Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125613
Date: Tue, 17 Sep 2024 19:30:12 -0700 (PDT)
To: Rob Landers <rob@bottled.codes>
Cc: Adam Zielinski <adam.zielinski@automattic.com>,
	Mike Schinkel <mike@newclarity.net>,
	Hammed Ajao <hamiegold@gmail.com>,
	PHP internals <internals@lists.php.net>
Subject: Re: [PHP-DEV] Zephir, and other tangents
Message-ID: <BB0310CD-8134-4B3F-9C51-B59B5A24405F@automattic.com>
In-Reply-To: <f433fbe1-bee4-4a61-ba18-90053975b29e@app.fastmail.com>
References: <A247BB36-9FD1-4AAF-AAB8-82DBD9DE3550@newclarity.net>
	<CA697780-BC2D-4054-A9FD-523E08236732@rwec.co.uk>
	<8D420123-4ECF-48FD-A9C3-F80C60457A37@newclarity.net>
	<CA+Jpajkx0OraH7GQyB5gECtPOo2JP=RzuSwqfv4AZGY+a+ryPw@mail.gmail.com>
	<AACF228F-53D3-480F-9127-77FBC4AE6A84@newclarity.net>
	<CAGnYymDhy1dov+4HcFWhAx1Ga9bXR=Urew9RbN5KEXcgHmk=Ew@mail.gmail.com>
	<f433fbe1-bee4-4a61-ba18-90053975b29e@app.fastmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="=_988767A7-3C8A-481A-8EA4-826A0A89F180"
From: dennis.snell@automattic.com (Dennis Snell)


--=_988767A7-3C8A-481A-8EA4-826A0A89F180
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable



