we want this thing to be a hard Error in master, or leave as warning ? and what about branches before master, not sure what to do there ?
the warning says "should", but we're essentially enforcing must, which feels more like error than warning, but just promoting a thing to an error because of a bug doesn't seem right
@NikiC what exactly prevents that? i.e. normal class registration, setting ZEND_ACC_ENUM, declaring the backing type and enum cases and then registering the automatic functions?
@RemiCollet Sorry :( We didn't do that as part of the RFC.
@JoeWatkins Sorry if this was mentioned before, I didn't follow the thread. Currently is_literal is only tracked for strings, right? I'm assuming that's why 'foo ' . $someInt results in a non-literal value? If this is the case, shouldn't the following return false? 3v4l.org/l99MW/rfc#focus=rfc.literals
In other words, all non-string values should probably return false as we have no way of knowing if they're tainted or not.
@RemiCollet Absolutely. It shouldn't be hard, enums are mostly just vanilla classes with the ZEND_ACC_ENUM flag. They also auto-implement the UnitEnum/BackedEnum interfaces, declare the name/value properties and define the from/tryFrom methods. Those things are done in zend_enum.c. I'm not sure how much of that can be reused for internal classes.
@IluTov that's how it started yes, but now we're being pushed to allow long to pass ... the reasons are in the thread, help with adoption and so on ...
I liked when it was just strings, but people complained that it's impractical and normal patterns wouldn't work ... I kinda think we were setting out to break those normal patterns and it's irrelevant ...
@JoeWatkins Doesn't sound great to me either... $_GET contains integers. That makes it useless for tons of cases. Most insecure websites will use raw IDs instead of slugs, which are also the websites that would profit most from this feature.
@IluTov well, we're not really sure that it presents a problem, it's less pure ... but practically, how can you use it as a vector of attack ?
using int, or strings as ints (in case of _GET, input) doesn't seem to enable any injection, but seems to make it more practical ...
if we're wrong about that (and nikita seemed to agree that integers are not a problem, called them "uninteresting"), I'd love to have an example I can use to drop this int stuff ...
@NikiC I'm not sure how I can add the dimension checks to ??, I'm staring at the code for the ZEND_COALESCE opcode and I don't see how it checks for dimensions
@Dharman weird... as far as I saw, constructorsynopses and methodsynopses are both formatted by the same method (format_methodsynopsis), so there should be no distinction between them. At least I don't yet know what the problem is
Also @SaifEddinGmati "are very close to having object → num conversion trigger exceptions" is basically what: github.com/php/php-src/pull/6106 is about
@MateKocsis I'll try to have a look, will need to be probably next week. Can you request a review from me on the PR on GitHub so that it's on the notificaiton queue?
@Gordon In my opinion, yes. I need a portfolio of work I've done to effectively act as a resume and I like the way Polywork does it. polywork.com/cspray I also think that when they open up more functionality around searching and the way they handle contact preferences it could be a way to find/recruit people.
Depends what you're doing with the URL and if you display it anywhere.
If someone goes to yoursite.com/iamhacker, presumably that path doesn't exist, so showing a 404 makes sense. The issue comes in if you try to display "iamhacker" on the page somewhere, as that is a potential attack vector. So don't show that without proper escaping/filtering/etc.
@JoeWatkins Naming philosophy question: Should static functions include the zend_fiber_ prefix or is it better that they don't? For example, this vs. this.
.......................................the windows users of Imagick still download random files from the internet rather than from the dependencies directory on windows.php.net. I still need to get that t-shirt made.
@Trowski I personally prefer prefixes because it helps when setting breaks in a debugger (completion) ... but I would say pick one and stick with it ... (and pick the one I like because it makes my life easier) ...
when I do zend_fiber in a debugger and press tab, I want it to show me all relevant symbols ... want/need/really like ...
I will take the risk of being a backchair suggestions thrower; I don't know this particular case, but every time in my life where I've wondered about prefixing or not, I've later found out that prefixing would have been nicer. ymmv
@JoeWatkins Well, normally passing too many ? is an error and in this case foo(?) is a function with one argument -- the fact that it originally derives from a variadic shouldn't matter, no?
yeah, I'll stick it in a startup somewhere or something
or ZEND_TLS ?
@NikiC but there are no arguments, the first placeholder in the second application should take the place of the only placeholder in the first application and produce 2 required args
@JoeWatkins function test($x) {} test(?, ?); is an error due to too many placeholders. Here the foo(?) should behave the same way as if you had created a single argument function
@DaveRandom Hey. Sorry I didn't ping you yesterday. I ended up down a rabbit hole. I am still down it today, but could come up for air if you have time for pipes. :-)
@JoeWatkins, do you want to get together with @PatrickAllaert and me on Tuesday to do the alpha2 builds, or would you like us to try to handle that on our own?
