« first day (3902 days earlier)      last day (1030 days later) » 
01:00 - 20:0020:00 - 00:00

8:00 PM
I'm saying that, in this particular case, is_literal is not useful one way or another.
 
maybe, if you want to assume everything inside the library is fine (and it probably is).
I'm just saying it could be used internally as well, if you wanted to be extra sure.
 
IFF the query is being built with a query builder. In this case, it wasn't. So that approach is irrelevant.
(The query builder had a measurable performance hit, so Drupal only uses it when it really needs to do something dynamic.)
 
I have just one more thing to add to this and then I’m going to bed. If you want to prevent injection vulnerabilities, the answer for values is parameterisation. You can choose not to use it but it still exists and is a common concept across languages and databases
 
@Crell That's fair
@Stephen Yep, we are pushing developers to using parameterised queries... that's the real answer.
But you need to have this in place to make sure they don't do things by mistake.
 
The more I think about it, the more I'd say you should remove the Drupageddon example as is_literal would not have helped.
 
8:05 PM
If you want to use a dynamic identifier like a table or column name then a known-hardcoded string check is helpful - the original premise of the rfc
Adding integers is solving a problem that’s already solved, in a more reliable way
 
@Crell ok, if you're sure... I'll remove tomorrow.
 
It might have proven useful in the SelectQuery builder, but I don't think it would have helped at all in the raw-query approach, and that's where the bug was.
 
You keep saying “show me how it’s unsafe”. That isn’t how security works. Assume it’s unsafe. Given that there’s a perfectly usable solution for integer values that’s been in place for over a decade. If people don’t want to use that, they dont actually care about injection vulnerabilities
 
@Crell Fair enough
 
The only way integers are required is if someone has a table called 2 and for some reason defines that table name in code as an integer not a string
I don’t like to use absolutes but that sounds like it’s practically unheard of
 
8:09 PM
I'm still not convinced that the target audience of this feature is not tiny. It's for people who know to use a DBAL rather than raw mysqli/PDO, but don't know enough to use those DBAL's existing placeholder functionality. I just don't see that as a sizeable number of people.
 
@Stephen While I don't like it, and as I said earlier... "They do things like array_map( 'intval', $ids ) that's used in WHERE id IN... but also some do a sprintf('SELECT * FROM table WHERE id = %d', intval($id))... not ideal, but lots exist."
 
> It's for people who know to use a DBAL rather than raw mysqli/PDO, but don't know enough to use those DBAL's existing placeholder functionality. I just don't see that as a sizeable number of people.
That's a lot of people
 
It’s not ideal but you’re willing to pander to their laziness
If you can convince them to use this, convince them to use parameterisation too
 
@Crell The flag (with other options) can be used by the native functions later... how/if we do that is up for debate though... but they all rely on the basic flag.
 
@Stephen You don't convince them to use it though. You are convincing dbal people
 
8:11 PM
Great so less people to convince
 
@PeeHaa Thanks, and yes, I've got Propel and RedBean interested.
 
It’s a solved problem, and pandering to people’s shit practices doesn’t help.
 
@Stephen The risk with a purity approach is that it isn't used at all.
 
No, it risks that the people who already don’t care enough to properly avoid injection vulnerabilities will still be at risk
Anyone who is already doing what they can to avoid injection vulnerabilities will gain an additional tool to help assure security
 
@Stephen It might still get removed, but at the same time, if you're using intval, that's not an injection vulnerability.
 
8:20 PM
The irony that you want to make it easier for people who are already “using it wrong” but apparently don’t think they’ll continue to “use it wrong”
 
@Stephen How is it wrong? while I don't personally like it, I could never say it was a problem to use an integer.
 
That’s because you’re expecting it to only be used how you expect
People misuse shit all the time
 
@Stephen How? it's an integer
 
The example I sent to the list took me a minute to think of
Yes, that is a bug because someone used the wrong variable in the query -
but its hidden
Because the value “is trusted”
 
I don't think anyone "using it wrong" is going to be able to continue using it wrong.
 