> On Sep 17, 2024, at 2:03 PM, Rob Landers <rob@bottled.codes> wrote:
>=20
>=20
>=20
>=20
>=20
> On Tue, Sep 17, 2024, at 14:57, Adam Zielinski wrote:
>=20
>>> To summarize, I think PHP would benefit from:
>>=20
>>>
>>=20
>>> 1. Adding WASM for simple low-level extensibility that could run on
>>=20
>>> shared hosts for things that are just not possible in PHP as described a
>>=20
>>> few paragraphs prior, and where we could enhance functionality over tim=
e,
>>=20
>>>
>>=20
>>> 2. Constantly improving PHP the language, which is what you are solely
>>=20
>>> advocating for over extensibility,
>>=20
>> Hi Mike,
>>=20
>>=20
>>=20
>> I=E2=80=99m Adam, I'm building WordPress Playground [1] =E2=80=93 it's W=
ordPress running in the browser via a WebAssembly PHP build [2]. I'm excite=
d to see this discussion and wanted to offer my perspective.
>>=20
>>=20
>>=20
>> WebAssembly support in PHP core would be a huge security and productivit=
y improvement for the PHP and WordPress communities.
>>=20
>>=20
>>=20
>>> To summarize, I think PHP would benefit from:
>>=20
>>>
>>=20
>>> 1. Adding WASM for simple low-level extensibility that could run on
>>=20
>>> shared hosts for things that are just not possible in PHP as described a
>>=20
>>> few paragraphs prior, and where we could enhance functionality over tim=
e,
>>=20
>>=20
>>=20
>> Exactly this! With WASM, WordPress would get access to fast, safe, and b=
attle-tested libraries.
>>=20
>>=20
>>=20
>> Today, we're recreating a lot of existing libraries just to be able to u=
se them in PHP, e.g. parsers for HTML [3], XML [4], Zip [5], MySQL [6], or =
an HTTP client [7]. There are just no viable alternatives. Viable, as in wo=
rking on all webhosts, having stellar compliance with each format's specifi=
cation, supporting stream parsing, and having low footprint. For example, t=
he curl PHP extensions is brilliant, but it's unavailable on many webhosts.
>>=20
>>=20
>>=20
>> With WebAssembly support, we could stop rewriting and start leaning on t=
he popular C, Rust, etc. libraries instead. Who knows, maybe we could even =
polyfill the missing PHP extensions?
>>=20
>>=20
>>=20
>>> 2. Constantly improving PHP the language, which is what you are solely
>>=20
>>> advocating for over extensibility,
>>=20
>>=20
>>=20
>> Just to add to that =E2=80=93 I think WASM support is important for PHP =
to stay relevant. There's an exponential advantage to building a library on=
ce and reusing it across the language boundaries. A lot of companies is inv=
ested in PHP and that won't change in a day. However, lacking access to the=
 WASM ecosystem, I can easily imagine the ecosystem slowly gravitating towa=
rds JavaScript, Python, Go, Rust, and other WASM-enabled languages.
>>=20
>>=20
>>=20
>> Security-wise, WebAssembly is Sandboxed and would enable safe processing=
 of untrusted files. Vulnerabilities like Zip slip [8] wouldn't affect a sa=
ndboxed filesystem. Perhaps we could even create a secure enclave for runni=
ng composer packages and WordPress plugins without having to fully trust th=
em.
>>=20
>>=20
>>=20
>> Another use-case is code reuse between JavaScript and PHP. I'm sceptical=
 this could work with reasonable speed and resource consumption, but let's =
assume for a moment there is a ultra low overhead JavaScript runtime in Web=
Assembly. WordPress could have a consistent templating language. PHP backen=
d would render the website markup using the same templates and libraries as=
 the JavaScript frontend. Half the code would achieve the same task.
>>=20
>>=20
>>=20
>> Also, here's a few interesting "WASM in PHP" projects I found =E2=80=93 =
maybe they would be helpful:
>>=20
>> - WebAssembly runtime built in PHP (!)=C2=A0https://github.com/jasperwey=
ne/unwasm
>>=20
>>=20
>> - WebAssembly runtime as a PHP language extension:=C2=A0https://github.c=
om/veewee/ext-wasm
>>=20
>>=20
>> - WebAssembly runtime as a PHP language extension:=C2=A0https://github.c=
om/extism/php-sdk
>>=20
>>=20
>>=20
>>=20
>> [1]=C2=A0https://github.com/WordPress/wordpress-playground/
>>=20
>>=20
>> [2]=C2=A0https://github.com/WordPress/wordpress-playground/tree/trunk/pa=
ckages/php-wasm/compile
>>=20
>>=20
>> [3]=C2=A0https://developer.wordpress.org/reference/classes/wp_html_proce=
ssor/
>>=20
>>=20
>> [4]=C2=A0https://github.com/WordPress/wordpress-develop/pull/6713
>>=20
>>=20
>> [5]=C2=A0https://github.com/WordPress/blueprints-library/blob/87afea1f9a=
244062a14aeff3949aae054bf74b70/src/WordPress/Zip/ZipStreamReader.php
>>=20
>>=20
>> [6]=C2=A0https://github.com/WordPress/sqlite-database-integration/pull/1=
57
>>=20
>>=20
>> [7]=C2=A0https://github.com/WordPress/blueprints-library/blob/trunk/src/=
WordPress/AsyncHttp/Client.php
>>=20
>>=20
>> [8]=C2=A0https://security.snyk.io/research/zip-slip-vulnerability
>>=20
>>=20
>>=20
>>=20
>> -Adam
>>=20
>>=20
>>=20
>>=20
>>=20
>>=20
>>=20
>=20
> Hey Adam,
>=20
>=20
>=20
> I actually went down something like this road for a bit when working at A=
utomattic. My repo even probably still exists in the graveyard repository=
=E2=80=A6 but I had plugins running in C# and Java over a couple of weeks. =
This was long before wasm was a thing, and while cool, nobody really could =
think of a use for it.
>=20
>=20
>=20
> It seems like you have a use for it though, and I=E2=80=99m reasonably ce=
rtain you could get it working over ffi in a few weeks; yet you mention hos=
ts not even having the curl extension installed, so I doubt that even if wa=
sm came to be, it would be available on those hosts.
>=20
>=20

There are two major areas I have found that would benefit from having a WAS=
M runtime in PHP:


Obviously, being able to run the same algorithms on the frontend and backen=
d is a huge win for consistency in applications. Particularly with text-rel=
ated algorithms it=E2=80=99s really easy for inconsistencies to develop due=
 to the features available in each languages standard library, as well as d=
ue to differences in how each language handles and processes string.


The other major area is similar, and we=E2=80=99ve seen this with the HTML =
and XML parsing work recently undertaken in WordPress. There are plenty of =
cases where efficient and spec-compliant operations are valuable, but these=
 kinds of things tend to cost significantly more in user-space PHP. Being a=
ble to jump into WASM, even with the overhead of exchanging that data and r=
unning another VM, would very likely result in a noticeable net improvement=
 in runtime performance. Additionally, it=E2=80=99s a perk being able to wr=
ite such algorithms in languages that aid that development through more pow=
erful type systems.


