SunshinePHP 2017
2 - 4 Feb 2017 at Embassy Suites Miami International

3

Have you heard about event sourcing and wondered what it is all about? Have you looked into it and wondered what sort of sorcery is going on behind the scenes that makes this magical technology work? Are you convinced that you cannot possibly move your existing applications to be event sourced? Take a step back and learn how event sourcing can be applied to a simple database-backed object model with little to no fuss. From there, see how you can start adding read models and begin to see how event sourcing and CQRS (Command Query Responsibility Segregation) go hand in hand!

3

Every project, it's the same dang thing! You setup a special snowflake that is your development environment. What if each environment didn't have to be an artisanal wortutorial_tagk of art? What if you could build one, spin it up for each project and never have to worry about it again? Let's talk. In this tutorial, we will see how Vagrant, VirtualBox, Ansible, and other tools will make setting up a new development environment easier than getting your next cup of coffee. In this session you will learn: Vagrant Basics Customizing Vagrant using shell scripts and Ansible Playbooks Advanced Vagrant customization options Join us and go from snowflakes to lego blocks for your next development environment.

13

In the middle of Web 3.0 it's become obvious that a very large percentage of developers are aware that there are tools available that allow them to write automated tests for the code they write. But you don't write tests. Never have. You feel a little bad about it but you tell yourself that it looks really tough to get into and you have a hard deadline that doesn't have any time for you to learn to use these tools. What if you could learn how to write tests from someone who has been using them for a long time and also knows how to explain it in a way that cuts down on the fear and anxiety while teaching you what you need to go to get started immediately? That's what Chris Hartjes, long-time PHP testing evangelist, wants to do for you. In this workshop Chris starts you off from the point of never having written a unit test and guides you through what tests really are. Then he will show you PHPUnit works and what features are the ones you really need to know. Next you will walk through using Test Driven Development using some code katas and leave with a solid, practical foundation that you can take back to your regular job and actually use. Testing your code is hard and might require you to relearn some closely-held practices. Let a grumpy programmer fix that for you! Code for the workshop can be found at https://github.com/chartjes/workshop

3

Ever had a need for some library in C in your PHP code? Or want to hook into the engine to do evil? Or maybe you just want to make some part of PHP better. And then you say “but I don't know enough C”. PHP extensions are actually quite easy to write, even for those with only the smallest amount of C knowledge, if you know the secret incantations, places to find help, and where to get your tribal knowledge. Write your own extension in this step by step tutorial which assumes you know nothing of PHP internals, the very basics of C syntax and little more, and have the ability to type “./configure && make && make install && make test” We'll also touch on recognizing and fixing non PHP7 compatible extensions.

9

Thanks to tools like vagrant, puppet/chef, and Platform as a Service services like Heroku, developers are extremely used to being able to spin up a development environment that is the same every time. What if we could go a step further and make sure our development environment is not only using the same software, but 100% configured and set up like production. Docker will let us do that, and so much more. We'll look at what Docker is, why you should look into using it, and all of the features that developers can take advantage of.

5

There's a classic mantra when it comes to security in applications: "build in security from the start". This is easy to say but much more difficult to put into practice, especially when first starting out. In this tutorial session let me guide you though some of the basic concepts and how to apply them in your code to ensure the security of your application is well architected and effective against your ultimate adversary: the hacker. I'll start with some of the basic topics, like authorization/authentication and input validation, before moving on to good security principles like "defense in depth", fault-tolerant development and tools and techniques to ensure the security of your application. Come get your hands dirty and learn to secure your applications from the start!

2

In this tutorial I will explain the differences between different types of noSQL databases as well as the CAP theorem. I will then progress to illustrate which paradigm shifts are necessary to successfully implement noSQL, using MongoDB as an example. The approaches to schema design, fault tolerance, the network breaking and latency are all things that are inherent to scalability with noSQL solutions and with this talk you will learn how to use MongoDB effectively considering all the above mentioned situations. Covered subjects will be: CAP theorem, schema design, dealing with error situations and architecture of multi-node set-ups.