@Crell Was watching your presentation on arrays today during lunch. I can't deny that I was fairly amused by the linguistic commentary along the presentation :>
@JoeWatkins I'm fine either way. I'll set up an invite for Tuesday to invite you and @PatrickAllaert. If you can make it, great! If not, I think Patrick and I are good to handle it. :-)
@JoeWatkins The main issue was that you didn't update the test expectation for the PHP 8.0 branch, which is different both from master and 7.4, which was mainly what I was trying to do while also applying my bugfix, probably explains the messiness
@Crell I shared the presentation internally and said it was great. Sadly many of the developers in my company suffers from not fully understanding types and one in paticular is obsessed with arrays :'(
@Kalle Sounds like someone who has never been exposed to anything else. The problem is, the kind of people who really need to learn how to advance their understanding are the ones that wouldn't bother to read books, articles, etc. on how to do so.
@Crell Very true, I've been told the person has mostly been working for himself, and it really shows as his experience with PHP in terms of years almost rivals that of mine (mine is 21 next week). Eager to learn, but the pandemic makes the ability to do pair programming difficult due to time contraints
I actually prefer to sit next to whoever it is with a machine each and do it that way, at least I have gotten more relevant questions like that personally but it could also be due to the location I am at (Finns don't talk a lot generally)
Honestly I quite dislike it. I code alone. I can code review or knowledge dump with someone, but actually writing code I want to not have humans involved.
Can't deny that I am in the same boat @Crell, I do enjoy knowledge sharing a lot to strengthen the team as a whole to invest future case of someone needing me being less :>
@IMSoP I guess we need a new mechanism to generate the capthas, I mean you can try obfuscate the output but it is only a patch solution and not a long term one
Hide everything by default until approved - No point in spamming it if the comments are never going to see the light of day. Obviously there's still going to be bots that don't care but it takes away at least some of the incentive to send new stuff.
@IMSoP I think pair programming can really work well when either i) you have people with two very different skill sets ii) junior developers who aren't sure what they are doing, and don't know what questions they should be asking themselves....
for the spam, probably would be better to move to a "any bug report that has a link in it needs to be approved before being visible" model. As that removes the incentive to spam.
@Crell you might want to think about withdrawing, levi voted against it, and people aren't going to ignore what nikita said about it ... it probably does more damage than good to leave the vote running at this point ...
I don't know why levi voted against it, and he probably doesn't either, except the words designed to induce panic on the mailing list done exactly that ...
Aside from noting the nullsafe handling, I am not sure what other changes are reasonable to make based on Nikita's post other than "don't do it", which seems... undesireable.
that's what he wants, none of the questions he asked are actually questions, he's read the patch at least 10 times and knows the answers already
politics, I don't enjoy this bit ... I had fun writing the code, but it's not fun anymore when my own "team" are voting against me and other people are playing games ... I don't want to play any more ...
Well, without your vote it's just barely not passing right now. Excrement.
@LeviMorrison Ping?
I hate politics as much as you do. But I didn't even have fun writing C code with it. :-) It's writing PHP code in the future I was hoping to have fun with.
Pulling it now, though, would also look bad for "oh you're just pulling it because it's not passing" reasons. (Though, you still haven't voted yourself.
It took up another ~6 hours today, and it looks like a waste of my time now ... that's good enough reason to pull it, to not waste any more of my time ...
I did have fun, but I also worked extremely hard for a very long time on it ... and it's gutting that it's not going to pass, but it isn't going to pass, and I don't want to spend the next 10 days fixing things for no reason, I have other stuff to do, that I'm being paid for ...
It would be really nice to know what people's objections are. Nikita apparently doesn't care about anything beyond named callables. Beyond that, I don't know if the objections are resolvable trivially or if they're impossible.
Yeah, similar boat here. :-( Especially since that also then blocks pipes, which is what I've been trying to work toward for the past year...
@Crell before nikita it was dmitry, internals needs a person to look to when they don't know the answers for themselves, to inform them how to vote, because most of the people voting aren't capable of judging for themselves ... most peoples objections then, are just going to be that nikita objects ...
I wasn't aware of the naming thing with variadics, but it makes sense. This alone could be considered a detail we can fix after merge, but overall I'm just not sure it's done Right. I had previously voted yes, btw.
see, what's really annoying me right now, is that you are capable of reading the patch, but you don't seem to have done that properly, so you're happy to say it's not done right, but don't even know the details ?
Honestly, I forget that strict_types is a thing. That was the first time I even realized PFA would need to have some defined behavior with regards to strict_types.
@JoeWatkins Nikita's comment on the PR is basically that it tests the happy case (same strict_types setting in definition and call), not the cross-file case (which is where they may differ).
@LeviMorrison he doesn't need to see a test for that, he wants it, but he absolutely knows how it will behave, he's reviewed the patch many many times in the last couple of days ...
What would you find convincing? (It's difficult to show "this would be used X amount", obviously, when the whole point is to enable patterns that were previously difficult and so avoided.)
well I mean, you watched the conversation, we had a simple version and it was universally hated ... I don't know how to make it simple, and please everyone ...