There=E2=80=99s additional value in a number of other separate tasks. Conve=
rting images or generating thumbnails is a good example where raw performan=
ce is less of a concern than being able to ensure that the image library is=
 available and not exposing the host system to risk. I imagine plenty of =
=E2=80=9CPHP lite-extensions=E2=80=9D appearing in this space because it wo=
uld give people the opportunity to experiment with features that are imprac=
tical in user-space PHP before fully committing the language itself to that=
 interface or library. It would extend the reach of PHP=E2=80=99s usability=
 because it would make possible for folks, who happen to be running on chea=
p shared hosts, to run more complicated processing tasks than are practical=
 today. While big software shops and SaaS vendors do and can run their own =
custom PHP extensions, there=E2=80=99s not great way to share those general=
ly to people without the same full control over their stack.


>=20
>=20
>=20
> However, plugins basically work via hooks/filters. So as long as you regi=
ster the right listeners and handle serialization properly, you can simply =
run a separate process for the plugin, or call a socket for =E2=80=9Cremote=
=E2=80=9D plugins.
>=20
>=20
>=20
> I don=E2=80=99t see anything stopping anyone from implementing that today.
>=20
>=20
> =E2=80=94 Rob
>=20

I=E2=80=99m excited to see this conversation. I=E2=80=99ve wanted to propos=
e it a number of times myself.


