LWN: Comments on "PHP showing its maturity in release 7.4"

PHP showing its maturity in release 7.4

flussence — Fri, 29 May 2020 09:24:21 +0000

Oh come on, apart from that one troll near the top (a name that thankfully doesn't look familiar) the link isn't *that* bad. And that user contains contemporary Slashdot concentrations of poison at best; phoronix has been a lawless land from the get-go and its denizens see that as a feature.

The systemd/gnome3 threads from that time period on the other hand… we're best not rediscovering those.

PHP showing its maturity in release 7.4

edeloget — Wed, 27 May 2020 23:44:29 +0000

I followed your link and have to double check if phoronix changed its main theme.

Please don't do that :)

PHP showing its maturity in release 7.4

coogle — Wed, 06 May 2020 17:53:20 +0000

I think libsodium is an excellent example and agree with you on how FFI can make a real impact on the PHP ecosystem! It's so massive of an extension however I didn't want to start trying to decide which functions are for "backward compatibility" though when it came to crypto, so I omitted the comparison. I know when I've personally used ext/sodium I have discovered the relatively few functions I actually needed to do the job properly (after a considerable amount of digging).

Like I said in the article, it's really going to be interesting to see what hosting providers do here because they are going to make or break it IMO. If cheap WordPress hosts make libsodium.so available (along with all the others) I think it's going to really change PHP for the better long-term.

PHP showing its maturity in release 7.4

WolfWings — Tue, 05 May 2020 12:54:32 +0000

And honestly 3/4ths of the LibSodium PHP extension documentation should be "Don't use this except for backwards compatibility with older code. Use function X instead." as well, it's essentially an "FFI before FFI" extension already which means it's exposing all of the functions that muddle up the waters.

The huge swath of aead_* functions should be ignored entirely by the supermajority of PHP devs for instance, just use secretbox, box, or seal instead. There's a lot of 'helper' functions that with the PHP interface they've been given are also entirely redundant compared to the built-in PHP functions as well like the duplicate bin2hex and it's ilk as well. Some like the memcmp exist to avoid side-channel attacks, but a lot of the conversion helper functions don't benefit from being exposed except to add additional functions to the extension to (not) document in over 2.5 years now.

PHP showing its maturity in release 7.4

ThePandaman — Tue, 05 May 2020 12:45:17 +0000

I believe the easiest and most popular way to handle the libsodium-extension is to use the Halite-library by the people of the Paragon Initiative.

They wrap around the extension with easy to use classes with good documentation on when to use which functions.

PHP showing its maturity in release 7.4

Karellen — Tue, 05 May 2020 07:31:01 +0000

Is there a missing link in the introduction? Surely "the criticisms of the past" should link to https://lwn.net/Articles/492714/.

:-)

PHP showing its maturity in release 7.4

jkingweb — Tue, 05 May 2020 03:31:08 +0000

I often see sodium being touted as a major feature of PHP 7.2, and yet with PHP 8.0 around the corner, the sodium extension still has practically no documentation. I understand that the libsodium documentation itself can (and should) be used as a reference, but that doesn't excuse PHP from documenting its interface to it. It has always felt to me as if the promise of easier cryptography in PHP is seriously undermined by this omission.