Asynchronous programming has always been difficult for JavaScript developers, even today. As applications become richer and have more bells and whistles than ever before, our ability to react to a user's clicks, gestures, scrolling, key presses, as well as reacting to remote data mashed up from different places is becoming unwieldy. To top it all off, we’re still dealing with a JavaScript event system that hasn’t seen much update in a long time. The Reactive Extensions for JavaScript (RxJS) tackles this problem head on. RxJS is a combination of the design patterns (like Observer and Iterator), and principles from functional programming to provide a state of the art computing model to write asynchronous code easier. In this tutorial, attendees will learn about the Observable data type, which can be used to abstract out the notion of latency and time from remote HTTP calls as well as eliminate the use of the dreaded callback approach to event handling. RxJS makes events first-class citizens of the language and extends it with: error handling, retry logic, cancelation and disposal, testability, composition, and much more. This technology has proven to be so successful, there’s a formal specification to include Observables natively in JavaScript ES7.

Have you ever looked at a project README.md and the first two to three lines are filled up with little graphics telling you the various stats of the project? The "badges" have become popular because they are a quick way for developers to communicate information about the project. I want badges for my life. When people look at my life's README.md, what badges do I want them to see? What badges do they really see? What can I do to control this? Join me as we jog through the list of Life Badges I want people to see on my life's repo. Along the way, we'll pause briefly to examine what each badge means, and what color is appropriate. As we examine README.md, you may be surprised at what you learn about me...and about your own life badges. Link to my life's repo: https://gitlab.com/calevans/cal-s-life

With the advent of the PSR-7 standard, middleware has become a household name in the PHP ecosystem. This talk will cover middleware architecture concepts including a comparison of how middleware is being used in PHP versus other languages. We’ll look at how to leverage middleware concepts to build applications from scratch as well as combine off-the-shelf components using middleware as the glue. Of course, we’ll also look at some downright dirty tricks you that middleware lets you get away with as well!

3

Should a password be long and complex? What about a string of easy-to-remember words instead? Are password managers the best way forward? What about multiple factors? Is there a better way? These are all questions your users have: learn how to answer them and how to make security easy by moving beyond passwords for your web app entirely with magic link based authentication! Your users just click a link; they don't have to remember anything. Full code examples available on GitHub: https://github.com/ericmann/netmag-magiclinks/

How to tackle real-world web platform performance problems in modern websites and apps? This session starts with a basic understanding of the web platform and then explores to a set of problem/solution pairs built from industry-standard performance guidance. In the talk, we will demonstrate performance tips and tricks that will help you improve the performance of your apps and sites today. We will discuss the following respond to network requests, speed and responsiveness, optimizing media usage, and writing fast JavaScript. These performance tips and tricks apply equally to web sites that run on standards based web browsers, as well as to modern apps.

5

Arrays are beautiful in PHP. One can map them, reduce them, filter them, foreach them, and use them in generators. Strings, on the other hand, are mere shadows to the Array. One can, uh, input and output Strings, and, when brave, manipulate them. What makes Arrays so awesome and Strings so dull? Iterators. In this talk, we’ll look at the modest origins of the String and the basics of the Iterator. Then, we’ll look at how we can make the String as awesome as the Array through the use of iterator interfaces. By the end of this talk, you will know the origins of the PHP String and you will be able to extend your knowledge of iterating through a String to be able to iterate through customized objects.

When creating a new REST platform, the planning process frequently gets skipped (or is misunderstood) resulting in an ill-conceived API. I’ll walk you through the steps needed to create an API that developers love, and point out the common traps to avoid. The presentation will cover creating user stories, deciding on metrics, planning the API, design decisions, documentation and developer support. I will focus on creating a developer experience that will delight and amaze your developer partners and increase engagement with your platform. This talk will focus on higher level choices rather than HTTP architecture, and is appropriate for developers, product managers, or anyone else with an interest in achieving success for their API program. The Open API Ecosystem is an amazing opportunity for companies to partner with developers, but you really only get one chance to impress, so come learn how to make your company’s API an “A List” destination.

var_dump($foo) print_r($bar) die($baz) Are these your current debugging tools? Wouldn't it be nice to see $foo, $bar, and $baz while the code is still being executed? Watch it change, live? And not have it just dumped all over the output of your otherwise beautiful app? We'll install XDebug, set up your IDE to use it (with examples shown for PhpStorm, Netbeans, and ZendStudio), then we'll actually walk through some badly written code that needs to be debugged. Level: Beginner

5

The Accelerated Mobile Page project aims to create a framework that allows webpages to load fast on mobile devices. By focusing on things that browsers do fast, and avoiding things that take time, the AMP project allows mobile devices to load content almost instantly. During this presentation we will dive into AMP HTML, AMP JS and the Google AMP cache. We will look at the AMP open source project and its closed source alternatives and we will also see how HTTP/2 plays into making your mobile site load faster. We will also look at how you can monetize your AMP based site. Level: Intermediate

Introduction/Tutorial of Data Visualization in JavaScript, with the use of the D3.js library.

