PHP Conference Brasil 2019 - Annotations

AnnotationsPHPConferenceBR2019.md

PHP CONFERENCE BRASIL 2019 - ANNOTATIONS

Conteúdos/Apresentações:

• Profilling 101: https://speakerdeck.com/dianaarnos/profiling-101-o-que-e-e-como-fazer-phpconference-2019
• PHP e Segurança: https://speakerdeck.com/dianaarnos/php-e-seguranca-e-possivel-phpconference-br-2019
• NGINX + PHP-FPM: https://docs.google.com/presentation/d/1eROmwin9v2ytdnPb0lSJf5ocmBnkpLT136NRghB9WXY/edit#slide=id.g655db65b33_0_4
• Mecanismos de Autenticação Seguros: https://viniciuscampitelli.com/slides-mecanismos-autenticacao-seguros/#/
• Apresentações Ricardo Coelho: https://speakerdeck.com/ramcoelho
• Profilling CacheGrind e MemInfo: https://speakerdeck.com/gusantoniassi/desmistificando-o-profiling-no-php-com-cachegrind-e-meminfo
• Algorítmos Genéticos: https://github.com/fgsl/geneticalgorithm

Links recomendados nas palestas:

• http://kcachegrind.github.io/ - Repositório do KCacheGrind

• https://xdebug.org/wizard - Auxiliar de instalação do XDebug

• https://xdebug.org/docs/all_settings - Documentação dos parâmetros de configuração do XDebug

• https://getcomposer.org/doc/articles/autoloader-optimization.md - Documentação sobre a otimização necessária no Composer para autoloading

• https://nikic.github.io/2015/05/05/Internal-value-representation-in-PHP-7-part-1.html - Explicação sobre a forma como o PHP armazena e representa as variáveis

• https://www.youtube.com/watch?v=NjIlKlFImlo - Palestra do criador do Meminfo (Benoit Jacquemont) demonstrando a utilização

• https://www.doctrine-project.org/projects/doctrine-orm/en/2.7/reference/batch-processing.html - Documentação do Doctrine sobre inserções em lote

• https://github.com/sensiolabs/security-checker

• https://www.butterfly.com.au/blog/website-development/web-application-security-essentials-for-php-developers-the-art-of-not-getting-hacked

• https://www.sqreen.com/checklists/php-security-checklist

• https://github.com/guardrailsio/awesome-php-security

• https://www.cyberciti.biz/tips/php-security-best-practices-tutorial.html

• https://www.owasp.org

• https://www.meetup.com/pt-BR/OWASP-Sao-Paulo-Chapter/

• https://paragonie.com/blog/2017/12/2018-guide-building-secure-php-software

Palestra NGINX:

• Fast_CGI => É um processo do PHP-FPM

Otimizações do Servidor:

• server_tokens => OFF
  • Manda Info do server no header de toda requisição
• Timeouts (aumentar tempo de resposta):
• client_header_timeout
• client_body_timeout
• send_timeout
• keepalive_timeout
• keepalive_requests
• Manipulação de arquivo:
  • send_file on
  • tcp_nopush on
  • tcp_nodelay on
  • reset_timeout_connection on
• Aumentar tamanho da requisição:
  • client_body_buffer_size
  • client_max_body_size
  • client_header_buffer_size
  • large_client_size
• Proxy limits:
  • proxy_connect_timeout
  • proxy_send_timeout
• Limitar TLS:
  • ssl_protocols TLSv1.2 TLSv1.3
• Resolvedor DNS:
  • resolver 8.8.8.8 8.8..4.4 valid=300s
  • resolver_timeout 5s
• GZIP:
  • gzip on
  • gzip_disable msie6
  • gzip_vary on
  • gzip_proxied any
  • gzip_comp_level 6
  • gzip_buffers 32 16k
  • gzip_types
• Log stdout container (Docker):
  • error_log /dev/stdout info
  • access_log /dev/stdout
• HTTP2:
  • listen 442 ssl http2
  • ssl_certificate server.crt
  • ssl_certificate_key server.key
• Bloquear ataque de bot:
  • https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker
• Bloqueio SQL Injection
• Utilizar cahce do NGINX
• Gerenciar processos FPM

Palestra Profilling:

• Cache valgrind
• QCacheGrind
• composer autoload -o
• XHProf (profilling em produção)
• MemoryLeak
• MemInfo
• Analyzer summary

Palestra Docker:

• Emu, oVirt, KVM => Virtualização baseado em Kernel
• Portainer

Palestra Autenticação Segura:

• reCAPTCHA v3 (Google)
• Sonata Google Authenticator
• Timming Attack
• hash_equals() (para não comparar string com '==')
• GateKeeper
• GPGMail
• Auth0
• ACME
• OpenID
• Paseto (semelhante ao JWT)
• Não permitir algorithm = none no JWT
• The PHPLeague

Palestra PWA:

• Service work
• manifest.json
• HTTPS
• StencilJS

Palestra WebScrapping:

• RevealJS (montar apresentações)
• file_get_contents
• cUrl
• guzzle
• https://github.com/symfony/browser-kit
• https://github.com/minkphp/MinkSelenium2Driver
• css-selector
• Pacote Crawler Symfony
• https://github.com/symfony/http-client
• Postgree => Ideal para armazenar dados do scrapping