP as described a
> few paragraphs prior, and where we could enhance functionality over time,
>
> 2. Constantly improving PHP the language, which is what you are solely
> advocating for over extensibility,
Hi Mike,

I=E2=80=99m Adam, I'm building WordPress Playground [1] =E2=80=93 it's Word=
Press running in
the browser via a WebAssembly PHP build [2]. I'm excited to see this
discussion and wanted to offer my perspective.

WebAssembly support in PHP core would be a huge security and productivity
improvement for the PHP and WordPress communities.

> To summarize, I think PHP would benefit from:
>
> 1. Adding WASM for simple low-level extensibility that could run on
> shared hosts for things that are just not possible in PHP as described a
> few paragraphs prior, and where we could enhance functionality over time,

Exactly this! With WASM, WordPress would get access to fast, safe, and
battle-tested libraries.

Today, we're recreating a lot of existing libraries just to be able to use
them in PHP, e.g. parsers for HTML [3], XML [4], Zip [5], MySQL [6], or an
HTTP client [7]. There are just no viable alternatives. Viable, as in
working on all webhosts, having stellar compliance with each format's
specification, supporting stream parsing, and having low footprint. For
example, the curl PHP extensions is brilliant, but it's unavailable on many
webhosts.

With WebAssembly support, we could stop rewriting and start leaning on the
popular C, Rust, etc. libraries instead. Who knows, maybe we could even
polyfill the missing PHP extensions?

> 2. Constantly improving PHP the language, which is what you are solely
> advocating for over extensibility,

Just to add to that =E2=80=93 I think WASM support is important for PHP to =
stay
relevant. There's an exponential advantage to building a library once and
reusing it across the language boundaries. A lot of companies is invested
in PHP and that won't change in a day. However, lacking access to the WASM
ecosystem, I can easily imagine the ecosystem slowly gravitating towards
JavaScript, Python, Go, Rust, and other WASM-enabled languages.

Security-wise, WebAssembly is Sandboxed and would enable safe processing of
untrusted files. Vulnerabilities like Zip slip [8] wouldn't affect a
sandboxed filesystem. Perhaps we could even create a secure enclave for
running composer packages and WordPress plugins without having to fully
trust them.

Another use-case is code reuse between JavaScript and PHP. I'm sceptical
this could work with reasonable speed and resource consumption, but let's
assume for a moment there is a ultra low overhead JavaScript runtime in
WebAssembly. WordPress could have a consistent templating language. PHP
backend would render the website markup using the same templates and
libraries as the JavaScript frontend. Half the code would achieve the same
task.

Also, here's a few interesting "WASM in PHP" projects I found =E2=80=93 may=
be they
would be helpful:
- WebAssembly runtime built in PHP (!) https://github.com/jasperweyne/unwas=
m
- WebAssembly runtime as a PHP language extension:
https://github.com/veewee/ext-wasm
- WebAssembly runtime as a PHP language extension:
https://github.com/extism/php-sdk

[1] https://github.com/WordPress/wordpress-playground/
[2]
https://github.com/WordPress/wordpress-playground/tree/trunk/packages/php-w=
asm/compile
[3] https://developer.wordpress.org/reference/classes/wp_html_processor/
[4] https://github.com/WordPress/wordpress-develop/pull/6713
[5]
https://github.com/WordPress/blueprints-library/blob/87afea1f9a244062a14aef=
f3949aae054bf74b70/src/WordPress/Zip/ZipStreamReader.php
[6] https://github.com/WordPress/sqlite-database-integration/pull/157
[7]
https://github.com/WordPress/blueprints-library/blob/trunk/src/WordPress/As=
yncHttp/Client.php
[8] https://security.snyk.io/research/zip-slip-vulnerability