In 1969, researchers at Stanford and UCLA collaborated to transmit the first message over what would become the Internet. In just five decades, the repercussions of that moment have echoed through every atom of society. The world is evolving at a pace unprecedented in human history as we use technology to change how we think, learn, communicate, and even how we understand ourselves. Let’s take an inside look at how the fusion of media and technology is reinventing human interaction and the role that we, as engineers and technologists, must play in this important process.

6

Software bugs are inevitable; some are especially difficult to track down, causing you to waste countless hours before throwing your hands up in defeat. It doesn't have to be this way! The mental fatigue and wasted time can be avoided by using strategies like identifying the most-appropriate tool, taking a logical & objective approach, challenging assumptions, listening to variables, isolating the code path, and reinforcing code with automated tests. Attendees will learn how to combine these techniques with the right mindset and attitude in order to debug their code quickly and effectively.

3

Congratulations! Your team has chosen a coding standard to use and you're well on your way to a consistent code style for all your projects. But... there are some extra things you'd like to check for, some rules you really can't be bothered with and some which sort of fit your needs, but not completely. Now what? Come and learn how to make the PHP Codesniffer work for you and how to streamline the PHPCS related work-flow along the way.

10

No matter how many virtual machines you throw at a problem you always have the physical limitations of hardware. Memory, CPU, and even your NIC's throughput have finite limits. Are you trying to load that 5 GB csv into memory to process it? No really, you shouldn't! PHP has many built in features to deal with data in more efficient ways that pumping everything into an array or object. Using PHP stream and stream filtering mechanisms you can work with chunked data in an efficient matter, with sockets and processes you can farm out work efficiently and still keep track of what your application is doing. These features can help with memory, CPU, and other physical system limitations to help you scale without the giant AWS bill.

2

Cryptography is a complex and confusing subject. There seems to be more disinformation than actual information. Learn how to properly use cryptography to secure user credentials and consumer data. We will discuss cryptographic methodologies and algorithms available to PHP. The main focus will focus be on encryption with RSA and AES and hashing with SHA and the PHP Password Hashing extension. We will discuss other methodologies as part of a compare and contrast based on cryptography strength and randomness.

Do your peers come to you when they need help with networking? Are the the one that has to trace down problems with local networking resources? Do you know the server is down because your Slack DMs blow up? If you answer yes to any of these, congratulations, you are "DevOps". Every company has DevOps people, whether they call them that or not. These are the people that fix things, patch software, that help developers stay focused on developing. In this session I will share with you lessons learned form 9+ years of being "the server person". We will cover topics like: - Stop using WAMP/MAMP and start using Vagrant - Version control isn't renaming files - Automate common tasks with shell scripts / command line PHP apps - From Vagrant to Production Join me. Embrace your inner DevOps

2

You've heard of Zend's new framework, Expressive, and you've heard it's the new hotness. In this talk, I will introduce the concepts of Expressive, how to bootstrap a simple application with the framework using best practices, and finally how to integrate a third party tool like Doctrine ORM.

14

Your new database query ran quickly when you tested it, but seconds after deploying it, alarms are blaring and you’re scrambling to rollback before the site goes down. What happened?!? I can “EXPLAIN”. Queries that perform well under development load with limited datasets can easily bring a database to its knees under production load. In this talk, you will learn to decipher MySQL query execution plans, recognize portions that can be improved, and take the necessary steps to optimize your queries - all without starting any fires!

3

So the time has come to take the leap and upgrade your application to a new major version of the underlying framework, or, perhaps, to an entirely different framework... how do you ensure that none of your functionality or usability is impacted by a potentially drastic rewrite of the underlying systems? How can you move forward with 100% confidence in your migrated codebase? Testing, testing and more testing. Using a combination of unit, functional and acceptance tests can give you the certainty you need. In this talk, we will go over key strategies for ensuring that you begin with full code coverage and move forward with confidence. Testing framework: Codeception 2.2.x

7

All of us have worked with relational DBs like MySQL or PostgreSQL, but for many use cases they aren't the best option. Graph databases have a simpler, more powerful model for handling complex related data. In this talk we'll work with Neo4j to explore the advantages of graph DBs. Attendees will learn the graph model, how graph DBs let you do things that are practically impossible with SQL, and the best options for integrating one into your PHP application -- new or existing.

