« first day (3869 days earlier)      last day (1065 days later) » 
00:00 - 15:0015:00 - 00:00

3:00 PM
I was leaning toward foo::func or foo::name until I realized that PFA gave us an alternative for free.
 
@JoeWatkins and then you get A::foo::function and people will complain that it's a method? :-D
 
It seems odd to knowingly introduce two separate mechanisms knowing in advance we can unify them
 
@JoeWatkins Oh yeah, we shouldn't use ::callable, ::function is better
 
@NikiC FWIW I also had the same first impression when I read the proposal. Personally, I'd like ::function or ::callable!
 
Based on ::class, if you add ::function or ::callable people are going to expect it to be a string representation that isn't checked at runtime. That might work for a function which would just give its fully qualified name, but it wouldn't work for methods
 
3:04 PM
eh, I like the fact that (...) can go on anything without weird brackets or precedence
 
I like (...) better than any of the suffix proposals.
 
Yeah, I'm also strngly in favor of (...)
 
yeah so do I
 
strlen::function $obj->foo::method
 
#TeamEllipsis
 
3:05 PM
Though I still think we can do full PFA, which gives us that for free as a degenerate case.
 
especially when you see it in actual code, you know that it's actually syntax
 
@NikiC personally prefer (...), feels more explicit, foo::class doesn't return an instance of foo, foo(...) doesn't return the full qualified function name;
 
#TeamEllipsis
 
@SaifEddinGmati that's a really good point actually; the similarity to ::class is actually a bad thing, because it's a very different feature
 
@NikiC will new MyClass(...) work?
 
3:06 PM
I definitely think there's something in this too
@bwoebi forbidden
 
why?
 
explained in the RFC
 
tho, foo::function or foo::fn syntax could be added to return the full qualified function name.
 
@IMSoP ah, I skimmed right to the rationale
 
@SaifEddinGmati That would be what I expect it to do. Not to give me a callable. (That the string is also a callable is not a good thing.)
 
3:07 PM
@SaifEddinGmati that's not trivial until we fix the fallback-to-global mess
 
function from looks okay, and literally describes what it does, no room for confusion at all ... but lots of typing ...
 
@IMSoP yea :(
@IMSoP actually, that's not a problem, as fallback shouldn't be used in that case. ( similarly to how ::class doesn't trigger autoloading or check if the class exists )
 
@SaifEddinGmati ::class doesn't need to fall back, because classes don't
 
@JoeWatkins in the normal instance-ful case the called_scope needs to be Z_OBJCE(call->This) as Nikita suggested
 
having foo::function resolve to something different from foo() would be a massive WTF
 
3:12 PM
BTW; Short callables already make me give WAY fewer fucks about PFA in Pipes. I think we could move pipe through NOW with short callables and if either PFA or FCC (First Class Callables) passes as well then great, but it can be dealt with orthogonally
 
#TeamEllipsis
class Foo { public $bar; public function bar() {} }
$foo = new Foo;
$foo->bar::function; // is this resolving the property, or referencing the method?
$foo->bar(...); // obviously referring to the method
 
$ret = $foo |> (fn($x) => str_pad($x, 12)) => 'strlen';
 
#TeamStillDoPFAWhichGivesUsEllipsisFunctionReferencesAnyway :-)
 
@IMSoP it's $foo->bar::function, ($foo->bar)::function vs $foo->bar(...), ($foo->bar)(...)
 
None of this FCC conversation has to preclude PFA, which has value, but PFA is shaping up as more complex than we thought, and I have doubts about PFA in 8.1
 
3:14 PM
@SaifEddinGmati oh, I know it's trivial to choose an answer, but the syntax doesn't make it obvious
 
@bwoebi I was wondering about that ... also, I don't see that comment ... fixed anyway ...
 
I'm not sure I'm confident about FCC in 8.1 either, but the main obstacle there seems to be syntax, rather than implementation
 
FCC?
 
@Crell there's fci and fcc … :-D (sorry, I think you don't get it)
 
cmb
@Crell $val |> $beep |> baz(?) |> foo(?, bar(1)); is very limited for point-free style. Or would the following be allowed as well:
 
3:17 PM
property access should probably have been spelled $foo->$bar in the first place, then $foo->bar::something referring to a method would make more sense
 
cmb
$func = $beep |> baz(?) |> foo(?, bar(1));
$func($var);
 
@Crell (function call cache)
 
Fancy Christmas Crackers?
 
@cmb If you wanted to save a piped sequence as a function, it's simple enough to make it an arrow func. $func = fn($beep) => $beep |> baz(?) |> foo(?, bar(1)); I didn't see a need to try and find another unused symbol for that.
Or a named function whose body can be just a series of tubes, er, pipes.
 
