Dip Your Toes in the Sea of Security
summary
Claims practical fixes: use PDO prepared statements to prevent SQL injection, replace naive randomness with random_bytes and timing-safe compare via hash_equals, store passwords with password_hash, and prefer lib sodium over homegrown crypto. Notes ≈573,000 GitHub hits for eval-from-query as a warning, recommends CSRF tokens, turning off display_errors, logging with Monolog, auditing composer deps (mentioning Rove security advisories), disable root SSH, use key‑based SSH, ufw and fail2ban.
AI-written summary · about
chapters (15)
- 0:00Start
- 4:35The Golden Rules
- 12:03Application Security (mainly PHP applications)
- 28:14Third Party Code
- 31:56Think like a hacker What do you want?
- 34:24Think Differently How do you get it?
- 36:01Threat Modelling D.R.E.A.D.
- 41:25Authentication & Authorization
- 45:00Password Hashing password_hash()
- 46:55CRYPTOGRAPHY IS HARD NEVER EVER "ROLL YOUR OWN"
- 48:26Linux Server Security
- 48:56Create an SSH Fortress
- 49:58Firewalls
- 50:44Mitigate Brute Force Attacks
- 51:23Install Only What You Need
related talks
01h 01mSecurity: From basic principles to PHP specifics
52mPractical Security in Web Applications
02h 14mWeb application security (Part 1)
53mOWASP Top Ten Proactive Controls
10mIntroduction to web security
02h 18mWeb application security (Part 2)
01h 04mWeb Security And You
35mPHP is evil (Defensive programming)