Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125656
Date: Mon, 23 Sep 2024 10:58:34 -0700 (PDT)
To: Mike Schinkel <mike@newclarity.net>
Cc: Arvids Godjuks <arvids.godjuks@gmail.com>,
	Niels Dossche <dossche.niels@gmail.com>,
	Larry Garfield <larry@garfieldtech.com>,
	=?UTF-8?Q?Rowan_Tommins_=5BIMSoP=5D?= <imsop.php@rwec.co.uk>,
	Hammed Ajao <hamiegold@gmail.com>,
	Rob Landers <rob@bottled.codes>,
	Adam Zielinski <adam.zielinski@automattic.com>,
	PHP internals <internals@lists.php.net>
Subject: Re: [PHP-DEV] Zephir, and other tangents
Message-ID: <F35FF058-7627-4D22-A22D-98477605ED9E@automattic.com>
In-Reply-To: <042AF6B3-ACAD-498E-99FA-CD7EDE8778FC@newclarity.net>
References: <A247BB36-9FD1-4AAF-AAB8-82DBD9DE3550@newclarity.net>
	<CA697780-BC2D-4054-A9FD-523E08236732@rwec.co.uk>
	<8D420123-4ECF-48FD-A9C3-F80C60457A37@newclarity.net>
	<CA+Jpajkx0OraH7GQyB5gECtPOo2JP=RzuSwqfv4AZGY+a+ryPw@mail.gmail.com>
	<AACF228F-53D3-480F-9127-77FBC4AE6A84@newclarity.net>
	<CAGnYymDhy1dov+4HcFWhAx1Ga9bXR=Urew9RbN5KEXcgHmk=Ew@mail.gmail.com>
	<f433fbe1-bee4-4a61-ba18-90053975b29e@app.fastmail.com>
	<BB0310CD-8134-4B3F-9C51-B59B5A24405F@automattic.com>
	<CA+Jpajnk9i=EhqXaKnYUTHhA_1TfzB1qiLfRh1whPoO8Y8ECqA@mail.gmail.com>
	<7EA884D2-0F37-4BF1-AC97-DB6953C944E6@automattic.com>
	<CAL0xaBHKUxwbzAYaPHevLSAEvWOQRPLsraxEg3oQtJ=wTxAkiw@mail.gmail.com>
	<042AF6B3-ACAD-498E-99FA-CD7EDE8778FC@newclarity.net>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="=_066572BE-451A-470D-B867-D4C34B1ECFE5"
From: dennis.snell@automattic.com (Dennis Snell)


--=_066572BE-451A-470D-B867-D4C34B1ECFE5
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable

Thanks for your thoughtful response, Mike. I hope everyone had a nice weeke=
nd.


> However, my guess is that Automattic (spelled correctly) is not likely to=
 do that given how dismissive PHP Internals and by extension the PHP Founda=
tion has been regarding the needs of WordPress users for as long as you Arv=
ids have been doing PHP. =C2=A0
>=20
>=20
> But who knows, maybe there could be a d=C3=A9tente? =C2=A0Who on this lis=
t would be more open than in the past to treat concerns of WordPress users =
as legitimate rather than dismiss them because (I am paraphrasing) "how bad=
 their code is?"
>=20
>=20

At Automattic we=E2=80=99re used to working in the open. With WordPress its=
elf (apart from Automattic) even more so. Dismissal is my bread and butter =
=F0=9F=98=84 But we=E2=80=99re still working hard to make the web a better =
place and I=E2=80=99m happy to partner with anyone, even if we share disagr=
eement.


> Or the ones who want to target the users of the CMS or Framework that rec=
ommend or require the extension.
>=20
>=20
> If the extension were bundled then I expect it could become a recommended=
 extension for hosts to enable and WordPress could start shipping WASM exte=
nsions for the use-cases Dennis Snell mentioned that can optionally run if =
the WASM extension is enabled vs. if not it would just run the old slower P=
HP code.
>=20
>=20
> BTW, Dennis, could you see WordPress recommending a WASM extension if PHP=
 bundled one here?=C2=A0https://make.wordpress.org/hosting/handbook/server-=
environment/#php-extensions
>=20
>=20
>=20
>=20

Absolutely, though realistically we=E2=80=99re still talking about _years_ =
before it could be required. We=E2=80=99re not going to alienate a broad sw=
atch of the internet just to get a new feature. But WordPress has become mo=
re assertive in pushing updates, both on users and on hosts. There is a com=
ponent of the decision that depends on how many sites are still using old v=
ersions and there is a component that looks at things like security issues,=
 whether a version is supported, and whether hosts offer the newer versions.


