Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125618
Precedence: bulk
MIME-Version: 1.0
References: <A247BB36-9FD1-4AAF-AAB8-82DBD9DE3550@newclarity.net>
 <CA697780-BC2D-4054-A9FD-523E08236732@rwec.co.uk> <8D420123-4ECF-48FD-A9C3-F80C60457A37@newclarity.net>
 <CA+Jpajkx0OraH7GQyB5gECtPOo2JP=RzuSwqfv4AZGY+a+ryPw@mail.gmail.com>
 <AACF228F-53D3-480F-9127-77FBC4AE6A84@newclarity.net> <CAGnYymDhy1dov+4HcFWhAx1Ga9bXR=Urew9RbN5KEXcgHmk=Ew@mail.gmail.com>
 <BC6DCE8C-3CB4-45F3-A7A5-FBF5001B092D@newclarity.net>
In-Reply-To: <BC6DCE8C-3CB4-45F3-A7A5-FBF5001B092D@newclarity.net>
Date: Wed, 18 Sep 2024 13:08:26 +0200
Message-ID: <CAGnYymCO=0BLe7Bx_EZeRTnL3Pf+TCo-tnNLxxT-Dcsoy-hkJA@mail.gmail.com>
Subject: Re: [PHP-DEV] Zephir, and other tangents
To: Mike Schinkel <mike@newclarity.net>
Cc: Adam Zielinski <adam.zielinski@automattic.com>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
From: adam.zielinski@automattic.com (Adam Zielinski)

On Tue, Sep 17, 2024 at 9:17=E2=80=AFPM Mike Schinkel <mike@newclarity.net>=
 wrote:
>
> On Sep 17, 2024, at 8:57 AM, Adam Zielinski <adam.zielinski@automattic.co=
m> wrote:
>
> > To summarize, I think PHP would benefit from:
> >
> > 1. Adding WASM for simple low-level extensibility that could run on
> > shared hosts for things that are just not possible in PHP as described =
a
> > few paragraphs prior, and where we could enhance functionality over tim=
e,
> >
> > 2. Constantly improving PHP the language, which is what you are solely
> > advocating for over extensibility,
> Hi Mike,
>
> I=E2=80=99m Adam, I'm building WordPress Playground [1] =E2=80=93 it's Wo=
rdPress running in the browser via a WebAssembly PHP build [2]. I'm excited=
 to see this discussion and wanted to offer my perspective.
>
> WebAssembly support in PHP core would be a huge security and productivity=
 improvement for the PHP and WordPress communities.
>
> > To summarize, I think PHP would benefit from:
> >
> > 1. Adding WASM for simple low-level extensibility that could run on
> > shared hosts for things that are just not possible in PHP as described =
a
> > few paragraphs prior, and where we could enhance functionality over tim=
e,
>
> Exactly this! With WASM, WordPress would get access to fast, safe, and ba=
ttle-tested libraries.
>
> Today, we're recreating a lot of existing libraries just to be able to us=
e them in PHP, e.g. parsers for HTML [3], XML [4], Zip [5], MySQL [6], or a=
n HTTP client [7]. There are just no viable alternatives. Viable, as in wor=
king on all webhosts, having stellar compliance with each format's specific=
ation, supporting stream parsing, and having low footprint. For example, th=
e curl PHP extensions is brilliant, but it's unavailable on many webhosts.
>
> With WebAssembly support, we could stop rewriting and start leaning on th=
e popular C, Rust, etc. libraries instead. Who knows, maybe we could even p=
olyfill the missing PHP extensions?
>
> > 2. Constantly improving PHP the language, which is what you are solely
> > advocating for over extensibility,
>
> Just to add to that =E2=80=93 I think WASM support is important for PHP t=
o stay relevant. There's an exponential advantage to building a library onc=
e and reusing it across the language boundaries. A lot of companies is inve=
sted in PHP and that won't change in a day. However, lacking access to the =
WASM ecosystem, I can easily imagine the ecosystem slowly gravitating towar=
ds JavaScript, Python, Go, Rust, and other WASM-enabled languages.
>
> Security-wise, WebAssembly is Sandboxed and would enable safe processing =
of untrusted files. Vulnerabilities like Zip slip [8] wouldn't affect a san=
dboxed filesystem. Perhaps we could even create a secure enclave for runnin=
g composer packages and WordPress plugins without having to fully trust the=
m.
>
> Another use-case is code reuse between JavaScript and PHP. I'm sceptical =
this could work with reasonable speed and resource consumption, but let's a=
ssume for a moment there is a ultra low overhead JavaScript runtime in WebA=
ssembly. WordPress could have a consistent templating language. PHP backend=
 would render the website markup using the same templates and libraries as =
the JavaScript frontend. Half the code would achieve the same task.
>
> Also, here's a few interesting "WASM in PHP" projects I found =E2=80=93 m=
aybe they would be helpful:
> - WebAssembly runtime built in PHP (!) https://github.com/jasperweyne/unw=
asm
> - WebAssembly runtime as a PHP language extension: https://github.com/vee=
wee/ext-wasm
> - WebAssembly runtime as a PHP language extension: https://github.com/ext=
ism/php-sdk
>
> [1] https://github.com/WordPress/wordpress-playground/
> [2] https://github.com/WordPress/wordpress-playground/tree/trunk/packages=
/php-wasm/compile
> [3] https://developer.wordpress.org/reference/classes/wp_html_processor/
> [4] https://github.com/WordPress/wordpress-develop/pull/6713
> [5] https://github.com/WordPress/blueprints-library/blob/87afea1f9a244062=
a14aeff3949aae054bf74b70/src/WordPress/Zip/ZipStreamReader.php
> [6] https://github.com/WordPress/sqlite-database-integration/pull/157
> [7] https://github.com/WordPress/blueprints-library/blob/trunk/src/WordPr=
ess/AsyncHttp/Client.php
> [8] https://security.snyk.io/research/zip-slip-vulnerability
>
>
> Thanks for this. It is super great information.
>
> Want to work on an RFC?
>
> -Mike

I'm happy to work together on the RFC document. I won't be able to
help with the implementation, though, which makes me nervous about
this part of the "How To Create an RFC" page:

> If you don't have the skills to fully implement your RFC and no-one volun=
teers to code it, there is little chance your RFC will be successful.

I know Steve Manuel from Dylibso [1] was highly interested in building
WASM support for PHP core. He's the founder of Extism [2] and his team
integrated a WASM runtime with PHP using FFI [3]. There's a conference
recording where he does a live demo of running WASM modules as
WordPress plugins [4]. He might be a better person to create an RFC
with, as he also seemed keen to work on the implementation. I've
reached out to him about this discussion.

[1] https://dylibso.com/
[2] https://extism.org/
[3] https://github.com/extism/php-sdk
[4] https://www.youtube.com/watch?v=3DChZpveTipPU&themeRefresh=3D1 (I
think it was that one)