8:24 PM
Where $column comes from the user? somehow?
 
I think the people who might run into an is_literal check are the people who don't need it.
 
@CraigFrancis you’ve never seen code where the wrong variable is passed/used based on a condition?
 
@Stephen As in, you must have cast it to an integer
 
when we're talking about it being an integer, do we mean that the user provided exactly an integer (which is a string type), or did we cast it using intval() or (int)?
 
@Crell These are the people who would run into it... github.com/craigfrancis/php-is-literal-rfc/blob/main/…
@ramsey it has been cast as one.
@ramsey the string type would not be trusted (it came from the user).
 
8:27 PM
@CraigFrancis At that point, it's not necessarily what the user provided, though (e.g., intval('123abc'))
unless we're also choosing not to trust that, too
 
Once it's been cast to an integer, we lose the ability to track where it came from... and as it stands at the moment, the integer would be trusted.
 
as the developer of the application, though, I shouldn't trust it because I don't know if that integer is what should be passed
 
@CraigFrancis How many people know to use Doctrine/Eloquent/DBTNG/etc, but don't know to use a placeholder? That's your benefit universe. Anyone not in that group (either they aren't using a DBAL or already know to use placeholders) is not going to benefit.
 
@ramsey It might get removed... I just took the feedback from Matthew, who said it would help adoption, and we couldn't find a problem with it.
@Crell Quite a few... it's when you have someone experienced writing it, then someone else who comes in later, is inexperienced, and edits it (CakePHP was the worst).
 
Do you have data on that?
 
8:32 PM
The question "is this trusted data?" is all weird when you get something like this: 3v4l.org/shGvB/rfc#focus=rfc.literals
 
Honestly I'm still torn on is_literal, leaning no, but could be grudgingly convinced if there's enough desire from the major library maintainers. But is_trusted just strikes me as dangerous on its face for reasons others have already stated. (It's promising too much.)
 
@Crell no, because it's when I've been working at agencies, doing code audits, penetration tests, etc... it's what I see happening in private repos
 
at that point, it's a 0, so it doesn't have an injection vulnerability, but it still needs to be validated
 
@ramsey Not sure I'm following with that example... it has been cast to 0?
 
@CraigFrancis Yes. (int) "' or '1'='1" turns it into 0, but I don't considered that "trusted"
 
8:36 PM
@Crell We might still drop integer support, and I'm uncomfortable with the word "trusted" as well (why it went to a vote)... but it's scary how much developers just want to make a "quick edit" to existing queries, and don't realise what they have done.
 
I think if you drop integer support and the function only asks the question "has this string been modified in such a way that changes its meaning from when the developer initialized it?," then I think I can get on-board with it. I think I'm still okay with the concatenation, as each string concatenated follows the same rules, as you've illustrated in the RFC.
 
Although you can combine literal strings in such a way that they're no longer safe from SQL injection.
But at least then is_literal() is an accurate description of what it IS, not what you should do with it.
 
@ramsey Oddly, that's the version I prefer as well, but I when asked about integers, and considering the limitations (no flags), and how including would help some developers, without technically introducing a problem, I reluctantly agreed.
@Crell True
Actually, a string only approach should still be safe from SQL Injection, as it cannot include any user values then (it's just the integers that muddy it a bit).
 
Hell, being literal doesn't mean it's not an injection, just that it's an injection you should really really see coming...
 
that's what I tried to say, earlier, but I'm wrong in my use of the term "injection," I guess ;-)
if the integers are being cast to int, then I don't see why standard type-check wouldn't work for them
 
8:48 PM
@Crell Sorry, please excuse my half asleep brain... but can you give me an example.
@ramsey Cast to an int, added to a string, then passed on to a library.
 