Warmly,
Dennis Snell


--=_988767A7-3C8A-481A-8EA4-826A0A89F180
Content-Type: text/html;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w=
3.org/TR/REC-html40/loose.dtd">
<html>
<head>
<meta charset=3D"utf-8">
<style>body{font-family:-apple-system,Helvetica,Arial,sans-serif;}blockquot=
e{margin:0;padding:0 0 0 12px;border-left:1px solid #aaa;color:#aaa;}hr.uni=
box-forward{border:0;color:#888;background-color:#888;height:1px;}</style>
</head>
<body>
<div><br></div>
<blockquote type=3D"cite">
<div>On Sep 17, 2024, at 2:03 PM, Rob Landers &lt;rob@bottled.codes&gt; wro=
te:</div>
<div><br></div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;">
<br class=3D"Apple-interchange-newline"><br>
</div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;">On Tue, S=
ep 17, 2024, at 14:57, Adam Zielinski wrote:<br>
</div>
<blockquote type=3D"cite" id=3D"qt" style=3D"caret-color: rgb(0, 0, 0); fon=
t-family: -webkit-standard; font-variant-caps: normal; font-weight: 400; te=
xt-decoration: none;"><div dir=3D"ltr">
<div>&gt; To summarize, I think PHP would benefit from:<br>
</div>
<div>&gt;<br>
</div>
<div>&gt; 1. Adding WASM for simple low-level extensibility that could run =
on<br>
</div>
<div>&gt; shared hosts for things that are just not possible in PHP as desc=
ribed a<br>
</div>
<div>&gt; few paragraphs prior, and where we could enhance functionality ov=
er time,<br>
</div>
<div>&gt;<br>
</div>
<div>&gt; 2. Constantly improving PHP the language, which is what you are s=
olely<br>
</div>
<div>&gt; advocating for over extensibility,<br>
</div>
<div>Hi Mike,<br>
</div>
<div><br></div>
<div>I=E2=80=99m Adam, I'm building WordPress Playground [1] =E2=80=93 it's=
 WordPress running in the browser via a WebAssembly PHP build [2]. I'm exci=
ted to see this discussion and wanted to offer my perspective.<br>
</div>
<div><br></div>
<div>WebAssembly support in PHP core would be a huge security and productiv=
ity improvement for the PHP and WordPress communities.<br>
</div>
<div><br></div>
<div>&gt; To summarize, I think PHP would benefit from:<br>
</div>
<div>&gt;<br>
</div>
<div>&gt; 1. Adding WASM for simple low-level extensibility that could run =
on<br>
</div>
<div>&gt; shared hosts for things that are just not possible in PHP as desc=
ribed a<br>
</div>
<div>&gt; few paragraphs prior, and where we could enhance functionality ov=
er time,<br>
</div>
<div><br></div>
<div>Exactly this! With WASM, WordPress would get access to fast, safe, and=
 battle-tested libraries.<br>
</div>
<div><br></div>
<div>Today, we're recreating a lot of existing libraries just to be able to=
 use them in PHP, e.g. parsers for HTML [3], XML [4], Zip [5], MySQL [6], o=
r an HTTP client [7]. There are just no viable alternatives. Viable, as in =
working on all webhosts, having stellar compliance with each format's speci=
fication, supporting stream parsing, and having low footprint. For example,=
 the curl PHP extensions is brilliant, but it's unavailable on many webhost=
s.<br>
</div>
<div><br></div>
<div>With WebAssembly support, we could stop rewriting and start leaning on=
 the popular C, Rust, etc. libraries instead. Who knows, maybe we could eve=
n polyfill the missing PHP extensions?<br>
</div>
<div><br></div>
<div>&gt; 2. Constantly improving PHP the language, which is what you are s=
olely<br>
</div>
<div>&gt; advocating for over extensibility,<br>
</div>
<div><br></div>
<div>Just to add to that =E2=80=93 I think WASM support is important for PH=
P to stay relevant. There's an exponential advantage to building a library =
once and reusing it across the language boundaries. A lot of companies is i=
nvested in PHP and that won't change in a day. However, lacking access to t=
he WASM ecosystem, I can easily imagine the ecosystem slowly gravitating to=
wards JavaScript, Python, Go, Rust, and other WASM-enabled languages.<br>
</div>
<div><br></div>
<div>Security-wise, WebAssembly is Sandboxed and would enable safe processi=
ng of untrusted files. Vulnerabilities like Zip slip [8] wouldn't affect a =
sandboxed filesystem. Perhaps we could even create a secure enclave for run=
ning composer packages and WordPress plugins without having to fully trust =
them.<br>
</div>
<div><br></div>
<div>Another use-case is code reuse between JavaScript and PHP. I'm sceptic=
al this could work with reasonable speed and resource consumption, but let'=
s assume for a moment there is a ultra low overhead JavaScript runtime in W=
ebAssembly. WordPress could have a consistent templating language. PHP back=
end would render the website markup using the same templates and libraries =
as the JavaScript frontend. Half the code would achieve the same task.<br>
</div>
<div><br></div>
<div>Also, here's a few interesting "WASM in PHP" projects I found =
=E2=80=93 maybe they would be helpful:<br>
</div>
<div>- WebAssembly runtime built in PHP (!)<span class=3D"Apple-converted-s=
pace">=C2=A0</span><a href=3D"https://github.com/jasperweyne/unwasm">https:=
//github.com/jasperweyne/unwasm</a><br>
</div>
<div>- WebAssembly runtime as a PHP language extension:<span class=3D"Apple=
-converted-space">=C2=A0</span><a href=3D"https://github.com/veewee/ext-was=
m">https://github.com/veewee/ext-wasm</a><br>
</div>
<div>- WebAssembly runtime as a PHP language extension:<span class=3D"Apple=
-converted-space">=C2=A0</span><a href=3D"https://github.com/extism/php-sdk=
">https://github.com/extism/php-sdk</a><br>
</div>
<div><br></div>
<div>[1]<span class=3D"Apple-converted-space">=C2=A0</span><a href=3D"https=
://github.com/WordPress/wordpress-playground/">https://github.com/WordPress=
/wordpress-playground/</a><br>
</div>
<div>[2]<span class=3D"Apple-converted-space">=C2=A0</span><a href=3D"https=
://github.com/WordPress/wordpress-playground/tree/trunk/packages/php-wasm/c=
ompile">https://github.com/WordPress/wordpress-playground/tree/trunk/packag=
es/php-wasm/compile</a><br>
</div>
<div>[3]<span class=3D"Apple-converted-space">=C2=A0</span><a href=3D"https=