-Adam

--00000000000064ac9b0622503bba
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>&gt; To summarize, I think PHP would benefit from:</d=
iv><div>&gt; </div><div>&gt; 1. Adding WASM for simple low-level extensibil=
ity that could run on </div><div>&gt; shared hosts for things that are just=
 not possible in PHP as described a </div><div>&gt; few paragraphs prior, a=
nd where we could enhance functionality over time,</div><div>&gt; </div><di=
v>&gt; 2. Constantly improving PHP the language, which is what you are sole=
ly </div><div>&gt; advocating for over extensibility,</div><div>Hi Mike,</d=
iv><div><br></div><div>I=E2=80=99m Adam, I&#39;m building WordPress Playgro=
und [1] =E2=80=93 it&#39;s WordPress running in the browser via a WebAssemb=
ly PHP build [2]. I&#39;m excited to see this discussion and wanted to offe=
r my perspective.</div><div><br></div><div>WebAssembly support in PHP core =
would be a huge security and productivity improvement for the PHP and WordP=
ress communities.</div><div><br></div><div>&gt; To summarize, I think PHP w=
ould benefit from:</div><div>&gt; </div><div>&gt; 1. Adding WASM for simple=
 low-level extensibility that could run on </div><div>&gt; shared hosts for=
 things that are just not possible in PHP as described a </div><div>&gt; fe=
w paragraphs prior, and where we could enhance functionality over time,</di=
v><div><br></div><div>Exactly this! With WASM, WordPress would get access t=
o fast, safe, and battle-tested libraries.</div><div><br></div><div>Today, =
we&#39;re recreating a lot of existing libraries just to be able to use the=
m in PHP, e.g. parsers for HTML [3], XML [4], Zip [5], MySQL [6], or an HTT=
P client [7]. There are just no viable alternatives. Viable, as in working =
on all webhosts, having stellar compliance with each format&#39;s specifica=
tion, supporting stream parsing, and having low footprint. For example, the=
 curl PHP extensions is brilliant, but it&#39;s unavailable on many webhost=
s.</div><div><br></div><div>With WebAssembly support, we could stop rewriti=
ng and start leaning on the popular C, Rust, etc. libraries instead. Who kn=
ows, maybe we could even polyfill the missing PHP extensions?</div><div><br=
></div><div>&gt; 2. Constantly improving PHP the language, which is what yo=
u are solely </div><div>&gt; advocating for over extensibility,</div><div><=
br></div><div>Just to add to that =E2=80=93 I think WASM support is importa=
nt for PHP to stay relevant. There&#39;s an exponential advantage to buildi=
ng a library once and reusing it across the language boundaries. A lot of c=
ompanies is invested in PHP and that won&#39;t change in a day. However, la=
cking access to the WASM ecosystem, I can easily imagine the ecosystem slow=
ly gravitating towards JavaScript, Python, Go, Rust, and other WASM-enabled=
 languages.</div><div><br></div><div>Security-wise, WebAssembly is Sandboxe=
d and would enable safe processing of untrusted files. Vulnerabilities like=
 Zip slip [8] wouldn&#39;t affect a sandboxed filesystem. Perhaps we could =
even create a secure enclave for running composer packages and WordPress pl=
ugins without having to fully trust them.</div><div><br></div><div>Another =
use-case is code reuse between JavaScript and PHP. I&#39;m sceptical this c=
ould work with reasonable speed and resource consumption, but let&#39;s ass=
ume for a moment there is a ultra low overhead JavaScript runtime in WebAss=
embly. WordPress could have a consistent templating language. PHP backend w=
ould render the website markup using the same templates and libraries as th=
e JavaScript frontend. Half the code would achieve the same task.</div><div=
><br></div><div>Also, here&#39;s a few interesting &quot;WASM in PHP&quot; =
projects I found =E2=80=93 maybe they would be helpful:</div><div>- WebAsse=
mbly runtime built in PHP (!) <a href=3D"https://github.com/jasperweyne/unw=
asm">https://github.com/jasperweyne/unwasm</a></div><div>- WebAssembly runt=
ime as a PHP language extension: <a href=3D"https://github.com/veewee/ext-w=
asm">https://github.com/veewee/ext-wasm</a></div><div>- WebAssembly runtime=
 as a PHP language extension: <a href=3D"https://github.com/extism/php-sdk"=
>https://github.com/extism/php-sdk</a></div><div><br></div><div>[1] <a href=
=3D"https://github.com/WordPress/wordpress-playground/">https://github.com/=
WordPress/wordpress-playground/</a></div><div>[2] <a href=3D"https://github=
.com/WordPress/wordpress-playground/tree/trunk/packages/php-wasm/compile">h=
ttps://github.com/WordPress/wordpress-playground/tree/trunk/packages/php-wa=
sm/compile</a> </div><div>[3] <a href=3D"https://developer.wordpress.org/re=
ference/classes/wp_html_processor/">https://developer.wordpress.org/referen=
ce/classes/wp_html_processor/</a></div><div>[4] <a href=3D"https://github.c=
om/WordPress/wordpress-develop/pull/6713">https://github.com/WordPress/word=
press-develop/pull/6713</a></div><div>[5] <a href=3D"https://github.com/Wor=
dPress/blueprints-library/blob/87afea1f9a244062a14aeff3949aae054bf74b70/src=
/WordPress/Zip/ZipStreamReader.php">https://github.com/WordPress/blueprints=
-library/blob/87afea1f9a244062a14aeff3949aae054bf74b70/src/WordPress/Zip/Zi=
pStreamReader.php</a></div><div>[6] <a href=3D"https://github.com/WordPress=
/sqlite-database-integration/pull/157">https://github.com/WordPress/sqlite-=
database-integration/pull/157</a></div><div>[7] <a href=3D"https://github.c=
om/WordPress/blueprints-library/blob/trunk/src/WordPress/AsyncHttp/Client.p=
hp">https://github.com/WordPress/blueprints-library/blob/trunk/src/WordPres=
s/AsyncHttp/Client.php</a> </div><div>[8] <a href=3D"https://security.snyk.=
io/research/zip-slip-vulnerability">https://security.snyk.io/research/zip-s=
lip-vulnerability</a></div><div><br></div><div>-Adam</div><div><br></div><d=
iv><br></div></div>

--00000000000064ac9b0622503bba--