Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125635
Content-Type: text/plain;
	charset=utf-8
Precedence: bulk
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.10\))
Subject: Re: [PHP-DEV] Zephir, and other tangents
In-Reply-To: <f82330df-d7da-4abe-bf4a-8fcb32c1fa1a@app.fastmail.com>
Date: Fri, 20 Sep 2024 01:20:46 -0400
Cc: Adam Zielinski <adam.zielinski@automattic.com>,
 PHP internals <internals@lists.php.net>,
 Dennis Snell <dennis.snell@automattic.com>
Content-Transfer-Encoding: quoted-printable
Message-ID: <C1BAD4A3-2B45-4BEC-B2C1-714F4D888393@newclarity.net>
References: <A247BB36-9FD1-4AAF-AAB8-82DBD9DE3550@newclarity.net>
 <CA697780-BC2D-4054-A9FD-523E08236732@rwec.co.uk>
 <8D420123-4ECF-48FD-A9C3-F80C60457A37@newclarity.net>
 <CA+Jpajkx0OraH7GQyB5gECtPOo2JP=RzuSwqfv4AZGY+a+ryPw@mail.gmail.com>
 <AACF228F-53D3-480F-9127-77FBC4AE6A84@newclarity.net>
 <CA+Jpajkuccd1XAur9pXp5u4yNGsHmH9B_8ugK+Q7rT9P4wvUYw@mail.gmail.com>
 <CAGnYymDigWop7+XOAv_HtsYtW4oPE=QuHtehafrgLSOz73VuDg@mail.gmail.com>
 <CA+JpajnQj-Y7OhpUWqi0r7fKmvwCfpt35R6gv4zydK67DkTv4A@mail.gmail.com>
 <E96AEF76-0823-4CE0-8E87-DDBAF35B8F59@newclarity.net>
 <f82330df-d7da-4abe-bf4a-8fcb32c1fa1a@app.fastmail.com>
To: "Rowan Tommins [IMSoP]" <imsop.php@rwec.co.uk>,
 Hammed Ajao <hamiegold@gmail.com>
From: mike@newclarity.net (Mike Schinkel)

> On Sep 19, 2024, at 12:00 PM, Rowan Tommins [IMSoP] =
<imsop.php@rwec.co.uk> wrote:
>=20
> On Wed, 18 Sep 2024, at 20:33, Mike Schinkel wrote:
>> Yeah. That was the original goal.
>>=20
>> But to say WASM's domain is limited to browsers is not valid any =
longer:
>> [...]
>=20
> While it's definitely interesting seeing what uses it's being put to =
beyond the browser, the majority of those articles are talking about =
using WASM on its own, in the kind of places where you might use a =
container, to host things like microservices, serverless functions, etc.

Sigh. I did not include all potential examples. Leave it to you to limit =
your characterizations to only the ones I included.=20

Here is another:

https://github.com/wasmerio/wasmer-php

> Embedding it into other languages is a different usage again. It's =
certainly something that is being explored, e.g. by Extism, and that =
seems like a good project for anyone interested here to participate in, =
e.g. to help design the "glue" between PHP and WASM / Extism.

Moot point as it cannot be run on a managed hosted server.

https://github.com/extism/php-sdk

>> WASM's ability to run on a managed server =E2=80=93 assuming it were =
built-in=20
>> to PHP core
>=20
> Just to reiterate, if by "built-in to PHP core", you mean "every copy =
of PHP includes a functional WASM runtime", that's not going to happen. =
It would mean bundling (or requiring every user to install) a huge =
third-party dependency, with all of its dependencies and platform =
requirements, even if they weren't interested in using it.

So why do you claim that bundling a third-party dependency is a "never =
going to happen" scenario? =20

By that logic PHP would have none of these functionalities:

=E2=80=A2 cURL
=E2=80=A2 GD
=E2=80=A2 PDO
=E2=80=A2 OpenSSL
=E2=80=A2 MBString
=E2=80=A2 Zlib
=E2=80=A2 Zip
=E2=80=A2 XSL
=E2=80=A2 EXIF
=E2=80=A2 BCMath

And PHP would be much less useful without any one of them.=20

> The only runtimes where WASM is ever going to be available "out of the =
box" are those already built on a JavaScript engine (usually V8), like =
node.js, Deno, Electron, etc. The WASM is then running inside the =
existing runtime, not a whole new VM - like running Scala and Java code =
in the same JVM; or Hack and PHP in (older versions of) HHVM.

Seems you do not actually understand WASM runtimes. =20

While WebAssembly is available "out of the box" in JavaScript-based =
runtimes like Node.js, Deno, and Electron, it is not limited to them. =
Standalone WebAssembly runtimes like Wasmtime and WAVM allow WebAssembly =
to be run as a general-purpose compute target, outside the scope of a =
JavaScript engine.=20

> On Sep 19, 2024, at 4:41 PM, Hammed Ajao <hamiegold@gmail.com> wrote:
>=20
> Shared hosting for php gets you the worst possible version of php. =
Can't recompile to enable any bundled extension, can't install any new =
extensions, so how exactly would you approach this? Wasm bundled with =
the engine by default? Or some kind of opt in mechanism that shared =
hosters won't even be able to use?