://developer.wordpress.org/reference/classes/wp_html_processor/">https://de=
veloper.wordpress.org/reference/classes/wp_html_processor/</a><br>
</div>
<div>[4]<span class=3D"Apple-converted-space">=C2=A0</span><a href=3D"https=
://github.com/WordPress/wordpress-develop/pull/6713">https://github.com/Wor=
dPress/wordpress-develop/pull/6713</a><br>
</div>
<div>[5]<span class=3D"Apple-converted-space">=C2=A0</span><a href=3D"https=
://github.com/WordPress/blueprints-library/blob/87afea1f9a244062a14aeff3949=
aae054bf74b70/src/WordPress/Zip/ZipStreamReader.php">https://github.com/Wor=
dPress/blueprints-library/blob/87afea1f9a244062a14aeff3949aae054bf74b70/src=
/WordPress/Zip/ZipStreamReader.php</a><br>
</div>
<div>[6]<span class=3D"Apple-converted-space">=C2=A0</span><a href=3D"https=
://github.com/WordPress/sqlite-database-integration/pull/157">https://githu=
b.com/WordPress/sqlite-database-integration/pull/157</a><br>
</div>
<div>[7]<span class=3D"Apple-converted-space">=C2=A0</span><a href=3D"https=
://github.com/WordPress/blueprints-library/blob/trunk/src/WordPress/AsyncHt=
tp/Client.php">https://github.com/WordPress/blueprints-library/blob/trunk/s=
rc/WordPress/AsyncHttp/Client.php</a><br>
</div>
<div>[8]<span class=3D"Apple-converted-space">=C2=A0</span><a href=3D"https=
://security.snyk.io/research/zip-slip-vulnerability">https://security.snyk.=
io/research/zip-slip-vulnerability</a><br>
</div>
<div><br></div>
<div>-Adam<br>
</div>
<div><br></div>
<div><br></div>
</div></blockquote>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;"><br></div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;">Hey Adam,=
<br>
</div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;"><br></div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;">I actuall=
y went down something like this road for a bit when working at Automattic. =
My repo even probably still exists in the graveyard repository=E2=80=A6 but=
 I had plugins running in C# and Java over a couple of weeks. This was long=
 before wasm was a thing, and while cool, nobody really could think of a us=
e for it.<br>
</div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;"><br></div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;">It seems =
like you have a use for it though, and I=E2=80=99m reasonably certain you c=
ould get it working over ffi in a few weeks; yet you mention hosts not even=
 having the curl extension installed, so I doubt that even if wasm came to =
be, it would be available on those hosts.<br>
</div>
</blockquote>
<div><br></div>
<div>There are two major areas I have found that would benefit from having =
a WASM runtime in PHP:</div>
<div><br></div>
<div>Obviously, being able to run the same algorithms on the frontend and b=
ackend is a huge win for consistency in applications. Particularly with tex=
t-related algorithms it=E2=80=99s really easy for inconsistencies to develo=
p due to the features available in each languages standard library, as well=
 as due to differences in how each language handles and processes string.</=
div>
<div><br></div>
<div>The other major area is similar, and we=E2=80=99ve seen this with the =
HTML and XML parsing work recently undertaken in WordPress. There are plent=
y of cases where efficient and spec-compliant operations are valuable, but =
these kinds of things tend to cost significantly more in user-space PHP. Be=
ing able to jump into WASM, even with the overhead of exchanging that data =
and running another VM, would very likely result in a noticeable net improv=
ement in runtime performance. Additionally, it=E2=80=99s a perk being able =
to write such algorithms in languages that aid that development through mor=
e powerful type systems.</div>
<div><br></div>
<div>There=E2=80=99s additional value in a number of other separate tasks. =
Converting images or generating thumbnails is a good example where raw perf=
ormance is less of a concern than being able to ensure that the image libra=
ry is available and not exposing the host system to risk. I imagine plenty =
of =E2=80=9CPHP lite-extensions=E2=80=9D appearing in this space because it=
 would give people the opportunity to experiment with features that are imp=
ractical in user-space PHP before fully committing the language itself to t=
hat interface or library. It would extend the reach of PHP=E2=80=99s usabil=
ity because it would make possible for folks, who happen to be running on c=
heap shared hosts, to run more complicated processing tasks than are practi=
cal today. While big software shops and SaaS vendors do and can run their o=
wn custom PHP extensions, there=E2=80=99s not great way to share those gene=
rally to people without the same full control over their stack.</div>
<div><br></div>
<blockquote type=3D"cite">
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;">
</div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;"><br></div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;">However, =
plugins basically work via hooks/filters. So as long as you register the ri=
ght listeners and handle serialization properly, you can simply run a separ=
ate process for the plugin, or call a socket for =E2=80=9Cremote=E2=80=9D p=
lugins.<br>
</div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;"><br></div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;">I don=
=E2=80=99t see anything stopping anyone from implementing that today.</div>
<div style=3D"caret-color: rgb(0, 0, 0); font-family: -webkit-standard; fon=
t-variant-caps: normal; font-weight: 400; text-decoration: none;"><br></div>
<div id=3D"sig121229152" style=3D"caret-color: rgb(0, 0, 0); font-family: -=
webkit-standard; font-variant-caps: normal; font-weight: 400; text-decorati=
on: none;">=E2=80=94 Rob</div>
</blockquote>
<div><br></div>
<div>I=E2=80=99m excited to see this conversation. I=E2=80=99ve wanted to p=
ropose it a number of times myself.</div>
<div><br></div>
<div>Warmly,</div>
<div>Dennis Snell</div>
</body>
</html>
--=_988767A7-3C8A-481A-8EA4-826A0A89F180--