My journey to the center of PHP - Midwest PHP 2017

Slide 1

Slide 1 text

M A R C H 1 8 T H , 2 0 1 7 JOURNEY MY CENTER TO THE OF S A M M Y K A Y E P O W E R S @SammyK #mwphp17 joind.in/talk/01835

Slide 2

Slide 2 text

SCARY! INTERNALS IS http://saint-max.deviantart.com @SammyK #mwphp17 joind.in/talk/01835

Slide 3

Slide 3 text

I don’t know C! Internals is scary! I don’t know what I’m doing!

Slide 4

Slide 4 text

BOOKS ON PHP 7 INTERNALS: THIS PAGE INTENTIONALLY LEFT BLANK @SammyK #mwphp17 joind.in/talk/01835

Slide 5

Slide 5 text

BUBBLE MY 1998-2013 @SammyK #mwphp17 joind.in/talk/01835

Slide 6

Slide 6 text

LARACON 2014 NEW YORK PHP|TEK CHICAGO @SammyK #mwphp17 joind.in/talk/01835

Slide 7

Slide 7 text

PHP|TEK HACK-A-THON CONTRIBUTE TO PHP @SammyK #mwphp17 joind.in/talk/01835

Slide 8

Slide 8 text

I don’t know what I’m doing! @SammyK #mwphp17 joind.in/talk/01835

Slide 9

Slide 9 text

ELIZABETH SMITH DERICK RETHANS

Slide 10

Slide 10 text

@SammyK #mwphp17 joind.in/talk/01835

Slide 11

Slide 11 text

ANTHONY FERRARA @SammyK #mwphp17 joind.in/talk/01835

Slide 12

Slide 12 text

CONTRIBUTION MY FIRST

Slide 13

Slide 13 text

this is a table… @SammyK #mwphp17 joind.in/talk/01835

Slide 14

Slide 14 text

I love tabs! this is a table… Spaces is where it’s at! I’m trying to upgrade bison I added array_column() Have you used Docker? Licensing in FOSS is important Let’s have a PGP key signing party! JavaScript is weird

Slide 15

Slide 15 text

Slide 16

Slide 16 text

TABS SPACES VS

Slide 17

Slide 17 text

CLOSER TO INTERNALS PUSHED ME

Slide 18

Slide 18 text

OPEN SOURCE @SammyK #mwphp17 joind.in/talk/01835

Slide 19

Slide 19 text

PHP SDK FACEBOOK

Slide 20

Slide 20 text

FOSCO MAROTTO @SammyK #mwphp17 joind.in/talk/01835

Slide 21

Slide 21 text

HQ FACEBOOK @SammyK #mwphp17 joind.in/talk/01835

Slide 22

Slide 22 text

No content

Slide 23

Slide 23 text

CHANGED IT ALL THE PR THAT @SammyK #mwphp17 joind.in/talk/01835

Slide 24

Slide 24 text

No content

Slide 25

Slide 25 text

No content

Slide 26

Slide 26 text

SCOTT ARCISZEWSKI (AR - SIZ - ZU - SKI) @SammyK #mwphp17 joind.in/talk/01835

Slide 27

Slide 27 text

@SammyK #mwphp17 joind.in/talk/01835

Slide 28

Slide 28 text

@SammyK #mwphp17 joind.in/talk/01835

Slide 29

Slide 29 text

SCOTT’S PR INFOSEC FALLOUT == @SammyK #mwphp17 joind.in/talk/01835

Slide 30

Slide 30 text

I HAD A CHOICE OR @SammyK #mwphp17 joind.in/talk/01835

Slide 31

Slide 31 text

CSPRNG WUT? @SammyK #mwphp17 joind.in/talk/01835

Slide 32

Slide 32 text

CSPRNG WUT? @SammyK #mwphp17 joind.in/talk/01835

Slide 33

Slide 33 text

CSPRNG mt_rand($min, $max); rand($min, $max); @SammyK #mwphp17 joind.in/talk/01835