@Crell I defined it earlier to cover "First-Class Callables", just want some shorthands for discusison purposes. :D
 
3:19 PM
ic fcic actually
 
@Sara Ah, I missed the definition. (I'm talking here, discussing TYPO3 code, and watching a TYPO3 online conf at the same time.)
 
cmb
@Crell okay, fair enough
 
 
Functional Programming is just a series of tubes. :-)
 
@Crell Yeah. I snuck it in. BUT I'M MAKING IT HAPPEN! STOP TRYING TO STOP FETCH FROM HAPPENING
 
3:22 PM
/me still has NFI what fetch is all about.
 
That is so NOT fetch
 
Clearly.
@Sara Unrelated, remember to RSVP for the picnic if you can make it.
 
What day is labor day? (serious question)
Sep 6th
Right, okay. Tomorrow I find out what days I'll have the boat, can answer after that.
 
Memorial Day Sunday is the picnic. May 30th. 10 days from now.
 
Oh, memorial day, glad that's straightened up
Makes much more sense
What year is it? 2020 still?
 
3:29 PM
Yes. The picnic is on March 410th, 2020.
 
Yeah, sunday the 30th is likely to be open at this point
 
Cool. Remember to RSVP then so I can keep track. :-)
 
@Tiffany Are you coming too? Can I bring ElePhpants with me?
 
!!xkcd 2459
 
@Tiffany I need an email address from you if you want an invite. :-) (DM me on Twitter.)
 
3:31 PM
I just can't count on @Jeeves anymore can I…
 
hahaha, that comic is great and so accurate
 
Yep, captures how I think most of us feel.
I'm still not entirely sure about it being May 2021, it's weird…
 
@Crell just now, is when I got it ...
 
What signature does closure::fromcallable create? Is it variadic or does it mimic the signature or..? Need to invesetigate.
 
it has the signature of the function
 
3:41 PM
The docs are a bit lacking ^_^
 
zend_closure has zend_function as member, it's copied, the closure only cares about dealing with static variables and rt cache (because of collisions on scope change), doesn't do anything to prototype ...
afk a while ... sunny ...
 
[is_literal](https://wiki.php.net/rfc/is_literal) justification (part 2)... why everyday programming needs commands written as literals:

<input type="checkbox" name="delete[]" value="1" />
<input type="checkbox" name="delete[]" value="3" />

$sql = 'DELETE FROM table WHERE id IN (' . implode(',', $_POST['delete']) . ')';

Database abstractions must be able to detect when SQL contains non-literal values, so they can even begin to provide an "inherently safe API" ([Christoph Kern @3m50](https://www.youtube.com/watch?v=ccfEu-Jj0as&t=230s)).
 
4:02 PM
Incident with GitHub Actions
Incident with GitHub Actions ・ GitHub Pages has Partial Outage
 
4:47 PM
Off-topic: Does anyone have experience using fiber optic cables for a long run, switching back to ethernet at both ends?
Looking at using this at both ends.
And 70m of this OM4 cable.
 
@DaveRandom ^^
 
yes I do have some experience, but only in that I have done it a couple of times so I can't really comment on "the best" thing]
I will find out which converter modules I used though, I think they will have been startech, most of the stuff like that I ever use is
I am going to one of the places where I have done it tomorrow, as it happens @Trowski, I will take some pics of what's there
 
@DaveRandom Great, thanks. What's the difference between SC, LC, etc. connectors? Should I care?
 
afaict the main difference is the shape
:-P
like there are probably considerations that matter when you are running kilometers of fibre outdoors or whatever, but I do not know of a practical difference functionally
 
That's what I had gathered. So just make sure square peg, square hole.
 
4:55 PM
I think I would be inclined to go with whatever the bigger form factor is (I forget) just because smaller is more fiddly
 
This looks to be the StarTech equivalent. Quite a bit more expensive.
 
are you constrained by the size of the cable?
 
And in other off-topic hardware questions, what do I need to search for, to find a mortice lock, that is fully lockable from the inside, but then can be opened without a key, from the inside?
 
@MarkR No, not at all.
 
The landlord just replaced the lock on my front door, and I'm not entirely happy with the choice of lock made....
 
5:02 PM
@Danack Most fire door rating locks can be opened via a handle from the inside to allow people to escape, on the down side, any letterboxes etc allow easy compromise
 
I've always known those as "Yale locks", although that's technically just a manufacturer
 
@Trowski Cat6a will easily run 100m carrying 10Gbps
 
@MarkR This is going to run underground (though probably through some sort of cheap conduit, like sewer pipe), so lightning and ground current is a concern.
 
