PHP Internals News: Episode 50: The RFC Process – Derick Rethans

PHP Internals News: Episode 50: The RFC Process

In this episode of “PHP Internals News”, Henrik Gemal (LinkedIn, Website) asks me about how PHP’s RFC process works, and I try to answer all of his questions.

The RSS feed for this podcast is https://derickrethans.nl/feed-phpinternalsnews.xml, you can download this episode’s MP3 file, and it’s available on Spotify and iTunes. There is a dedicated website: https://phpinternals.news

Transcript

Derick Rethans 0:16

Hi, I’m Derick. And this is PHP internals news, a weekly podcast dedicated to demystifying the development of the PHP language. This is Episode 50. Today I’m talking with Henrik come out after he reached out with a question. You might know that at the end of every podcast, I ask: if you have any questions, feel free to email me. And Henrik was the first person to actually do so within a year and a half’s time. For the fun, I’m thinking that instead of I’m asking the questions, I’m letting Henrik ask the questions today, because he suggested that we should do a podcast about how the RFC process actually works. Henrik, would you please introduce yourself?

Henrik Gemal 0:52

Yeah, my name is Henrik Gemal. I live in Denmark. The CTO of dinner booking which does reservation systems for restaurants. I’ve been doing a PHP development for more than 10 years. But I’m not coding so much now. Now I’m managing a big team of PHP developers. And I also been involved in the the open source development of Mozilla Firefox.

Derick Rethans 1:19

So usually I prepare the questions, but in this case, Henrik has prepared the questions. So I’ll hand over to him to get started with them. And I’ll try to do my best to answer the questions.

Henrik Gemal 1:27

I heard a lot about these RFCs. And I was interested in the process of it. So I’m just starting right off here, who can actually do an RFC? Is it anybody on the internet?

Derick Rethans 1:38

Yeah, pretty much. In order to be able to do an RFC, what you would need is you need to have an idea. And then you need access to our wiki system to be able to actually start writing that, well not to write them, to publish it. The RFC process is open for everybody. In the last year and a half or so, some of the podcasts that I’ve done have been with people that have been contributing to PHP for a long time. But in other cases, it’s people like yourself that have an idea, come up, work together with somebody to work on a patch, and then create an RFC out of that. And that’s then goes through the whole process. And sometimes they get accepted, and sometimes they don’t.

Henrik Gemal 2:16

How technical are the RFCs? Is it like coding? Or is it more like the idea in general?

Derick Rethans 2:23

The idea needs to be there, it needs to be thought out. It needs to have a good reason for why we want to add or change something in PHP. The motivation is almost as important as what the change or addition actually is about. Now, that doesn’t always get us here at variable. In my opinion, but that is an important thing. Now with the idea we need to talk about what changes it has on the rest of the ecosystem, whether they are backward compatible breaks in there, how it effects extensions, or sometimes how it effects OPCache. Sometimes considerations have to be taken for that because it’s, it’s something quite important in the PHP ecosystem. And it is recommended that it comes with a patch, because it’s often a lot easier to talk about an implementation than to talk about the idea. But that is not a necessity. There have been quite some RFCs where the idea was there. But it wasn’t a patch right away yet. It is less likely that t

Truncated by Planet PHP, read more at the original (another 15239 bytes)

PHP Internals News: Episode 48: PHP 8, JIT, and complexity – Derick Rethans

PHP Internals News: Episode 48: PHP 8, JIT, and complexity

In this episode of “PHP Internals News” I discuss PHP 8’s JIT engine with Sara Golemon (GitHub).

The RSS feed for this podcast is https://derickrethans.nl/feed-phpinternalsnews.xml, you can download this episode’s MP3 file, and it’s available on Spotify and iTunes. There is a dedicated website: https://phpinternals.news

Transcript

Derick Rethans 0:16

Hi, I’m Derick. And this is PHP internals news, a weekly podcast dedicated to demystifying the development of the PHP language. This is Episode 48. Today I’m talking with Sara Golemon about PHP 8 and JIT. Sara, would you please introduce yourself?