WordPress today requires PHP 7.2.24, though that=E2=80=99s hidden in a para=
graph of text after stating that the recommended minimum is 7.4. I believe =
that the update cycle has been contracting over time and the ecosystem is d=
oing a much better job today at keeping updated than it was a decade ago.


My guess is that we could see rapid adoption of some WASM extensions and ad=
d it to the recommended list. This is _my_ opinion though, and other mainta=
iners may disagree.


>=20
>> How would we handle the JS-like stdlib of assembly script? Another abstr=
action layer? That seems easier to you than a DSL created specifically for =
this?=C2=A0
>>=20
>>=20
>>=20
>=20
>=20
>=20
>=20
>=20

At this point I am realizing I might have completely misunderstood the orig=
inal tangent into WASM. For one, I also find the idea of a DSL surprising f=
or the needs being discussed. I=E2=80=99d like to understand better what th=
is means, or what kind of extension would benefit from such a DSL, and what=
 stage of the build this is being discussed (for example, a DSL for more ea=
sily writing PHP extensions in C, or a DSL like eBPF which PHP code can bui=
ld as a string and submit for processing internally).


>=20
>=20
>> With PHP like syntax?=C2=A0
>>=20
>>=20
>>=20
>=20
> Why is "PHP like syntax" a blocking requirement? =C2=A0C does not have a =
PHP-like syntax, or at least one that is not more similar to AssemblyScript=
 than PHP. =C2=A0Why then is C acceptable for extensions but AssemblyScript=
 is not?
>=20
>=20
> And even so, there is no reason a PHP-like syntax is required. PHP develo=
pers work with JS or TS every day, and AssemblyScript is just a variant of =
TypeScript.
>=20
>=20
>=20
>=20
>=20
>=20

What does it mean to build a WASM runtime _for AssemblyScript_? When I thin=
k about it, I consider a real black-box implementation with basic means of =
transferring primitive data types across the barrier. In JS we have numbers=
 and shared memory buffers. This leaves many things wanting, but also is =
=E2=80=9Cenough=E2=80=9D and makes the security domain much smaller and eas=
ier to ensure.


I=E2=80=99m not sure how to visualize what people are discussing when they =
talk about designing something for AssemblyScript. Would that exclude the a=
bility to run C applications or Rust applications compiled to WebAssembly?


> Once CMS & Frameworks are empowered to use WASM as part of their core off=
ering then they could start recommending WASM and managed web hosts that wa=
nt to cater to their users would start offering WASM enabled on their platf=
orms.
>=20
>=20
> BTW, very few CMS or Frameworks make any extensions not referenced in pro=
duction.ini as requirements, and for very good reason because doing so woul=
d be too risky.=C2=A0
>=20
>=20
>=20
>=20
>=20

We can flip the discussion, too. The idea of running code on a WASM runtime=
 from PHP isn=E2=80=99t just about stuffing new complexity into PHP. The da=
y we _require_ a WASM runtime is the day we can drop almost every other PHP=
 extension from the required list. It=E2=80=99s great having `curl` and `ex=
if` and `pcre` available, but the fact that they may not be makes every cal=
l out to them a liability - every call needs to a fallback implementation i=
n user-land PHP or else we=E2=80=99re going to have to deal with site crash=
es.


Even extensions like `mb_string` are incredibly useful, but only because we=
 don=E2=80=99t have access to tools that better fit the needs we have as a =
CMS. There are some very surprising code snippets that exist (a) because `m=
b_string` isn=E2=80=99t guaranteed to be there and (b) because the interfac=
e is close enough to look right but different enough to be extremely awkwar=
d.