@MarkR My family home used to have one that had a little sliding button on it to fully lock it.......but searching for "mortice lock little sliding button" doesn't give great results.
 
@NikiC we want attribute/new to be parse errors, or compile errors ?
 
@JoeWatkins Compile error is preferred
Makes for a nicer error message
 
that's what I thought
 
@IMSoP I was actually thinking of one that fits inside the door (that's the mortice bit), but yeah....I do actually have a one of those locks as well, so could replace that, and leave the shiny and not actually lockable new mortice lock alone.
 
The expression does not compile correctly ・ PECL ・ #81060
 
5:08 PM
@Danack yeah, I'm failing to search as well
the one I have is actually more like this: homebase.co.uk/yale-pm320-3-lever-sashlock-76mm-brass/…
 
got a suggestion for the attribute error message, do we call those constructors ?
 
the deadlock at the bottom has a separate key, so you can double lock the door when you're leaving the house empty
 
@IMSoP apparently they have fallen victim to "political correctness" on the grounds that if you lock it, and then there's a house fire while your inside, not being able to open the door without the key is a problem.
 
@Danack well, we bought one when we moved in a couple of years ago
from either B&Q or Homebase
 
5:13 PM
Ok, it's my landlords letting agent whose insurance apparently wants the change.
 
conflicting requirements: when you're in, the lock needs to be easy to open; when you're out, it needs to be a 5-lever deadlock
insurers love asking you how secure your locks are
 
The expression does not compile correctly ・ PCRE related ・ #81061
 
@IMSoP well yeah, so they can avoid paying out.
Jan 27 '16 at 1:00, by Danack
whoa deja vu
 
What lockpickinglawyer's YT channel has taught me is that most locks are utterly garbage
 
> Delimiters that are between \Q \E should be treated as literal characters, not delimiters.
@Girgias hence my wanting to have a manual control, that blocks a key from the outside working, when I've deliberately locked myself in.
 
5:23 PM
Which makes sense
 
@Danack delimiters aren't "metacharacters"; in fact, they're not even part of PCRE, they're just PHP being cute
 
@Girgias Also important to remember: Most homes have easily breakable windows, so lock quality makes little difference.
 
@Trowski Not if you live in a basement :4head:
 
Don't know what codes are like in other parts of the world, but in the US any basement room with the purpose of sleeping must have two exits, usually the second being an egress window.
 
I wouldn't know, don't live in a basement, and you'd need to go past 3 locked doors already to get into my flat lol
 
5:31 PM
Though if you live in an apartment above say the second floor, there is only one practical way in :)
 
while we're sorting out first-class callable syntax, maybe we can sort out first-class regex syntax too ;)
 
That will be.... more complicated.
 
is that even possible at this point? we are rapidly running out of ascii table
 
@IMSoP The is operator that @IluTov and I were talking about has a future-scope that mentions regexes.
 
5:47 PM
Danack has been removed from list of room owners by Nikic.
 
@Danack >.>
whatcha doin
 
@Danack Was pretty sure that thread would quickly degrade to syntax suggestions.
 
@Tiffany poking internals
 
@Tiffany BEING REALLY HELPFUL AND NOT IN ANY WAY ANNOYING.
 
@Danack I see, you want to introduce shell to PHP ... $( $var ) :-P
 
5:58 PM
@Danack ohh, is that my turn...
[is_literal](https://wiki.php.net/rfc/is_literal) justification (part 3)... why everyday programming needs commands written as literals:

$html = '<a href="' . htmlentities($_GET['url']) . '">Link</a>';

The HTML should be a literal, and processed by a HTML templating engine; because it will know 'javascript:' URLs are dangerous.
 
@Danack also a disadvantage of $(strlen) is the ambiguity between constant and function name, especially in a place where all other sorts of expressions would be supported.
and don't tell me to use $((MY_CONST)), that's bash syntax for math expressions :-P
 
@CraigFrancis If anything, these examples are making me more concerned. is_literal should not be a replacement for prepared statements and output escaping.
 
@Trowski Erm, the point is to push you towards using prepared statements and output escaping.
 
@bwoebi yeah, that's what I like about the (...) syntax, or anything that looks vaguely like a syntax call: PHP's sigil usage is horribly inconsistent, so everything else ends up looking like constants and object properties
 
No, it's not. You're providing a way to avoid that.
 
6:04 PM
@Trowski Erm, how?
 
The assumption seems to be that if a string is a literal, it's safe to use in the context of these examples.
 