Slide 34

Slide 34 text

CSPRNG echo mt_rand(0, 42); 11

Slide 35

Slide 35 text

CSPRNG echo mt_rand(0, 42); 7

Slide 36

Slide 36 text

echo mt_rand(0, 42); 39 CSPRNG

Slide 37

Slide 37 text

CSPRNG mt_srand(10); echo mt_rand(0, 42); 21

Slide 38

Slide 38 text

CSPRNG mt_srand(10); echo mt_rand(0, 42); 21

Slide 39

Slide 39 text

mt_srand(10); echo mt_rand(0, 42); 21 CSPRNG

Slide 40

Slide 40 text

rand(); mt_rand(); AUTO SEEDING USING TIMESTAMP + A FEW OTHER VARIABLES CSPRNG @SammyK #mwphp17 joind.in/talk/01835

Slide 41

Slide 41 text

No content

Slide 42

Slide 42 text

No content

Slide 43

Slide 43 text

No content

Slide 44

Slide 44 text

No content

Slide 45

Slide 45 text

AUTO SEEDING USING TIMESTAMP + A FEW OTHER VARIABLES @SammyK #mwphp17 joind.in/talk/01835

Slide 46

Slide 46 text

No content

Slide 47

Slide 47 text

CSPRNG’S USE BETTER SEEDS @SammyK #mwphp17 joind.in/talk/01835

Slide 48

Slide 48 text

No content

Slide 49

Slide 49 text

CSPRNG OPTIONS IN 5.x openssl_random_pseudo_bytes() mcrypt_create_iv() /dev/*random @SammyK #mwphp17 joind.in/talk/01835

Slide 50

Slide 50 text

CSPRNG OPTIONS IN 5.x openssl_random_pseudo_bytes() mcrypt_create_iv() /dev/*random @SammyK #mwphp17 joind.in/talk/01835

Slide 51

Slide 51 text

openssl_random_pseudo_bytes() https://wiki.openssl.org/index.php/Random_fork-safety Since the UNIX fork() system call duplicates the entire process state, a random number generator which does not take this issue into account will produce the same sequence of random numbers in both the parent and the child […], leading to cryptographic disaster… “

Slide 52

Slide 52 text

openssl_random_pseudo_bytes() https://wiki.openssl.org/index.php/Random_fork-safety OpenSSL cannot ﬁx the fork- safety problem because its not in a position to do so. However, there are [solutions] available and they are listed below. “

Slide 53

Slide 53 text

openssl_random_pseudo_bytes() https://wiki.openssl.org/index.php/Random_fork-safety Don't use RAND_bytes “

Slide 54

Slide 54 text

openssl_random_pseudo_bytes() https://wiki.openssl.org/index.php/Random_fork-safety Instead, you can read directly from /dev/random, /dev/urandom or /dev/srandom; or use CryptGenRandom on Windows systems. “

Slide 55

Slide 55 text

CSPRNG OPTIONS IN 5.x openssl_random_pseudo_bytes() mcrypt_create_iv() /dev/*random @SammyK #mwphp17 joind.in/talk/01835

Slide 56

Slide 56 text

mcrypt_create_iv()

Slide 57

Slide 57 text

mcrypt_create_iv()

Slide 58

Slide 58 text

mcrypt_create_iv()

Slide 59

Slide 59 text

CSPRNG OPTIONS IN 5.x openssl_random_pseudo_bytes() mcrypt_create_iv() /dev/*random @SammyK #mwphp17 joind.in/talk/01835

Slide 60

Slide 60 text

/dev/*random

Slide 61

Slide 61 text

CSPRNG OPTIONS IN 5.x openssl_random_pseudo_bytes() mcrypt_create_iv() /dev/*random @SammyK #mwphp17 joind.in/talk/01835

Slide 62

Slide 62 text

Why is CSPRNG so hard in PHP?

Slide 63

Slide 63 text

SUNSHINE PHP 2015 @SammyK #mwphp17 joind.in/talk/01835

Slide 64

Slide 64 text

Why is CSPRNG so hard in PHP?