Sara Golemon 0:33

Hi there. Hi there, everybody listening to PHP internals podcast. I’m Sara. I’ve been on this podcast before. But in case you’re just getting here to for the first time, welcome to the podcast. You have a nice backlog to go through. I am a lapsed web developer, come database security engineer by day, and an opinionated open source dev slash PHP 7.2 release manager by night and also day. I’ve been involved with the project for about 20 years now off and on. Somehow I just keep coming back for more punishment.

Derick Rethans 1:03

We’re leading up to PHP 8, with lots of new features being added. But one of the biggest thing in PHP 8 that I’ve spoken about on the podcast on before all the way back last year in Episode 7, is that PHP eight is going to get a JIT engine. Would you care to explain what a JIT engine does again?

Sara Golemon 1:20

Well, I’m going to give you the short, you can look this up on Wikipedia in two seconds definition of JIT, means just in time compilation. That doesn’t really tell you much, unless you listen to it on the sort of other half of that of AOT, or ahead of time compilation. AOT is what you expect from applications like GCC, you know, you just make an application that you’ve got C or C++ kind of source code to that’s ahead of time. JIT is saying, well, let’s take the source for application. And let’s just run with it. Let’s just start executing it as fast as I can. And eventually we’re going to get down to some compiled code. That’s going to run a little bit quicker than the initial stuff did. PHP already has this nice little virtual machine built into it. We call it the Zend engine. That takes your script and immediately just says: All right, well, what does this say in computer terms? Well, a computer readable term is a series of these op codes, they’re also called byte codes in other languages that give you instructions for: run this type of instruction at this time and get something done. The PHP runtime interpreter interprets that one instruction at a time basically pretending to be a CPU. This works quite well, it runs quite efficiently. But there’s still this sort of bottleneck in the middle there of a program pretending to be a CPU running on top of a CPU in order to run other code. The idea of JIT is that this thing sitting in the middle is going to gradually figure out what your program really is trying to do and how it’s intended to run, and It’s going to take those PHP instructions and it’s going to turn them all the way down into CPU instructions, so that it can get out of the way and let the CPU run your code natively as if it had been written in a compiled AOT kind of language. What that actually means for execution of PHP code in PHP 8 is still sort of a, you know, a question that’s, that’s left to be answered here. I listened to your interview with Zeev. Episode 7, is a good episode of getting some good information on that. We do definitely agree on what the status of the JIT within PHP is, right now we can. It’s subjective facts like this is how much work has been done largely by Dmitri, where we can kind of expect to see the best gains come from. I personally think I might be a little bit more pessimistic than him in terms of the actual

Truncated by Planet PHP, read more at the original (another 22290 bytes)

Xdebug Update: March 2020 – Derick Rethans

Xdebug Update: March 2020

Another month, another monthly update where I explain what happened with Xdebug development in this past month. It will be published on the first Tuesday after the 5th of each month. Patreon supporters will get it earlier, on the first of each month. You can become a patron here to support my work on Xdebug. If you are leading a team or company, then it is also possible to support Xdebug through a subscription.

In March, I worked on Xdebug for about 75 hours, on the following things:

Xdebug 2.9.3 and 2.9.4

The last month saw two releases. In Xdebug 2.9.3 I fixed an issue with breakpoint resolving. In files with a class that inherits from another class, the line start/end information from the inherited methods were incorrectly added to the lines map for the file with the extending class. This caused Xdebug to stop at confusing lines in some cases.

Xdebug overloads PHP’s internal error handler. As the hooks in the PHP engine aren’t great, Xdebug reimplements most of this. This code is liable for getting out of sync with how PHP itself handles errors. In Xdebug 2.9.3 I fixed such an issue, where a behavioural change in PHP 7.2 was not propagated to Xdebug’s reimplementation of the error handler.

Through a discussion with other PHP contributors I found out that Xdebug’s way of handling the overriding of opcodes (PHP Engine’s “instructions”) was not optimal. Other extensions also overload opcodes, such as Nikita’s scalar objects, or Xinchen’s taint. When Xdebug and one of these other opcode-overloading extensions are loaded at the same time, none of them would check whether they were also overloaded by another extension. In Xdebug 2.9.3 I fixed that, and this is now also resolved in taint, although the issue for scalar objects is still open.