The is_literal() check is to be used by libraries to make sure literals are given to them, no mistakes made by the programmer... and those libraries do the prepared statements and appropriate output escaping.
 
If you're using prepared statements and output escaping, then a string being a literal is (mostly) inconsequential.
 
@Trowski Sorry, but I think I must have done a bad job explaining how it will be used.
 
@CraigFrancis Not necessarily… I probably just didn't read it :P
 
6:10 PM
@Trowski The idea is to be a really (really) simple flag, so when libraries (APIs) are receiving these strings, they know that certain ones have been written by the programmer (defined in the PHP script).
 
@Sara sure
@Crell sent
 
Once the library has those literal strings, they can build up the full HTML, SQL, OS Command, or whatever... using the appropriate escaping, or parameters.
 
@Danack at least your email is somewhat productive... in my naive, not-continuously-watching-internals mind
 
@CraigFrancis agreed, I'm talking about abstract semantics rather than internal workings there, what matters is consistent behaviour in userland
 
@DaveRandom Yep, 100%, I want this to be consistent as well, and I'm happy to look at those implode like functions... previously I was just thinking that any function would drop the literal flag (in that form of consistency).
 
6:24 PM
@CraigFrancis Assuming everyone uses the feature the way you intend. I'm not yet sold on that. The Query->where() example is making the assumption that any is_literal string must be safe, when in general it should just insist upon prepared statements.
 
...at least if you put it in reflection, every usage is not the intended usage :-P
 
Hi all, is it possible to start executing PHP script on a multipart/form-data file upload request before file is uploaded?
0
Q: Is it possible to start executing PHP script on a multipart/form-data file upload request before file is uploaded?

user1768741It should be be a common use-case, but I can't find whether it's achievable at all. I want to validate a multipart/form-data uploaded file extension on server-side - must I wait for the file to fully upload? I might be missing something, but it doesn't make sense, especially when handling large f...

 
@Trowski Erm, I think I made a mistake early on by calling it "safe", while I think that's kinda true, it has confused things... I've since tried to focus on calling it a "programmer defined string" (same as the JavaScript version).
@Trowski Or in other words... when the Query->where() example is building up it's prepared statement, it knows that every part going in to it was written by the programmer (defined in the PHP script).
 
@user1768741 there are probably ways to do it in specific web server/OS configurations, but PHP doesn't really have an API to access the input data as a stream, nor does it have a mechanism for executing some code, waiting for the input to finish and then continuing
why do you want to do that, though?
 
@DaveRandom I do need to spend a bit more time thinking about Reflection, but I don't think that's gonna be easy to use... take the CakePHP ORM, it accepts an array for its where(), using the keys (ish) in the SQL string... I don't think reflection would allow you to follow that back to the sources (and if I understand it correctly, any concat would be out of the question, everyone would need to use a Query Builder).
 
6:31 PM
my point is that this feature is essentially part of reflection
you are inspecting the metadata of a value at runtime
 
@bwoebi so, deprecate constants first? /s but yeah....this is possibly the crux of the problem. Because of the historic choices, constants are easier to use than names of classes, methods and functions.
 
I want to: 1. Run some validations that might reject the file/request altogether. 2. Create a database entry with file's metadata before it finishes uploading, so it is reflected immediately when the upload started

I have a list of entries, the user can upload a new one. Files can be large (1-2GB sometimes) - So, when the user starts uploading, gets back (SPA) to the entries list, list is re-fetched - But new entry (currently uploading) isn't there yet (and for a long time)
 
@DaveRandom Erm, kinda, I suppose... but having to follow all the variables back to their source, I don't think that's possible... also, would it be possible to do that at runtime, all the time... I worry that will be really slow.
 
the origin of this point last night was: reflection is presented more as a debugging tool, and putting it there might make it less susceptible to misuse
key word in that sentence being "might"
 
@DaveRandom The good thing about reflection is that it is not documented so nobody can misuse it!
 
6:35 PM
@user1768741 look at the top of your screen ^^^ :-)
@PeeHaa nor does it have an intended purpose \o/
 
@DaveRandom Yeah, I see what you mean, but I worry that trying to see it as debugging implies not running all the time.
 
I see is_literal() as a check I only want to do when I am building something horrible/magical... the same places I use reflection, in other words
 
It’s kinda like static analysis, which you should do, but it’s a side process that not everyone uses.
 
it is a component that belongs firmly inside black boxes
 
@DaveRandom erm, I see it as something you’re always checking… like how you check if a variable is an int or a string.
 
6:39 PM
One of the things I like about how FB does HackLang is that static analysis is running CONSTANTLY. During dev, in CI, pre-deployment, on-server-startup.
There's no way for a type error to slip through.
Other errors, sure. But not type errors.
 