Slide 65

Slide 65 text

Because no one’s made it easy.

Slide 66

Slide 66 text

CSPRNG MAKE EASY

Slide 67

Slide 67 text

I have NO idea what I’m doing!

Slide 68

Slide 68 text

Start with user-land implementation

Slide 69

Slide 69 text

github.com/SammyK/php-src-csprng

Slide 70

Slide 70 text

THREE ADD NEW FUNCTIONS random_int($min, $max) random_bytes($bytes) random_hex($bytes) @SammyK #mwphp17 joind.in/talk/01835

Slide 71

Slide 71 text

Vetted by infosec nerds. including…

Slide 72

Slide 72 text

SCOTT @SammyK #mwphp17 joind.in/talk/01835

Slide 73

Slide 73 text

THREE ADD NEW FUNCTIONS random_bytes($bytes) random_hex($bytes) random_int($min, $max) @SammyK #mwphp17 joind.in/talk/01835

Slide 74

Slide 74 text

THREE ADD NEW FUNCTIONS random_bytes($bytes) random_hex($bytes) random_int($min, $max) two @SammyK #mwphp17 joind.in/talk/01835

Slide 75

Slide 75 text

ADD NEW FUNCTIONS bin2hex(random_bytes($bytes)) === THREE two random_hex($bytes) @SammyK #mwphp17 joind.in/talk/01835

Slide 76

Slide 76 text

IMPLEMENTATION THE ACTUAL @SammyK #mwphp17 joind.in/talk/01835

Slide 77

Slide 77 text

No content

Slide 78

Slide 78 text

google!

Slide 79

Slide 79 text

COPY I DON’T ALWAYS PASTE & BUT WHEN I DO…

Slide 80

Slide 80 text

github.com/php/php-src/pull/191/files

Slide 81

Slide 81 text

/ext/standard/basic_functions.c

Slide 82

Slide 82 text

/ext/standard/base64.c

Slide 83

Slide 83 text

COPY PASTE @SammyK #mwphp17 joind.in/talk/01835

Slide 84

Slide 84 text

COMPILE TEST @SammyK #mwphp17 joind.in/talk/01835

Slide 85

Slide 85 text

random bytes int min max ?? ?? ? ??!! @SammyK #mwphp17 joind.in/talk/01835

Slide 86

Slide 86 text

ROOM 11 @SammyK #mwphp17 joind.in/talk/01835

Slide 87

Slide 87 text

segfault @SammyK #mwphp17 joind.in/talk/01835

Slide 88

Slide 88 text

I have NO idea what I’m doing! random bytes int min max

Slide 89

Slide 89 text

LEIGH LAST NAME? @SammyK #mwphp17 joind.in/talk/01835

Slide 90

Slide 90 text

@SammyK #mwphp17 joind.in/talk/01835

Slide 91

Slide 91 text

THE P R O C E S S (REQUEST FOR COMMENTS) @SammyK #mwphp17 joind.in/talk/01835

Slide 92

Slide 92 text

[email protected] @SammyK #mwphp17 joind.in/talk/01835

Slide 93

Slide 93 text

GET YOU SOME WIKI KARMA @SammyK #mwphp17 joind.in/talk/01835

Slide 94

Slide 94 text

GET YOU SOME WIKI KARMA wiki.php.net @SammyK #mwphp17 joind.in/talk/01835

Slide 95

Slide 95 text

GET YOU SOME WIKI KARMA [email protected] @SammyK #mwphp17 joind.in/talk/01835

Slide 96

Slide 96 text

YOUR RFC CREATE wiki.php.net/rfc/howto @SammyK #mwphp17 joind.in/talk/01835

Slide 97

Slide 97 text

YOUR RFC ANNOUNCE [email protected] @SammyK #mwphp17 joind.in/talk/01835

Slide 98

Slide 98 text

FOR 2 WEEKS WAIT @SammyK #mwphp17 joind.in/talk/01835

Slide 99

Slide 99 text

UNDER DISCUSSION @SammyK #mwphp17 joind.in/talk/01835

Slide 100

Slide 100 text

ANNOUNCE THE VOTING PHASE [email protected] @SammyK #mwphp17 joind.in/talk/01835

Slide 101

Slide 101 text

USUALLY 2 WEEKS @SammyK #mwphp17 joind.in/talk/01835

Slide 102

Slide 102 text

@SammyK #mwphp17 joind.in/talk/01835

Slide 103

Slide 103 text

sammyk.me/how-to-contribute-to-php-documentation @SammyK #mwphp17 joind.in/talk/01835