One quick example comes up from just two nights ago: detecting URLs. We wan=
t to have a Unicode-aware `strspn()` function, so we have to use PCRE with =
the Unicode flag set. Now we have dependencies on extensions and no practic=
al fallback, also the code in JavaScript cannot be the same because they us=
e different regular expression syntax and people have to manually and corre=
ctly translate that. (Well, I have proposed some user-space PHP code to pro=
vide a streaming UTF-8 decoder, but it=E2=80=99s much slower than the C cod=
e inside PHP or the WASM binary would be). One new algorithm, compiled to W=
ASM, could return the byte-offsets into a string where URLs are detected an=
d then the PHP and JS could have a stable agreement and it wouldn=E2=80=99t=
 depend on any other extensions than WASM.


Having spent years dealing with text encoding issues I=E2=80=99d cheerly re=
place existing `mb_` code in WordPress with custom functionality as a WASM =
module. And again, I want to highlight that this is a win for hosts. Nobody=
 needs to ask their host to install new extensions, no host has to evaluate=
 the security or reliability of an extension. Nobody has to come begging fo=
r a rapid update to `openssl` because some vulnerability gave internet visi=
tors root-level access on the host=E2=80=99s server. Nobody has to be disap=
pointed because their host refuses to make `libvips` available to PHP code =
for the one site on their service that wants it. Hosts can start _removing_=
 extensions that have long been headaches but are so necessary in practice =
that they can=E2=80=99t get rid of them.



=E2=80=94=E2=80=94


This was supposed to be a very brief response. Sorry, and thanks for your p=
atience reading through to the end. I=E2=80=99m responding because I feel l=
ike the conversation is relevant and good, but my tone is meant to be frien=
dly with a realizing that none of this stuff is likely happening rapidly, a=
nd nobody is demanding this work. I want PHP to grow and mature, as I hope =
all here do, and I=E2=80=99m sharing where I can see WASM being the missing=
 piece that we=E2=80=99ve wanted or needed for a long time to relieve press=
ure from the core language and escape from many of the legacy warts that ma=
ke building reliable performant software in PHP so difficult.


Warmly,
Dennis Snell


--=_066572BE-451A-470D-B867-D4C34B1ECFE5
Content-Type: text/html;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w=
3.org/TR/REC-html40/loose.dtd">
<html>
<head>
<meta charset=3D"utf-8">
<style>body{font-family:-apple-system,Helvetica,Arial,sans-serif;}blockquot=
e{margin:0;padding:0 0 0 12px;border-left:1px solid #aaa;color:#aaa;}hr.uni=
box-forward{border:0;color:#888;background-color:#888;height:1px;}</style>
</head>
<body>
<div>Thanks for your thoughtful response, Mike. I hope everyone had a nice =
weekend.<br>
</div>
<br><blockquote type=3D"cite"><div style=3D"overflow-wrap: break-word; -web=
kit-nbsp-mode: space; line-break: after-white-space;">