"SELECT a FROM b WHERE id=" . ';' . 'DELETE FROM products' - Everything there is a literal, and it will destroy your database. :-)
 
@CraigFrancis Oh... hmm... so, concatenated onto another literal string, basically?
 
@Crell ok, I think this is where, as I'm from a security background, I am required to do the "technically it's not an injection" response (which I know annoys everyone).
 
:-)
 
@ramsey Yep
 
8:52 PM
@CraigFrancis What if the signature is typed for a string? i.e., is_literal(string $value), but concat'ing integers onto strings passed to it doesn't break the paradigm?
 
But I'm sure, given time, we could come up with a less trivial case where code can grab different literal strings and concat them together in an unexpected place and way to achieve an unintended and dangerous query.

That's not necessarily something that should block the RFC on its own, but just noting that even is_literal() doesn't mean "trusted".
 
@CraigFrancis And my response was that it is still an injection into the request you're sending out to the database
 
@ramsey It's when the values are being concatenated we have to decide if the output string has the flag.
@Crell just for my own morbid curiosity, I would love to see one of those.
 
@CraigFrancis Right, but if it's been cast to an int, you can't tell, so why not allow concat'ing typed integers?
 
Eh, I don't care enough to try and contrive something. :-) Just noting that it technically exists.
 
8:56 PM
@ramsey that's what the RFC has been updated to allow... but if most are having a problem with integers, then it will get removed (back to the original version).
@Crell Maybe, but I do love a good mystery (says he having looked though far too many complicated code bases, asking wtf is going on).
 
@CraigFrancis I think my problem is allowing this signature: is_trusted(string|int $value)
 
@ramsey Ok, It's been noted... I've got a few names now, which should hopefully justify overriding the 18 to 3 name vote.
 
Cool. So to clarify where my confusion was: the RFC doesn't specify a function signature, so I assumed `is_trusted(string|int $value)`. I also assumed that you were allowing numeric strings to pass, so if `$_GET['id']` is a numeric string passed to `is_trusted()`, then it would result in `true`. Then, when I understood that the numeric strings would need to be cast to `int` first, having an `int` as the value passed to `is_trusted()` didn't make any sense at all, since a type hint can handle that.
 
@ramsey yep, specifically strings not modified by external sources... it's integers which muddy things.
 
> haven't been modified by any external sources

Including other PHP functions that could potentially introduce external sources
 
9:08 PM
@ramsey Yep, same, they don't get the flag.
 
I don't know that integers muddy the water if they are literal integers concatenated onto literal strings
 
@ramsey what do you mean by "literal integers"?
 
they might have come from anywhere, but at this point, they are purely integers, right? You said they had been cast to int.
 
yep... but some people call literal integers as ones defined in source code.
 
If it came from an external source, it's not a literal. It may be "Safe" by some definition, but soft-mixing "literal" and "safe/trusted/acceptable" is, I think, a massive, feature-killing mistake.
 
9:11 PM
Sorry... I'm using the wrong term here... By "literal integers," I mean "really integers of the integer type and not a string that looks like an integer"
I realize I was mixing programming terminology
But, by "literal strings," I did mean the ones defined in source code ;-)
But I probably would have said "string literal," if I was referring to it in the programming sense :-D
 
Anyway, thanks again for the feedback... I best get some food, I'll be around again tomorrow.
 
@Crell One way to get around this, I think, is to not allow any concatenated strings to pass the check, so you'd have to do something like this...
I guess block code doesn't work here?
 
You have to use the "fixed formatting" button at the right, and indent the entire message.
 
ah
if (is_literal($foo) && is_literal($bar)) {
    $baz = $foo . ' ' . $bar . ' ' . (int) $_GET['id'];
}
 
9:26 PM
Boom, injection. :-)
 
@Creel, please keep the order: First injection, then boom.
Ba da boom.
I wonder when we get duck typing for strings in PHP.
 
is_duck() ?
 