Slide 104

Slide 104 text

THE PROCESS FIN @SammyK #mwphp17 joind.in/talk/01835

Slide 105

Slide 105 text

RFC WORKING IMPLEMENTATION ANNOUNCE TO INTERNALS CHECKLIST @SammyK #mwphp17 joind.in/talk/01835

Slide 106

Slide 106 text

RFC WORKING IMPLEMENTATION ANNOUNCE TO INTERNALS CHECKLIST ✓ @SammyK #mwphp17 joind.in/talk/01835

Slide 107

Slide 107 text

RFC WORKING IMPLEMENTATION ANNOUNCE TO INTERNALS CHECKLIST ✓ ✓ @SammyK #mwphp17 joind.in/talk/01835

Slide 108

Slide 108 text

RFC WORKING IMPLEMENTATION ANNOUNCE TO INTERNALS CHECKLIST ✓ ✓ x @SammyK #mwphp17 joind.in/talk/01835

Slide 109

Slide 109 text

RFC WORKING IMPLEMENTATION ANNOUNCE TO INTERNALS CHECKLIST ✓ ✓ x PHP internals is scawy!

Slide 110

Slide 110 text

Everyone is smarter than me - I’ll be a laughingstock! Everyone is mean - look at scalar type- hints drama!

Slide 111

Slide 111 text

Let’s do this sh… stuff!

Slide 112

Slide 112 text

No content

Slide 113

Slide 113 text

No content

Slide 114

Slide 114 text

LATER …TWO WEEKS

Slide 115

Slide 115 text

No content

Slide 116

Slide 116 text

No content

Slide 117

Slide 117 text

@SammyK #mwphp17 joind.in/talk/01835

Slide 118

Slide 118 text

@SammyK #mwphp17 joind.in/talk/01835

Slide 119

Slide 119 text

JOURNEY MY CENTER TO THE OF IT’S LIKE EATING @SammyK #mwphp17 joind.in/talk/01835

Slide 120

Slide 120 text

LEARNED WHAT I I don’t know what I’m doing! HOW FEATURES ARE ADDED TO PHP THE CULTURE OF PHP INTERNALS BETTER AT C & C++ DEEPER UNDERSTANDING OF CSPRNG’S BINARY AND HEXADECIMAL NUMBER SYSTEMS HOW TO CONTRIBUTE TO THE PHP DOCS AND TONS MORE!

Slide 121

Slide 121 text

I STILL have no idea what I’m doing!

Slide 122

Slide 122 text

SCARY! INTERNALS IS http://saint-max.deviantart.com @SammyK #mwphp17 joind.in/talk/01835

Slide 123

Slide 123 text

SCARY! INTERNALS IS http://saint-max.deviantart.com not ^ @SammyK #mwphp17 joind.in/talk/01835

Slide 124

Slide 124 text

COMMUNITY LOVING @SammyK #mwphp17 joind.in/talk/01835

Slide 125

Slide 125 text

I N T E R N A L S N E E D S YOU SOURCE BUGS WEBSITE TESTS @SammyK #mwphp17 joind.in/talk/01835

Slide 126

Slide 126 text

TABS INTERNALS USES @SammyK #mwphp17 joind.in/talk/01835

Slide 127

Slide 127 text

THANKS! SAMMY KAYE POWERS @SammyK SammyK.me Host of @PHPRoundtable @ChiPHPUG West Coast Swing Hire me! :) /talk/01835