Unfortunately this fixed introduced a crash for thread safe builds of PHP. I quickly released Xdebug 2.9.4 to rectify this problem after a number of reports.

Last month I mentioned that I merged a patch for Asynchronous Debugging Support into Xdebug’s master branch (which will become Xdebug 3.0). While doing some more work on this, in particularly towards making it less of a performance impact, I found a bug that was present in Xdebug for a long time: When an IDE uses the detach command, Xdebug would disable the remote debugger for the entire life time of the PHP process in use. This potentially explains lots of weird situations where debugger suddenly stopped working. This bug is also fixed in Xdebug 2.9.4.

Truncated by Planet PHP, read more at the original (another 847 bytes)

PHP Internals News: Episode 47: Attributes v2 – Derick Rethans

PHP Internals News: Episode 47: Attributes v2

In this episode of “PHP Internals News” I chat with Benjamin Eberlei (Twitter, GitHub, Website) about an RFC that he wrote, that would add Attributes to PHP.

The RSS feed for this podcast is https://derickrethans.nl/feed-phpinternalsnews.xml, you can download this episode’s MP3 file, and it’s available on Spotify and iTunes. There is a dedicated website: https://phpinternals.news

Transcript

Derick Rethans 0:16

Hi, I’m Derick. And this is PHP internals news, a weekly podcast dedicated to demystifying the development of the PHP language. This is Episode 47. Today I’m talking with Benjamin Eberlei about the attributes version 2 RFC. Hello, Benjamin, would you please introduce yourself?

Benjamin Eberlei 0:34

Hello, I’m Benjamin. I started contributing to PHP in more detail last year with my RFC on the extension to DOM. And I felt that the attributes thing was the next great or bigger thing that I should tackle because I would really like to work on this and I’ve been working on this sort of scope for a long time.

Derick Rethans 0:58

Although RFC startled attribute version two. There was actually never an attribute version one. What’s happening there?

Benjamin Eberlei 1:05

There was an attributes version one.

Derick Rethans 1:07

No, it was called annotations?

Benjamin Eberlei 1:08

No, it was called attributes. There were two RFCs. One was called annotations, I think it was from 2012 or 2013. And then in 2016, Dmitri had an RFC that was called the attributes, original attributes RFC.

Derick Rethans 1:25

So this is the version two. What is the difference between attributes and annotations?

Benjamin Eberlei 1:30

It’s just a naming. So essentially, different languages have this feature, which we probably explain in a bit. But different languages have this. And in Java, it’s called annotations. In languages that are maybe more closer home to PHP, so C#, C++, Rust, and Hack. It’s called attributes. And then Python and JavaScript also have it, that works a bit differently. And it’s called decorators there.

Derick Rethans 1:58

What are these attributes or annotations to begin with?

Benjamin Eberlei 2:01

They are a way to declare structured metadata on declarations of the language. So in PHP or in my RFC, this would be classes, class properties, class constants and regular functions. You could declare additional metadata there that sort of tags those declarations with specific additional machine readable information.

Derick Rethans 2:27

This is something that other languages have. And surely people that use PHP will have done something similar already anyway?

Benjamin Eberlei 2:35

PHP has this concept of doc block comments, which you can access through an API at runtime. They were originally I guess, added as part or of like sort of to support the PHP doc project which existed at that point to declare types on functions and everything. So this goes way back to the time when PHP didn’t have type hints and everything had to be documented everywhere so that you at least have roughly have an idea of what types would flow in and out of functions.

Derick Rethans 3:07

Why is that now no longer good enough?