<div>However, my guess is that Automattic (spelled correctly) is not likely=
 to do that given how dismissive PHP Internals and by extension the PHP Fou=
ndation has been regarding the needs of WordPress users for as long as you =
Arvids have been doing PHP. =C2=A0</div>
<div><br class=3D""></div>
<div>But who knows, maybe there could be a d=C3=A9tente? =C2=A0Who on this =
list would be more open than in the past to treat concerns of WordPress use=
rs as legitimate rather than dismiss them because (I am paraphrasing) "how =
bad their code is?"</div>
</div></blockquote>
<div><br></div>
<div>At Automattic we=E2=80=99re used to working in the open. With WordPres=
s itself (apart from Automattic) even more so. Dismissal is my bread and bu=
tter =F0=9F=98=84 But we=E2=80=99re still working hard to make the web a be=
tter place and I=E2=80=99m happy to partner with anyone, even if we share d=
isagreement.</div>
<div><br></div>
<blockquote type=3D"cite"><div style=3D"overflow-wrap: break-word; -webkit-=
nbsp-mode: space; line-break: after-white-space;">
<div class=3D"" style=3D"overflow-wrap: break-word; -webkit-nbsp-mode: spac=
e; line-break: after-white-space;">
<div>
Or the ones who want to target the users of the CMS or Framework that recom=
mend or require the extension.</div>
<div><br class=3D""></div>
<div>If the extension were bundled then I expect it could become a recommen=
ded extension for hosts to enable and WordPress could start shipping WASM e=
xtensions for the use-cases Dennis Snell mentioned that can optionally run =
if the WASM extension is enabled vs. if not it would just run the old slowe=
r PHP code.</div>
<div><br class=3D""></div>
<div>BTW, Dennis, could you see WordPress recommending a WASM extension if =
PHP bundled one here?=C2=A0<a href=3D"https://make.wordpress.org/hosting/ha=
ndbook/server-environment/#php-extensions" class=3D"">https://make.wordpres=
s.org/hosting/handbook/server-environment/#php-extensions</a>
</div>
</div>
</div></blockquote>
<div><br></div>
<div>Absolutely, though realistically we=E2=80=99re still talking about _ye=
ars_ before it could be required. We=E2=80=99re not going to alienate a bro=
ad swatch of the internet just to get a new feature. But WordPress has beco=
me more assertive in pushing updates, both on users and on hosts. There is =
a component of the decision that depends on how many sites are still using =
old versions and there is a component that looks at things like security is=
sues, whether a version is supported, and whether hosts offer the newer ver=
sions.</div>
<div><br></div>
<div>WordPress today requires PHP 7.2.24, though that=E2=80=99s hidden in a=
 paragraph of text after stating that the recommended minimum is 7.4. I bel=
ieve that the update cycle has been contracting over time and the ecosystem=
 is doing a much better job today at keeping updated than it was a decade a=
go.</div>
<div><br></div>
<div>My guess is that we could see rapid adoption of some WASM extensions a=
nd add it to the recommended list. This is _my_ opinion though, and other m=
aintainers may disagree.</div>
<div><br></div>
<blockquote type=3D"cite"><div style=3D"overflow-wrap: break-word; -webkit-=
nbsp-mode: space; line-break: after-white-space;"><div class=3D"" style=3D"=
overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-whit=
e-space;"><div><div class=3D"" style=3D"overflow-wrap: break-word; -webkit-=
nbsp-mode: space; line-break: after-white-space;"><div>


<br class=3D""><blockquote type=3D"cite" class=3D""><div dir=3D"ltr" class=
=3D""><div class=3D"gmail_quote"><div class=3D"">How would we handle the JS=
-like stdlib of assembly script? Another abstraction layer? That seems easi=
er to you than a DSL created specifically for this?=C2=A0</div></div></div>=
</blockquote>
</div></div></div></div></div></blockquote>
<div><br></div>
<div>At this point I am realizing I might have completely misunderstood the=
 original tangent into WASM. For one, I also find the idea of a DSL surpris=
ing for the needs being discussed. I=E2=80=99d like to understand better wh=
at this means, or what kind of extension would benefit from such a DSL, and=
 what stage of the build this is being discussed (for example, a DSL for mo=
re easily writing PHP extensions in C, or a DSL like eBPF which PHP code ca=
n build as a string and submit for processing internally).</div>
<div><br></div>
<blockquote type=3D"cite"><div style=3D"overflow-wrap: break-word; -webkit-=
nbsp-mode: space; line-break: after-white-space;"><div class=3D"" style=3D"=
overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-whit=
e-space;"><div><div class=3D"" style=3D"overflow-wrap: break-word; -webkit-=
nbsp-mode: space; line-break: after-white-space;"><div>
<div><br class=3D""></div>
<blockquote type=3D"cite" class=3D""><div dir=3D"ltr" class=3D""><div class=
=3D"gmail_quote"><div class=3D"">With PHP like syntax?=C2=A0</div></div></d=
iv></blockquote>
<div><br class=3D""></div>
<div>Why is "PHP like syntax" a blocking requirement? =C2=A0C does not have=
 a PHP-like syntax, or at least one that is not more similar to AssemblyScr=
ipt than PHP. =C2=A0Why then is C acceptable for extensions but AssemblyScr=
ipt is not?</div>
<div><br class=3D""></div>
<div>And even so, there is no reason a PHP-like syntax is required. PHP dev=
elopers work with JS or TS every day, and AssemblyScript is just a variant =
of TypeScript.</div>
</div></div></div></div></div></blockquote>
<div><br></div>
<div>What does it mean to build a WASM runtime _for AssemblyScript_? When I=
 think about it, I consider a real black-box implementation with basic mean=
s of transferring primitive data types across the barrier. In JS we have nu=
mbers and shared memory buffers. This leaves many things wanting, but also =
is =E2=80=9Cenough=E2=80=9D and makes the security domain much smaller and =
easier to ensure.</div>
<div><br></div>
<div>I=E2=80=99m not sure how to visualize what people are discussing when =
they talk about designing something for AssemblyScript. Would that exclude =
the ability to run C applications or Rust applications compiled to WebAssem=
bly?</div>
<div><br></div>
<blockquote type=3D"cite"><div style=3D"overflow-wrap: break-word; -webkit-=
nbsp-mode: space; line-break: after-white-space;"><div class=3D"" style=3D"=
overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-whit=
e-space;"><div><div>