It’s kinda like strict type checking, but allowing you to identify the strings created by the programmer.
@Sara do you think we would ever be able to get everyone to use static analysis? I don’t, that’s why I’m going down this route (providing a useful flag that libraries can use to be sure they are being used correctly).
 
@CraigFrancis I'm hoping to have some insight into how to thread the needle of making the idea more obviously correct to other people, as soon as my neck doesn't feel like it's trying to tear itself apart. But for now I suspect just thinking more is likely to be more productive than trying to work through the feedback of people who aren't grokking it.
 
@CraigFrancis I don't think WE can, but I think the ecosystem can, if it creates tooling that is dirty fucking simple to use and is reliable and fast.
dirt fucking simple*
I think "dirty fucking simple" might be... something else...
 
@Danack Maybe, but I’m hoping to learn where I’m failing to explain myself, I’ve noticed a few times where I’ve jumped ahead, so I’m learning, and hoping to simplify the explanation, as it’s really simple once you see it working.
@Sara I hope so, but I just see a lot of programmers who just write or modify PHP scripts, and even today, just upload those to a server (nothing running locally… /me shudders).
 
That reminds me, I should test that the code I pushed to php.net actually works now that it's live.
 
6:50 PM
@Danack And just to add to that, I think we only really have a few weeks to get it to a vote for 8.1, and considering the implementation is pretty much there, I’d hate to hold off for another year just because I can’t explain something that’s proven to be effective.
 
@Sara nice :-)
 
SOchat broke that, but: /??= /?? /?: Basically, shortcuts for shortcuts that start with a '?'
 
All issues have been resolved!
 
@CraigFrancis not really, it's rare that I have a var that might be literal and might not be, unless the literal was a default value in which case 99% of the time I will treat it as untrusted because the logic I would skip with the check is not a lot more expensive than the check
ymmv tho obv :-P
 
7:04 PM
> PHP 8.1 feature-freeze is currently scheduled for 20th of July, 2021.
 
@Sara niiiiiice
 
@DaveRandom erm, it’s not the difference between runs, it’s checking what the programmer has written, and while different paths might be taken each execution (like a custom WHERE clause depending on what fields the user is searching)… as to why it can’t easily go to debug is that many times the script is just being run (not a special testing run), especially with newbies, and they need that immediate feedback.
 
@CraigFrancis that is plenty of time....and I don't think the current conversation is actually being productive. If anything, it's hardening people against the idea. To be clear, I think most people are wrong, and it's a good idea. But just keep talking over the same points, without taking a break for a bit is not a way to change people's minds.
 
@Danack I’m trying to understand how they are viewing it, to see how I’ve mislead them.
 
@Sara disappointing that the last two don't link correctly
 
7:12 PM
@Danack and just to add to that, I think it’s one of those things where the core concept is really simple, but it needs the context, to show how it’s used (and it’s that simplicity that makes it the right solution, especially when it’s been proven to work in Go and Java, in a slightly different form due to their compiled nature).
 
NikiC has removed Danack from the list of this room's owners.
9
 
lol
 
@PeeHaa what’s going on? Dan upset someone?
 
2 hours ago, by Danack
Danack has been removed from list of room owners by Nikic.
 
7:23 PM
@Tiffany ahh, yeah, might be rocking the boat a bit (I’m wondering at what point Joe explodes with that project).
 
@CraigFrancis I think people have been reasonably clear....the problem is that doesn't naturally lead to what to do about it. It's a pretty common frustration for people who have an idea for an RFC, to ask for feedback of "what changes are needed to make this pass?" but people who "aren't getting it", aren't going to be able to answer that.
This has been an issue in the past (and actually from someone similarly concerned about safety), but the pattern is that people end up getting tired of reading small tweaks to the words.
 
7:42 PM
@Danack Yep, I think you have a point, and I've seen that before, but so far the only change are some functions to make the concat/implode stuff consistent... everything else seems to be about everyone trying to understand how it will be used; so I'm trying to get them to explain their understanding, so I can work out where I've gone wrong (that bit will need to happen either way).
 
@CraigFrancis I can't speak for anyone else, but what would probably sway me from undecided to yes is endorsement from DBAL maintainers that they would find value in this and know how to build in the appropriate escape hatches. That doesn't increase the odds that the people who need their hand slapped would get it (if they're not using a user-space DBAL), but it reduces the risk of it making existing DBALs weaker.
 