Truncated by Planet PHP, read more at the original (another 19016 bytes)

The suddenly online conference: an Indy Cloud Conf case study – platform.sh

With the global COVID19 pandemic threatening the globe, dozens of conferences have had to either cancel or switch from in-person to online events on short notice. That’s no easy task under the best of circumstances and is, not surprisingly, posing challenges for many.
Last week I keynoted Indy Cloud Conf a small regional conference on cloud, IoT, and machine learning stuff ostensibly in Indianapolis, Indiana. Of course, it wasn’t in Indianapolis anymore but “on the Interwebs,” and I’m pleased to report that the organizers did a great job of shifting gears so quickly.

Managing Security Risks in the PHP Engine & Web Applications

This blog explains:

  • How the PHP community manages security risks in the PHP engine.
  • How PHP security issues are classified and handled.
  • How to secure web applications against risks — and minimize the chance you are affected by existing or future security issues.

Managing Security Risks: What Are Security Risks?

To better understand what security risks are and how they are handled, let’s start with a definition of software security, by Gary McGraw:

PHP Internals News: Episode 46: str_contains() – Derick Rethans

PHP Internals News: Episode 46: str_contains()

In this episode of “PHP Internals News” I chat with Philipp Tanlak (GitHub, Xing) about his str_contains() RFC.

The RSS feed for this podcast is https://derickrethans.nl/feed-phpinternalsnews.xml, you can download this episode’s MP3 file, and it’s available on Spotify and iTunes. There is a dedicated website: https://phpinternals.news

Transcript

Derick Rethans 0:16

Hi, I’m Derick. And this is PHP internals news, a weekly podcast dedicated to demystifying the development of the PHP language. This is Episode 46. Today I’m talking with Phillipp Tanlak, about an RFC that he’s made titled str_contains. Phillipp, would you please introduce yourself.

Philipp Tanlak 0:35

Hey, Derick. My name is Philipp. I’m 25 years old and I live in Germany. I work for an IT service company, which does mainly development and maintenance of IT projects. We specialise in the maintenance of e-commerce website and create enterprise applications.

Derick Rethans 0:52

How long have you been using PHP for?

Philipp Tanlak 0:54

I’ve been using PHP for quite a long time now that might be six years I guess.

Derick Rethans 0:58

What brought to you creating an RFC?

Philipp Tanlak 1:02

The main reason I’ve created this RFC was out of necessity and interest, mainly to scratch my own itch.

Derick Rethans 1:08

That is how most things make it into PHP in the end isn’t it?

Philipp Tanlak 1:11

Yeah, I guess.

Derick Rethans 1:12

The RFC is titled str_contains, that tells me something that is about strings and containing things. How do we currently find a string in a string?

Philipp Tanlak 1:22

The current approach to find the string in a string is to use the strpos() function or the strstr() function. But on Reddit, I found someone also use preg_match which I find kind of interesting.

Derick Rethans 1:35

There are multiple amount of different methods in use, what are the general problems with these approaches that people have made?

Philipp Tanlak 1:41

So the current approach which I find is not very intuitive, and mainly because of the return values of these functions. For example, the strpos() returns either the position where the string is found, or a false value if the string is not found, but there has to be a check with a !== operation, and the strstr() function just returns a string. So you have to convert that to a boolean to check if the string is found or not.

Derick Rethans 2:11

Because with strpos(), if you wouldn’t use the === or !== operator. Of course, if it would find it at the first position of the string, it’d be zero position, and it would return false, even though it’s sfound it.

Philipp Tanlak 2:26

Yeah.

Derick Rethans 2:27

So there’s a few different problems with these things. Also, I don’t think it’s particularly vary intuitive to do because you sort of need to come up with like a whole construct to see whether it’s part of a string.

Philipp Tanlak 2:37

Correct. I don’t think it’s intuitive for a beginner. So if someone is learning PHP for

Truncated by Planet PHP, read more at the original (another 9479 bytes)

The container is a lie! – platform.sh

(This article was originally published in php[architect] magazine, in two installments.)
As a general rule, lying to people is a bad idea. People don’t like dishonesty. It’s insulting to lie to a person and tends to destroy relationships both personal and professional.
But computer software isn’t people (thank goodness). Virtually all software today is based on lies, very well-organized and effective lies. Lies make modern computer systems possible.
The latest generation of software deception is “containers.