Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:92505
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.51 as permitted sender)
To: Marco Pivetta <ocramius@gmail.com>
References: <CAFMT4Nq+VdfYS+eKbdbmPr92-X1QYCE2eOtPGo6Zu1qgAOGkhA@mail.gmail.com>
 <570EAB0D.6080706@gmail.com> <570EB67E.8010908@garfieldtech.com>
 <5B147E88-CC0A-4CBC-A49D-C7FE3BF557C0@zend.com>
 <6F.C3.12455.94C5F075@pb1.pair.com> <20160414094440.GF19347@phcomp.co.uk>
 <CAKSD0w6Gd7uN2L=d3VfnK-Mj+cwjpcGtCpjfD6iq+VMmJVxkhA@mail.gmail.com>
 <570FD94F.90703@fleshgrinder.com> <570FE8A9.4020809@gmail.com>
 <20.53.29891.17401175@pb1.pair.com> <57110BCD.5030009@garfieldtech.com>
 <571124C2.9040606@gmx.de> <57112F31.8070209@garfieldtech.com>
 <BY2PR02MB298C91463EC030C3710EFD2AC6C0@BY2PR02MB298.namprd02.prod.outlook.com>
 <57167C35.8080601@gmail.com> <57168FCC.7000507@garfieldtech.com>
 <BY2PR02MB298C8AB7EE3C1EB40A4CB5AAC6C0@BY2PR02MB298.namprd02.prod.outlook.com>
 <CAFMT4NoqVMRmDKSNC1wCyeBn2mH81K=VEP0i43OzcUKgzAfjXg@mail.gmail.com>
 <BY2PR02MB298619E23B62D2D375454BCAC6C0@BY2PR02MB298.namprd02.prod.outlook.com>
 <CADyq6sJjO9SWHZcH6X2DJL=QJvrbL3LbdoDBWNhSCq2FWjnYhw@mail.gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <5716BAF9.6000302@gmail.com>
Date: Tue, 19 Apr 2016 16:10:49 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.7.1
MIME-Version: 1.0
In-Reply-To: <CADyq6sJjO9SWHZcH6X2DJL=QJvrbL3LbdoDBWNhSCq2FWjnYhw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: Improving PHP's type system
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> Any reflector-based system, such as a serializer, an ORM or just a
> dependency injection or configuration loader would be able to do operations
> in a much more precise and less complex way.

This should be solved by annotations. Yes, I know all the story, but it
does not change the fact that ORM serialization is not the same as
internal PHP typing, and arguing we need to change PHP typing system
because it makes it easier for (a particular) ORM serializer is putting
the cart in front of the horse.

> Having a configuration system that expects to call setters with specific
> parameter types can allow the configuration system to validate the given
> data upfront, providing meaningful exceptions to the user, without having
> to write an entire separate config specification.

We already have system that provides meaningful exceptions to the user.
It's called PHP engine. The system you describe changes nothing but
wording of error messages. This is not really worth changing the typing
system in PHP.

> Having a serializer that expects certain types of data allows rejecting any
> kind of value that is possibly insecure, and would cause a RCE
> vulnerability by unserializing a value into something with a malicious
> `__wakeup` in it.

All examples of unserialize problems so far were in the engine and those
examples have all the types already known, the problem was/is
unserializer has no way to use this information. This problem is not
solved by adding more syntax.

> In general, improving the type system provides a much more interesting and
> practical playground for any kind of tool that would rely on static

That's my point - "more interesting playground" does not sound like a
reason enough to mess with the type system of the language used by
millions. This sounds like a good description of a thesis project or a
academic proof-of-concept language, not something mature widely-used
language prizing simplicity should be aiming for. I completely agree
that *if* we added a ton of shiny things into PHP then there would be a
lot of interesting stuff to play with. I am saying that is not the
reason enough to actually add them.
-- 
Stas Malyshev
smalyshev@gmail.com