@Crell I've not been able to get in touch with the right people with the big ones yet, but Mark Scherer from Propel said "I think this syntax would really help in Propel", and Gabor de Mooij from RedBean has said "You can list RedBeanPHP as a supporter, we will implement this into the core".
btw, that's at the end of some fairly long conversations on how it would be used.
 
That's reassuring to hear. It would be better if they said so publicly on list or you could quote them in the RFC. :-) This is a place where Appeal to Authority is actually valid.
 
@Crell I can add those quotes to the RFC... as to your comment about making "DBALs weaker", can you expand on that?
 
The same "DBAL doesn't support the wacky case I have but at least I can make my own SQL string by hand if I really need to" thing I've been yammering about all along. :-)
That requires DBALs that use is_literal to have some kind of "trust me, I know what I'm doing" flag you can set for a specific query. Which you've amply shown can be done, which is not the same as will be done.
 
7:50 PM
@Crell You can still do that do the SQL string by hand... and most of the time they will be literals, so will work perfectly... the only oddity you brought up was user defined tables, which needs a little tweak, but I've hopefully covered in the example, and by doing that, it enforces no mistakes are made when accepting those table/field names.
 
That's one case. Remember, SQL is way the hell more complicated than any moral realizes. :-) There's valid syntax in the current versions of all current OSS DBs that you've never even heard of, and existing query builders most certainly have never thought to build full support for.
 
@Crell Oh, yes, there are some really specialist things, and I know I'm mortal... but I'm pretty sure they can all be used by writing literals, providing values as parameters, and special things accepted via the "aliases" in that example (as in, these are checked separately and applied after the is_literal check)... or, if not, have the checks just disabled for that query (and because they are marked as such, make auditing so much easier, as you know where to find the "unsafe" things).
 
Right, that's the "trust me, I know what I'm doing" flag.
 
(oh, btw, that aliases check is currently limited to /^[a-z0-9_]+$/, and the values are injected into the SQL with ` quotes, but that's just my primitive, done in 5 minutes check).
 
So yeah, don't spend more time explaining to me or others why it's useful. Spend the time getting DBAL authors on the record that they would benefit from it and use it responsibly, and not overly-strictly. :-) In practice there's about a dozen people that would actually write is_literal(), unlike most language features. They're the ones you want on board.
 
7:58 PM
@Crell That's the one, if you want to do that you can wrap your SQL in the unsafe_sql() object (for that example), or call unsafe_disable_injection_protection() to disable all checks for everything.
 
We can quibble about the best way to tell a DBAL to disable that check, but that's a separate matter.
 
@Crell Do you have any names? e.g. it seems there are a lot of people working on Doctrine, but I can't find who would be best placed to talk to... and yes, I think the example I gave gives you the most flexibility, and it makes it really easy for any of the DBALs to copy/implement (say he a bit proud of how quickly I wrote that a few days ago).
 
Ocramius is the Doctrine-ite I know best. He's on the internals list and could at least point you at the right person if he's not it. His voice carries weight.
(Marco Pivetta is his actual name.)
I don't know who to talk to in Laravel besides Taylor; no idea what that team is like, other than insular. :-)
 
Taylor just did a "Cool! Thanks for letting me know", and I've not heard anything since.
 
Sounds about right for Taylor.
 
8:05 PM
Ocramius, is that Marco Pivetta? if so I got a "I'm generally staying out of anything related to Doctrine these days: personal choice that keeps my stress levels manageable."
 
Ah. Then I'm not sure.
 
A long time ago Marco did say Yes, I am, and would vote for it, but I can't really use that quote, as the followup line makes me wonder if Marco had really understood it (as it can't be implemented in userland).
 
github.com/doctrine/dbal/graphs/contributors - Looks like @beberlei might know.
 
@Crell Thanks, is that a SO reference that Benjamin will be notified about, or shall I try contacting via Twitter?
 
It should SO ping him. Whether he responds is up to him. :-)
 
8:15 PM
@CraigFrancis hi
 
Hi, I've just been talking to @Crell about a PHP RFC that could close the final SQL Injection risks that can happen with Doctrine, are you the best person to talk about it? shouldn't take too long.
 
(The is_literal patch, if you're familiar with it.)
 
(final, might be a bit too strong, but it's covering the issues mentioned on the doctrine security page)
 
8:30 PM
o/
 
@CraigFrancis @Crell i followed the patch
and discussions here a little
 
@beberlei I don't know if this helps, if you're more of a code person (I am), but I've also got an example of how it could be used (primitive, but I think effective).
 
what about $where[] = "constant string"; $where[] = "another"; implode(" AND ", $where);
 
the the idea is to support that
At the moment the patch relies on literal_implode (which throws an exception if anything isn't a literal), but others have said implode() should be supported as well (and silently keep the literal flag if everything is a literal, as per your example).
(btw, most won't use literal_implode, but Dan correclty points out, if you do, then it's easier to debug your code, because you're effectivly getting lots of checks at
*... each time that's used.
 