@Danack if (is_duck($what)) {$what->doTheQuack();}
 
@Danack Yeah I agree. I'd like to work on that RFC but it's not simple enough to get done in time.
 
@Crell Right. I think the focus on injection vulnerabilities should be removed from the RFC. It would possibly be useful to know that a string has not changed since it was initialized by the code. And maybe also to know that two strings that were also both not changed since they were initialized, when put together, form a string that is composed of two unmodified strings... but I'm not certain about the usefulness of this.
 
9:40 PM
 
@IluTov did you have a read? And should I announce it on the list?
 
@Girgias Where? Didn't see anything
Did I miss a notification?
I did, sorry, I'll read it right now
 
2 hours ago, by Girgias
@IluTov Words: https://github.com/Girgias/php-rfc-bool-string-deprecation
:(
 
"Declaration should be compatible with" gives incorrect line number with traits ・ *General Issues ・ #81192
 
@Girgias Perfect! Does the voting include the removal in the next major version? If so the next major version should also be mentioned in "Proposed PHP version" I think.
 
9:46 PM
@IluTov Huh, I didn't do that for float to int, but will add it
which was a very convenient template
 
@Danack This is amazing!
@Girgias I like this, as long as casting bool to int continues to work, I think this is perfect.
 
@Girgias I might be the type of person who does echo "Value of foo is [$foo]"; when debugging stuff occassionally....
 
@Danack I do, too, but I've gotten into the habit of using var_export($foo, true)
 
@ramsey Yeah, this is only about bool -> string
@Danack Wouldn't you prefer then to have a bool be converted to its value like JS/Python i.e. 'false'/'true' then?
 
@Danack Hm, debugging is probably the only "good" use case. Although PHPs behavior (true -> '1', false -> '') is still hardly optimal. I usually just do var_dump('Foo', $foo);
 
9:52 PM
But I actually never done this tbh, always just spammed var_dumps()
 
echo "Value of foo is " . var_export($foo, true); works nicely :)
 
Is Derick here? What I meant of course was that I use Xdebug.
3
 
@Girgias maybe. If you also have a time machine so that (bool)"false" isn't true.
 
If I had a time machine I'm not sure that the first thing I would fix about PHP...
Good candidate, but not the first one
 
I'd stop "0" from being falsey... that one has caused me too many bugs
 
9:55 PM
@MarkR That's why coercion often only sounds good on the surface. There are just too many non-obvious cases.
 
If I had a time machine, the only thing I'm doing is getting a copy of Grays Sports Almanac
 
WHY ARE NONE OF YOU TALKING ABOUT FIXING PHP ARRAYS????????
 
I'm too tired to talk about this much, and going for 5G booster tomorrow, so will probably be offline/incoherent for a couple of days, but I think i) this is a good idea ii) is one of those things that is right for most people, but not all, so being able to opt into it would be better than having a single setting for all code.
 
@Danack If we're still talking about bool to string coercion, the opting in would be the cast :)
 
@IluTov That it's literally has to be special-cased in the opcode function drives me crazy. Special cases are f**king evil when designing a language.
 
9:58 PM
And I keep coming back to "having some sort of package system where people can have different 'compile settings'" sounds like a very lovely thing to have. Though would be a huge amount of work, and make the engine be even more complex.
 
It's also bedtime for me, see ya'll tomorrow
 
Every compile setting we put in gives people an excuse to demand it stays forever, that would be the benefit of editions... you get 5 - 10 years to get your house in order then you're out of luck
 
@IluTov I think I could make the case that having no 'package' set should be the loosest set of rules, as that is where people hack shit together. And then for stuff where people actually prefer strict correctness, spending the time to set all the strict options would be worth their time.
but sleep is nice.
@MarkR it switches the order that the argument takes place in. Instead of havingthe argument of when to plan to remove something sooner, it delays that argument until much fewer people are using it.
And then we can tell them to go and use redhat.
 
