Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87845
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.214.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAAyV7nHpV_KujJbS8E+jU3aOTGL9pDDfcwFe=0t-_3A2k+ONnA@mail.gmail.com>
References: <CAKws9z25cW7MTFeSanYVJK64Lb1uJYm5JJ82h7DDG1Td+j3EuA@mail.gmail.com>
	<CAPwsocHaTtGjL8CAdzAvbSN2wZSGZ50SRC6MBNKO0WtXzAZu3g@mail.gmail.com>
	<CANUQDCgiJVackjoxDaPmZWn_wCcDAZ=BwvhDzdaXsLhSPFVeRA@mail.gmail.com>
	<99CE9AAF-E6E9-4D37-B462-E4A63139EAFB@icicle.io>
	<CAKws9z0Q2WMxAGVZAgz=noJbViqmEJb43SWo_fB6MTum3ptFDA@mail.gmail.com>
	<CAKws9z2pKRHR0kaTgw=UhLLeUDPS8MpY70PCMsSwsFxJnPbAZw@mail.gmail.com>
	<CANUQDCj-yBLNWGP60YBfjRjtAUMC2SpbQJaVjy3qjhhz0gFAEw@mail.gmail.com>
	<CAHXmDMCW0hP+-hB9Geo-niu+LkvTPKXKrbKkaki=nMuQSRMCuw@mail.gmail.com>
	<CAKws9z2w31Tjya9ctsfQYk416Yb_SRRGRNyCCSsJLRyZ_aHpbQ@mail.gmail.com>
	<CAEZPtU6yRQrGmG-Pw+z28QD+8vKGhvSSQ9vr4mrqE_qCrKubhA@mail.gmail.com>
	<CAKws9z2V3rYFuPdxLcTcV_9sLEySydcapMOtq3Xu21hmGH-44Q@mail.gmail.com>
	<CAAyV7nHpV_KujJbS8E+jU3aOTGL9pDDfcwFe=0t-_3A2k+ONnA@mail.gmail.com>
Date: Sat, 22 Aug 2015 00:26:49 +0300
Message-ID: <CAPhkiZyq8o5m_B8dOFENByieG-ToOUY7cbmZx6YTgTGAqKM-eQ@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>
Cc: Scott Arciszewski <scott@paragonie.com>, Pierre Joye <pierre.php@gmail.com>, 
	Trevor Suarez <rican7@gmail.com>, Niklas Keller <me@kelunik.com>, 
	PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Recap - Core functions throwing exceptions in PHP7
From: narf@devilix.net (Andrey Andreev)

Hi,

On Fri, Aug 21, 2015 at 4:36 PM, Anthony Ferrara <ircmaxell@gmail.com> wrote:
>
> MHO is this is too important of a distinction to simply gloss over.
> Having it return false (or null) will be a problem, as nobody will
> perform the error checks. And returning $x where `$x == 0` in a
> security context could be incredibly bad. As such, I think the
> security implications here outweigh nearly all of the other concerns
> about consistency and convention.

^ That! Please don't sweep this under the carpet.

Yes, the RFC and release processes are vital, and consistency is
desirable, but neither should be an excuse for what could be a
horrible mistake here.

Cheers,
Andrey.