On Tue, Sep 17, 2024 at 9:17 PM Mike Schinkel <[email protected]> wrote:
>
> On Sep 17, 2024, at 8:57 AM, Adam Zielinski <[email protected]> wrote:
>
> > To summarize, I think PHP would benefit from:
> >
> > 1. Adding WASM for simple low-level extensibility that could run on
> > shared hosts for things that are just not possible in PHP as described a
> > few paragraphs prior, and where we could enhance functionality over time,
> >
> > 2. Constantly improving PHP the language, which is what you are solely
> > advocating for over extensibility,
> Hi Mike,
>
> I’m Adam, I'm building WordPress Playground [1] – it's WordPress running in the
> browser via a WebAssembly PHP build [2]. I'm excited to see this discussion and wanted to offer
> my perspective.
>
> WebAssembly support in PHP core would be a huge security and productivity improvement for the
> PHP and WordPress communities.
>
> > To summarize, I think PHP would benefit from:
> >
> > 1. Adding WASM for simple low-level extensibility that could run on
> > shared hosts for things that are just not possible in PHP as described a
> > few paragraphs prior, and where we could enhance functionality over time,
>
> Exactly this! With WASM, WordPress would get access to fast, safe, and battle-tested libraries.
>
> Today, we're recreating a lot of existing libraries just to be able to use them in PHP,
> e.g. parsers for HTML [3], XML [4], Zip [5], MySQL [6], or an HTTP client [7]. There are just no
> viable alternatives. Viable, as in working on all webhosts, having stellar compliance with each
> format's specification, supporting stream parsing, and having low footprint. For example, the
> curl PHP extensions is brilliant, but it's unavailable on many webhosts.
>
> With WebAssembly support, we could stop rewriting and start leaning on the popular C, Rust,
> etc. libraries instead. Who knows, maybe we could even polyfill the missing PHP extensions?
>
> > 2. Constantly improving PHP the language, which is what you are solely
> > advocating for over extensibility,
>
> Just to add to that – I think WASM support is important for PHP to stay relevant.
> There's an exponential advantage to building a library once and reusing it across the language
> boundaries. A lot of companies is invested in PHP and that won't change in a day. However,
> lacking access to the WASM ecosystem, I can easily imagine the ecosystem slowly gravitating towards
> JavaScript, Python, Go, Rust, and other WASM-enabled languages.
>
> Security-wise, WebAssembly is Sandboxed and would enable safe processing of untrusted files.
> Vulnerabilities like Zip slip [8] wouldn't affect a sandboxed filesystem. Perhaps we could even
> create a secure enclave for running composer packages and WordPress plugins without having to fully
> trust them.
>
> Another use-case is code reuse between JavaScript and PHP. I'm sceptical this could work
> with reasonable speed and resource consumption, but let's assume for a moment there is a ultra
> low overhead JavaScript runtime in WebAssembly. WordPress could have a consistent templating
> language. PHP backend would render the website markup using the same templates and libraries as the
> JavaScript frontend. Half the code would achieve the same task.
>
> Also, here's a few interesting "WASM in PHP" projects I found – maybe they
> would be helpful:
> - WebAssembly runtime built in PHP (!) https://github.com/jasperweyne/unwasm
> - WebAssembly runtime as a PHP language extension: https://github.com/veewee/ext-wasm
> - WebAssembly runtime as a PHP language extension: https://github.com/extism/php-sdk
>
> [1] https://github.com/WordPress/wordpress-playground/
> [2] https://github.com/WordPress/wordpress-playground/tree/trunk/packages/php-wasm/compile
> [3] https://developer.wordpress.org/reference/classes/wp_html_processor/
> [4] https://github.com/WordPress/wordpress-develop/pull/6713
> [5] https://github.com/WordPress/blueprints-library/blob/87afea1f9a244062a14aeff3949aae054bf74b70/src/WordPress/Zip/ZipStreamReader.php
> [6] https://github.com/WordPress/sqlite-database-integration/pull/157
> [7] https://github.com/WordPress/blueprints-library/blob/trunk/src/WordPress/AsyncHttp/Client.php
> [8] https://security.snyk.io/research/zip-slip-vulnerability
>
>
> Thanks for this. It is super great information.
>
> Want to work on an RFC?
>
> -Mike
I'm happy to work together on the RFC document. I won't be able to
help with the implementation, though, which makes me nervous about
this part of the "How To Create an RFC" page:
> If you don't have the skills to fully implement your RFC and no-one volunteers to code it,
> there is little chance your RFC will be successful.
I know Steve Manuel from Dylibso [1] was highly interested in building
WASM support for PHP core. He's the founder of Extism [2] and his team
integrated a WASM runtime with PHP using FFI [3]. There's a conference
recording where he does a live demo of running WASM modules as
WordPress plugins [4]. He might be a better person to create an RFC
with, as he also seemed keen to work on the implementation. I've
reached out to him about this discussion.
[1] https://dylibso.com/
[2] https://extism.org/
[3] https://github.com/extism/php-sdk
[4] https://www.youtube.com/watch?v=ChZpveTipPU&themeRefresh=1
(I
think it was that one)