8:42 PM
Infinite loop causes a segmentation fault ・ Reproducible crash ・ #81062
 
Has there already been a discussion regarding PDO::quote()?
 
@Tiffany There have been, but what are you thinking of?
 
If you're looking for real-world use cases, I can maybe ask some coworkers/boss to have a look and see if it's something that would interest them
 
@CraigFrancis i see we could add support for this, but it must be robust, otherwise we would need to add extra APIs to enable / disable it
 
(btw, I like the fact it adds quote, unlike mysqli... grumble grumble).
 
8:44 PM
@CraigFrancis nothing specific, I just recently learned PDO::quote() existed 😅
 
@beberlei Yep, that's the intention... I've been using it for a few weeks, and Joe's done an amazing job on it.
@Tiffany If you can, I'd really appreciate their comments... and if they don't like it, I'll still like to know why (mainly because I think the simplicity does sound weird at first).
 
@CraigFrancis so what can i help you with?
 
@beberlei I think @Crell wanted to see what you thought of it, and the value in being able to identify those classic ->where('u.id = ' . $_GET['id']) type mistakes
 
I've argued that the "Extra APIs to enable/disable it" are mandatory, because SQL is always more weird than you expect.
 
well the question is, if you have the api $connection->executeQuery() safe and $connection->dangerouslyExecuteQueryWithoutLiteralCheck() - or the other way around with $connection->executeLiteralSafeQuery()
 
8:51 PM
I am torn on the ROI of the feature; the basic goal is to slap the hand of people not using prepared statements... but they're probably not using a DBAL anyway so wouldn't have an opportunity to get their hand slapped. For people who are, the need is far less but not zero. But they need a way to still manually construct an SQL query for cases where literal strings or literal fragments whitelisted by the DBAL aren't viable.
I was thinking executeQuery($query, $args, disable_literal_check=true) or something like that.
 
@Crell What do you think about having a value-object to mark the unsafe version, as per the example? rather than separate methods
 
So what I advised @CraigFrancis to do was get DBAL authors on board the RFC to say officially "yes, we like this, and we'll use it wisely." That would quiet my concerns, as well as I suspect that of others.
(Since it's the sort of feature that would be used by a very small number of devs that then impacts a very large number of devs.)
 
@Crell Ideally it's used by everyone, even if it just puts warnings in the log files (like we do with deprecations)... then over time, as people see the value (assuming the even need to change anything), they can move up to exceptions to catch these very damaging mistakes.
 
do you have a draft for the rfc already?
 
It's really only meaningful at IO boundaries, and most IO boundaries are handled by dedicated libraries these days.
 
8:55 PM
@Crell Yep, so any part of the libraries API that takes SQL strings, and this can check the DBAL is getting something written by the programmer, and user supplied values are provided separately (basically pushing everyone to using parameterised queries).
(at the moment, if a programmer makes a mistake, it can easily create an SQLi issue that can expose the contents of your whole database, so kinda important).
 
9:14 PM
 
(hopefully mods won't get angry at us ...)
 
@Tiffany Aren't you supposed to abuse your powers?
 
9:33 PM
@Tiffany Spider-Man Pointing at Spider-Man meme
 
I want to write something like this to the list but it's still coming off elitist to me, despite trying to specifically not try to sound that way:
> I wish "people" would stop suggesting syntax alternatives. People are generally no good at this, as evidenced by many occurrences in past features, such as this, short closure syntax, and many more where the suggestion is ambiguous. I'm not trying to create some sort of elite status for people who can modify and make unambiguous and semantic grammars -- it's just a niche skill that few people learn.
> That's okay; I am just wishing that people who do not have this skill would stop making suggestions on syntax and instead try to say what they like/don't like and focus the rest of the time on semantics.
 
@LeviMorrison But have you tried... :-P
 
Is it people in general or specific people who just come in "hur dur durrrrr try this syntax"?
@CraigFrancis hehehe
 
@PeeHaa It's many different people over time, few of which ever have these skills.
 
@LeviMorrison I don't think it's helpful to continue suggesting syntax alternatives. While it looks easy on the surface, there's a lot that goes into picking the right syntax in terms of elegance, clarity and avoiding syntax ambiguities in the future. It's somewhat of a niche skill that few people learn, and it requires thorough understanding of the current grammar and a vision of where the language is going.
... Syntax also tends to drown out discussions about semantics which are arguably even more important for the future of the language.
 