@Danack It's harder to make an argument to default something people can already opt-in or out of on a per-feature level. If you bundle them up and people are forced to upgrade wholesale if they want any of the new shiney's. then that acts as the incentive to move away from old horrible behaviour, so it's less of an issue when support for the old style is pulled
ye olden carrot and stick... the carrot is you get new better behaviour across a range of features, the stick is the old versions are going away eventually
 
Welp posted onto the list, let the debate rage
 
10:11 PM
medconfidential.org/how-to-opt-out UK residents read plz <3
 
And why on earth is there yet another thread about the is_literal thing
 
@DaveRandom That favicon doesn't spark me with confidence though
 
basically if you use a GP in the UK, you have until the end of August to opt out of your medical data being available for sale
part of it is an online form but also part of it requires submitting a form directly to your GP
this is not the correct forum for this but also it's important damn it :-P
> this is not the correct forum for this
as if I ever cared about that anyway :-P
 
I still recon that's going to get shot down
 
Recon... reckon?
Recon is shorthand for reconnaissance
 
10:17 PM
Something like that yeah
 
You still reconnaissance that's going to get shot down? :P
 
"from the overview of the facts as I understand them" seems reasonable for reckon == recon :-P
@MarkR it seems like it's kinda happening
definitely worth taking the time to send the opt-out form in, anyway...
 
They should have distinctly separated what could be used for planning and research vs what could be shared with third parties
 
sure, but they didn't, so... opt out? :-P
I know what you are saying though the thing is not conceptually valueless
it just feels like a clandestine data reaping exercise
 
Indeed, it could be extremely valuable
 
10:22 PM
...and ftr I am not given to tin foil hats
 
But I don't exactly trust the government not to see said value and sell it to the highest bidder... that and the government isn't exactly top notch when it comes to cybersecurity and sooner or later it will all end up on bittorrent
 
crucially there are no details on how the data would be anonymised, so I have to assume it won't be correctly anonymised, if at all
 
It says the data wont include names or addresses, just a replacement for a postcode, but that seems pretty damn weak considering the number of datapoints each person's medical history would have, fingerprinting would be a trivial task
... especially considering it's literally designed for fingerprinting
 
yeh that's not anonymising it's just removing columns from the select list
 
@MarkR ANPR will only be used the moment you drive somewhere and data will be automatically deleted straight away!
 
10:25 PM
obviously anonymity and data granularity are at direct odds with each other, but in this world that I live in that trade off is not enough
@PeeHaa yeh but the problem with that is it's not about anpr it's about video footage
computers can figure out where some cars were in the 70s just by watching TV
 
There's huge advantages to being able to map data and say... run a query on everyone who had illness X who also had condition Y, and be able to run that query in a few minutes.
 
the point is not putting that info on TV in the first place... so... opt out :-P
 
But this should have been done like the census, everyone should have received a letter through the door with a custom code that could be entered onto a website to opt out
 
Does the UK not have something like HIPAA in place?
 
@MarkR no I think this is missing the point, the decisions of individual use cases should be public
I'm not sure how to implement that, but I am very sure that giving the govt full rights to do whatever the fuck the want in perpetuity is not the Correct Answer™
again, let me be clear, I do not have an inherent distrust of govt, although I would happily throw a lot of the current one into a volcano
but government definitely should not have free rights to sell my data to anyone they want without telling me first
 
10:32 PM
That's pretty much what HIPAA is over here. Even so, there are still limitations on how information can be used... I think...
 
opted out of the national data, that only took a second
There are limitations on it here too, but said limitations can be changed at any time
 
yeh that bit's easy, the more insideous part I only found out about this evening is the bit where you have to contact your GP directly
 
yeah that seems very much like a deliberate barrier
 
the original deadline for this was tomorrow, I only found out about the 2nd part tonight, and I like to think I am farliy switched on to this sort of stuff
it really feels like a deliberate attempt to hide what is happening
that is why I am banging on about it :-P
 
as if the government would ever do such a thing.... /s
 
10:35 PM
yeh, and you really need to be on high alert at the moment because this particular govt is an extra special shower of c**ts
 
This is true... I blame the public
... and Labour
 
I blame the politics of fear, and the fact that an entire generation has passed since WWII
 
Fear is giving it too much credit. It's ignorance. People too busy watching TikTok videos or reading celebrity magazines to learn or properly analyse.
 