<div>Once CMS &amp; Frameworks are empowered to use WASM as part of their c=
ore offering then they could start recommending WASM and managed web hosts =
that want to cater to their users would start offering WASM enabled on thei=
r platforms.</div>
<div><br class=3D""></div>
<div>BTW, very few CMS or Frameworks make any extensions not referenced in =
production.ini as requirements, and for very good reason because doing so w=
ould be too risky.=C2=A0</div>
</div></div></div></div></blockquote>
<div><br></div>
<div>
<div>We can flip the discussion, too. The idea of running code on a WASM ru=
ntime from PHP isn=E2=80=99t just about stuffing new complexity into PHP. T=
he day we _require_ a WASM runtime is the day we can drop almost every othe=
r PHP extension from the required list. It=E2=80=99s great having `curl` an=
d `exif` and `pcre` available, but the fact that they may not be makes ever=
y call out to them a liability - every call needs to a fallback implementat=
ion in user-land PHP or else we=E2=80=99re going to have to deal with site =
crashes.</div>
<div><br></div>
<div>Even extensions like `mb_string` are incredibly useful, but only becau=
se we don=E2=80=99t have access to tools that better fit the needs we have =
as a CMS. There are some very surprising code snippets that exist (a) becau=
se `mb_string` isn=E2=80=99t guaranteed to be there and (b) because the int=
erface is close enough to look right but different enough to be extremely a=
wkward.</div>
<div><br></div>
<div>One quick example comes up from just two nights ago: detecting URLs. W=
e want to have a Unicode-aware `strspn()` function, so we have to use PCRE =
with the Unicode flag set. Now we have dependencies on extensions and no pr=
actical fallback, also the code in JavaScript cannot be the same because th=
ey use different regular expression syntax and people have to manually and =
correctly translate that. (Well, I have proposed some user-space PHP code t=
o provide a streaming UTF-8 decoder, but it=E2=80=99s much slower than the =
C code inside PHP or the WASM binary would be). One new algorithm, compiled=
 to WASM, could return the byte-offsets into a string where URLs are detect=
ed and then the PHP and JS could have a stable agreement and it wouldn=
=E2=80=99t depend on any other extensions than WASM.</div>
<div><br></div>
<div>Having spent years dealing with text encoding issues I=E2=80=99d cheer=
ly replace existing `mb_` code in WordPress with custom functionality as a =
WASM module. And again, I want to highlight that this is a win for hosts. N=
obody needs to ask their host to install new extensions, no host has to eva=
luate the security or reliability of an extension. Nobody has to come beggi=
ng for a rapid update to `openssl` because some vulnerability gave internet=
 visitors root-level access on the host=E2=80=99s server. Nobody has to be =
disappointed because their host refuses to make `libvips` available to PHP =
code for the one site on their service that wants it. Hosts can start _remo=
ving_ extensions that have long been headaches but are so necessary in prac=
tice that they can=E2=80=99t get rid of them.</div>
</div>
<div><br></div>
<div>=E2=80=94=E2=80=94</div>
<div><br></div>
<div>This was supposed to be a very brief response. Sorry, and thanks for y=
our patience reading through to the end. I=E2=80=99m responding because I f=
eel like the conversation is relevant and good, but my tone is meant to be =
friendly with a realizing that none of this stuff is likely happening rapid=
ly, and nobody is demanding this work. I want PHP to grow and mature, as I =
hope all here do, and I=E2=80=99m sharing where I can see WASM being the mi=
ssing piece that we=E2=80=99ve wanted or needed for a long time to relieve =
pressure from the core language and escape from many of the legacy warts th=
at make building reliable performant software in PHP so difficult.</div>
<div><br></div>
<div>Warmly,</div>
<div>Dennis Snell</div>
</body>
</html>
--=_066572BE-451A-470D-B867-D4C34B1ECFE5--