9:39 PM
Much better.
 
"While I really appreciate everyone who has tried to help with alternative syntaxes, this is quite a difficult thing to get right. We are continuing to try different ideas, but there are a lot of things to consider"... maybe, to try and make them feel like they have been valuable, but please go away?
Yep, go with @IluTov suggestion.
 
My suggestion, feel free to copy anything or nothing, as you see fit.
 
maybe s/syntax ambiguities in the future/syntax ambiguities now and in the future/
I personally wouldn't know which syntaxes would cause the parser to explode and which ones look weird but the parser doesn't care
as in the famous case of "==>"
(and yes, I know I'm probably one of the "guilty" parties who've gone ahead and suggested things anyway)
 
> I don't think it's helpful to continue suggesting syntax alternatives. While it looks easy on the surface, there's a lot that goes into picking the right syntax: clarity, elegance, and above all else avoiding syntax ambiguities now and in the future. It's a niche skill that few people learn.
> Discussion on syntax also tends to drown out discussions about semantics which are arguably even more important for the future of the language.
> I am glad people are interested in this feature and are participating in the discussion phase; I just ask that people suggesting syntax refrain from doing so unless they have practiced this skill at least somewhat, preferably on PHP's own grammar. It's not productive that every time we introduce new syntax, such as this and in short closures, that there is a flood of syntax suggestions which are ambiguous.
> Thank you for your time.
 
sounds good to me
 
9:53 PM
thumbs-up.gif
 
I'll consider sending it. See how I feel in a bit.
Thanks.
 
It's a valid statement to make. Unpopular, but valid.
 
BTW, the English definition for ellipsis is strikingly accurate for the proposed semantic:
 
Language design is a particular niche skill that takes time to develop. I'm still barely adequate at it myself, in all honesty. :-)
 
> The ellipsis ..., . . ., or (in Unicode) …, also known informally as dot-dot-dot, is a series of (usually three) dots that indicates an intentional omission of a word, sentence, or whole section from a text without altering its original meaning.
 
9:58 PM
@Crell It seems easy, and almost everbody has an opinion on syntax. That makes it such a popular target for bikeshedding.
 
@IluTov Yep. And there are parts of it that are highly subjective and subject to personal preference. It's just not always obvious which those are until well after the fact. :-)
 
@Crell Absolutely. Probably the biggest factor is just what languages you've used apart from PHP.
 
A major part, certainly.
 
@SaifEddinGmati just for reference, if you're trying to make a standard library for PHP, maybe avoid drugs for a bit:
Apr 25 '15 at 1:58, by Danack
@Worf I'm not going to say that drugs are bad, I'm just going to say that some of the SPL was designed when people were discovering Mescaline, and that the results were bad.
 
To be fair, though, we don't really provide good guidance for passers by for what sort of feedback would be useful. That makes bikeshedding even more likely. (I am certain I've pissed off several past RFC authors with what they viewed as ignorant bikeshedding. Probably about half of this room. :-) )
 
10:01 PM
@Crell we love you really.
 
@CraigFrancis I wasn't even thinking of you in this case. :-) (No offense intended...)
 
@Crell Nah, just trying to be funny :-P
 
10:19 PM
Memcached::setMulti() throws confusing TypeError ・ memcached ・ #81063
 
I think many people love PHP and wanna get involved. Syntax discussions seem like an easy way to do so. There's no harm intended but it still hurts the project as it kills more productive conversations. I have a very hard time staying up to date even on my own RFCs, let alone other ones.
 
10:32 PM
@Jeeves ...lol
that title is terrible but also an accurate description
 
10:45 PM
I think I saw something similar on Imagick also.
 
@IluTov yeah, I just avoid internals bkeshedding
 
11:42 PM
Does anyone know a parameter name that would suggest a range of 0 to 1 for a floating point arg? e.g. for function setOpacity(float $opacity): bool {} - the name opacity doesn't really imply 0 to 1 unless you already know the meaning of it...
 
Though I wonder how many would immediately know that means 0 to 1. :)
 
indeed.
still, not the worst naming problem I have:
// The fuzz value should be in the range 0-QuantumRange. The maximum value
    // represents the longest possible distance in the colorspace. e.g. from
    // RGB(0, 0, 0) to RGB(255, 255, 255) for the RGB colorspace
    public function isPixelSimilarQuantum(ImagickPixel|string $color, float $fuzz_quantum_range_scaled_by_square_root_of_three): bool {}
kind of tempted to just leave it like that.
 
00:00 - 15:0015:00 - 00:00

« first day (3869 days earlier)      last day (1065 days later) »