@MarkR semi-lol but also fuck me, this sort of shit is so badly the problem, I know so many people who are fundamentally anti-the current bullshit but also so fucking caught up in party politics
 
If everyone in the country spent 12 hours reading independent news sources with fact checking and the government would fall the day after.
 
10:39 PM
no they wouldn't, people are not that maliable
the 12 hours only work when you have been paying attention for years
 
fair point
 
the news is like a soap opera, you can't just dive into it for one episode, it makes no sense and it seems big and confusing
 
I saw a comment on Reddit the other day... no government will willingly give people the education needed to overthrow them.
 
@MarkR the world is sooooo much bigger than evolution designed your brain to deal with, those are tools to make it smaller... similarly, conspiracy theories boil the world down to extrapolating from a small number of facts that you can understand all of at once, they are a lot more comfortable than worrying about all the rest of the facts
 
10:49 PM
Comfortable is not what I'd consider my personal experience of them.
 
the default response to being overwhelmed is fear, the last ~50 years of media has been about increasing the available information, and thus increasing the ovberall level of fear
@MarkR no but you are a person who is interested in how shit works
that's not most people's world view
 
and that's what I find most uncomfortable
 
if you go into a library, the fiction section is a) smaller b) much more popular
stories are how the vast majority of people make sense of the world
 
Nice story bruv
 
it's much easier to follow a narrative than acquire facts
 
10:53 PM
Do I want to spend a grand on a 49" samsung odyssey G9 in the 6 minutes before prime day ends...
 
no, because that is too big.
 
.. too... big?
 
imho, ymmv etc etc
 
I'm using a pair of 27" right now, same size
 
yes, and easier to use
you don't do things super wide, you do a few things at once
again, imho
@MarkR comes back to this, weirdly. take a break between doing stuff, that includes just a few mm of black between one window and another
 
10:57 PM
meh, I guess i'll wait until mini led comes out
 
I've almost completely ignored Prime day this year and last year. Maybe I'll pay attention to it next year.
 
It's usually a pretty reliable way to pick up discounted SSDs and such, but i've not got anythin this year
 
Doing your part to not over-work Amazon's warehouse drones.
 
I need to get a bookshelf
 
@MarkR #chia
 
10:58 PM
@Crell aye, one of the reasons.
 
I did treat myself to a teleprompter last week though so that was my for-fun spending
 
I cannot help but visualise some poor person holding up flash cards
 
It took me far too long to record a 3 minute clip last week while looking into the camera so I thought... get teleprompter, just read
 
I have build a bunch of forms with basic information almost the same but what changes is that it every form has different questions. My initial data schema was to have one table for every form.
 
as someone who is chronically afraid of public speaking to the point that I still freeze even when it's actually happening, I probably can't really comment but anything that make it easier for minimal effort sounds like a winner
 
11:09 PM
I almost wanna make a table just for questions. So That I don't build so many tables for every form.
 
I am currently in the process of trying to build a desk to let my dad's church broadcast services over zoom, but also can be driven but a random octogenarian
 
@SalOrozco this sounds like a job for javascript, particularly react....
 
I think that when you know what you are talking about that should give you the confidence to speak in front of people. It would be another thing to just speak about something you know nothing about.
 
it's unlikely that "form" === "a collection of scalar values"
 
> that should give you the confidence to speak
ha. no.
 
11:12 PM
why not
 
monkey brain scared of tribe staring.
 