To be clear, shared hosting and managed hosting can be VERY different =
animals.=20

I am advocating for enterprise-level managed hosting =E2=80=94 like =
Pantheon =E2=80=94 not shared hosting like GoDaddy.

> On Sep 19, 2024, at 4:12 PM, Hammed Ajao <hamiegold@gmail.com> wrote:
> On Wed, Sep 18, 2024, 1:33=E2=80=AFp.m. Mike Schinkel =
<mike@newclarity.net> wrote:
> But to say WASM's domain is limited to browsers is not valid any =
longer:
>=20
> I don't know where you got that since I never said anything along =
those lines.

You did not say that explicitly, but you strongly implied it. Had you =
not meant to imply it then you'll argument would have made little sense =
because you would been implicitly admitting there are other uses for it.

> But since you have all those guides and it's so practical, what's =
stopping you? You'd do a better job of convincing me with a MVP than =
some random blog posts.

Here you go:

https://github.com/wasmerio/wasmer-php

BTW, as you being a C++ developer your argument is rather cynical =
because most PHP developers do not have the skills to write PHP =
extensions or work with FFI, and it is not a skill that can be acquired =
in a few weeks worth of free time. So you saying "Just do it" can be =
seen by a cynical person as you attempting to shut down discussion by =
presenting a blocking task that you can be pretty sure is too high a =
technical bar for most PHP developers.

I do want to gain that skill, but I doubt that I will be able to any =
time in the near future, especially not with other work commitments.=20

> - https://docs.docker.com/desktop/wasm/
>=20
> You mean the feature that's been in beta since 2022? Yeah that's =
exactly what I'm referring to. If docker and all their money and =
engineers haven't shipped wasm in 2 years, how long do you think it'll =
take a bunch of volunteers?

Shipping as a container runtime without the surrounding support of a =
host is a bit more complicated than implementing within a host.=20

By your argument Node, Deno, and Wasmer would not have been able to ship =
WASM support yet.

> You can't do shit on a managed server, that is not the bar at all.=20

Who made you the arbiter of what the bar should be for the needs of =
other people?

> What makes you so sure that wasm will be allowed on managed hosts? =
What's the incentive for providers to allow it?

The incentives would be market differentiation and customer demand.

For security reasons it does not matter if customers demanded FFI or =
extensions written in C, there is simply too much risk.

But if there were a sandboxed secure runtime shipped with PHP, =
especially one that could be memory-limited and CPU-throttled, then it =
would be easy for some managed hosts to decide to enable it.  Not all =
would, but channeling your imagined role as arbiter, I would say that is =
not "the bar."

> > Extensions, which are already implemented in lower-level languages =
like C or C++, would still need to be compiled to WebAssembly if the =
goal were full compatibility.

When did I or anyone proposing WASM for PHP suggest that making =
compiling extensions into WebAssembly would necessarily be a blocking =
requirement?

> This might lead us down the path of either creating a domain-specific =
language (DSL) for PHP=E2=80=94similar to AssemblyScript=E2=80=94or =
simply leaving it up to the library authors to choose lower-level =
languages (as is currently the case).

Or, simply allowing AssemblyScript as the initial way to use WASM in PHP =
core.
=20
> > In essence, WebAssembly is great for certain scenarios, but PHP has =
existing mechanisms that make the addition of a Wasm runtime potentially =
redundant for most use cases.=20

Then for those cases where it is redundant, don't use it.

> I hear you, you want to run low level code on managed servers. I would =
approach the problem differently e.g. Creating some kind of directory =
for `trusted` php extensions, the criteria for what qualifies as =
`trusted` would be up for discussion. Or maybe we can bundle a small std =
lib of select extensions with core. Those make a lot more sense to me =
than adding an entire abstraction layer.

Many hosts already whitelist php extensions. That does not help.=20

The use-case being discussed by me and the others who commented in =
support of WASM is primarily bespoke code written for project-specific =
requirements.

I am not saying WASM has to be the thing to meets that need, but AFAIK =
there is no other potential similar solution that could address it.  You =
can dismiss that goals as being unimportant or "not making sense," but =
that does not mean there are not those who find meeting that need to =
make a lot of sense.

Let me turn it around then and ask that =E2=80=94 rather than being the =
gatekeeper against a solution=E2=80=94 you instead propose a solution to =
address all the following requirements:

Ability to run some form of =
module/add-in/extension/whatever-you-want-to-call-it in PHP that:

1. Ships with PHP code so those managed hosts who want to enable it can =
easily do so,
2. Allows for fully-bespoke project-specific things to be developed,=20
3. Is reasonably easy to program in a secure way (not C or C++),=20
4. Enables near native performance for things like looping and string =
manipulation and maths, and
5. And is secure, can limit memory use, and can throttle CPU hogging so =
hosts will not object to enabling it.

Since you have already dismissed WASM as not the right approach, how =
would you alternately address those requirements?

-Mike=