^
basically your brain does not work the same as mine @SalOrozco :-P
which is totally fine, I envy you in fact
it's a cliche, but at a funeral I would much rather be in the box than giving the eulogy
 
lol
Dave I picture you being the life of the party.
I dont see you as being shy of speaking.
 
weirdly I'm actually quite (very) socially confident, I fold in on myself when I am centre of attention in a structured way tho
I have actually tried a few times as well ftr, done a few talks at user groups
definitely not for me :-P
 
Danack is good get some tips from him.
You just have to have talking points so you don't have those award pauses
akward
 
11:17 PM
yeh Dan is almost the opposite of me, a great public speaker but not great in social groups of >2 :-P
<3
 
lol
You make a good team then.
 
I find getting so nervous that you lose consciousness but remain standing up works for me.
 
What about in the company you work for.
do they make you do presentations
Maybe not the same thing right.
not as many people.
 
@Danack ah yeh see I generally use alcohol for this purpose, which doesn't make for brilliant tech talks
 
yawn
 
11:21 PM
@DaveRandom I disagree
 
lol
Good to loosen up.
 
@PeeHaa Bob's talk on the chicken farming industry will live forever
 
@SalOrozco have you actually given many talks? A presentation is a completely different thing from a talk, where you have to be both entertaining and informative, and people aren't being paid to listen to you.
 
lolwat?
 
yeh sorry bad ping
though I think you were actually there, phpnw 15(?)
slideshare roulette
might have been 17 I don't remember loads from either
 
11:23 PM
it's possible... these years all blend together
 
inorite
it was the year when there were 12 #11ers in the pub before the conf, tho I think that might pre-date you being under that umbrella, as it were
 
i don't know what #11ers means
 
I used to run a sports league from time to time at the end of each season I would have to give a talk to all the kids and their families.
 
@Derick Room 11 presumably
 
Always very nervous but knowing that I knew the subject kinda gave me the confidence to speak.
 
11:29 PM
@Derick regulars in tthis room, sorry
 
Question, Ilija said on Reddit to move ahead with an RFC for a new basic function, now I know nothing about the process. But am I right to assume he meant mail internals with a proposal? Since that's the first step in the how-to. He said RFC so I'm a bit confused.
 
ffs sorry for many pings
 
Do you guys have a prime day in your parts of the world?
 
Yeah I am in my prime days right now
:p
 
same here, I'm in my prime years too
 
11:30 PM
Anything good?
lol
Drinking that bone broth? keeping you youthful
 
I'll drink anything really
 
@KimHallberg wiki.php.net/rfc/howto - but yeah....probably email internals. Thought to set expectations, right now is currently....."not a productive environment".
People are trying to wrangle stuff in for PHP 8.1 release schedule, and there is a higher volume than normal of emails.
Most of which are people talking past each other.
 
@Danack I know that it's close to feature lock, the function is already implemented and he suggested I'd submit one so.
 
Though if it's 'just' a function it might not need an rfc. Link to the idea?
 
The behavior is possible to create in userland, but the function exists in many other languages out-of-the-box so.
Maybe you wanted the Reddit discussion I don't know; reddit.com/r/PHP/comments/o41juw/…
 
11:39 PM
@KimHallberg cool. If you have a time machine, and go back to before 2010, this it the type of thing that would just be added without much drama. I personally think that function is a good idea, but we have a slight problem (imo) of people wanting to add all of their own functions to php core.
I'd suggest emailing the list with "Does this need an RFC?" as the question.....but the response will be "why not just do it in userland?".
Also, I am obligated to post:
 
@Danack Most likely, didn't have high expectations for this anyway, but it was suggested, and as I said to Ilija, nothing ventured nothing gained.
 
Yeah, at this point there's a very strong sense that anything that can be done in userland should be, and we'd throw out half the standard library functions if we could. I doubt it would get much traction, regardless of whether it's useful or not.
 
01:00 - 20:0020:00 - 00:00

« first day (3902 days earlier)      last day (1030 days later) »