8

Catching software bugs is a mysterious magic, unknowable by science and untouchable by process. False! Programming bugs, like real bugs, can be organized into a taxonomy. Come with me and I'll show you how classification can help you build “programmer’s instinct” into a logical debugging process. Debugging may be instinctual but those instincts come from seeing, identifying and diagnosing patterns. In this talk, we’ll use phenetic taxonomy to build a debugging decision making network based on attributes and behaviors of common bugs. Newer developers will learn how to apply systematic pattern matching to debugging while seasoned developers will learn how to use their instincts to teach debugging.

We live in a highly distributed world. This means that data doesn’t all live in one place, development teams are scattered and spread geographically, and service modularization is the key to tackle the complexity of large enterprise systems—in short, the end of the monolith. As a result, modern distributed architectures (microservices) have become widespread. What does this mean for a professional PHP developer like you? It means that instead of reading data from your single, all-mighty MySQL server, you find yourself mashing up APIs from different sources that each make up a piece of the puzzle of the user interface your customers see. Unfortunately, this adds an incredible degree of difficulty to your code as the data is no longer accessible from your local, fast database, but from slower, remote, asynchronous RESTful APIs. In this talk , we explore the Reactive Extensions library for PHP (RxPHP), which will become your BFF when building a server-side aggregation endpoint that can compose data from multiple RESTful services or APIs and combine together in ways PHP developers have never seen before.

Being on call sucks, but it doesn’t have to. Many organizations struggle to maintain effective on-call rotations that minimize the number of people woken up in the middle of the night -- so much so, that “burnout syndrome” is an actual disorder that’s commonly experienced by professionals in on-call positions. In this talk, we’ll talk about how you can set up your on-call rotations to optimize the uptime of your infrastructure and your engineering team.

Join us, as Adam Culp moderates, for an eye opening discussion about security for web-based applications. Bring questions!

Hack Event

10

Imagine a world in which your career, the careers of your friends and coworkers, and the businesses and industries built on PHP vanished overnight, or never existed at all. No Facebook. No Wordpress. Billions of dollars in online commerce, all gone. Flickr, Tumblr, MailChimp: poof! This talk presents a dystopian world in which we are stuck updating each other via SMS or (gasp!) MySpace, reading content on corporate portals, and buying everything from just a handful of online marketplaces.

I don't have enough time" is a cry that echoes across social media and online chat rooms. Work deadlines, family obligations, hobbies that don't involve computers -- they all are taking out chunks of the time we have available to us. But there is one immutable fact --we all have the same amount of time available, some of us just find different ways to use it. In this session learn how long-time grumpy programmer Chris Hartjes organizes and makes decisions about how to spend his time. Business owner, involved work-from-home parent, conference speaker, podcaster, collectable card game enthusiast - Chris does this all and more without feeling super-stressed about it. Was he born with this super power? Not at all. The talk will cover how Chris plans his life, his preferred tools, and strategies for figuring out what to do and when to do it. It is possible to get a lot done and not become a workaholic in the process. Sit back, relax, and let a grumpy programmer show you how to maximize your time.

HTTP/2 (H2) is coming, and along with it a whole new way of communicating over the web. Connection re-use, prioritization, multiplexing, and server push are just some of the features in H2. In this talk we'll look at the HTTP/2 protocol, and at how we can use asynchronous request now with HTTP/1.x. We will also look at what asynchronous requests and H2 mean for your API and clients in the future.

While there is some truth to “some amount of innate talent is required to be a true artist”, it’s not necessarily so in learning how to design. And as developers, we’ve all found ourselves struggling when called on to be both the designer and developer of a website. There are processes and techniques you can use to create a well designed site. From “hierarchy of content” to “font usage” to “proximity of elements”, I will teach you how to develop an eye for design that will carry you through any task, and may even alter how you see the world as you learn related patterns are everywhere.

2

The new JSON fields are some of the most talking about new features in MySQL 5.7. But they are by no means the only awesome things this version has to offer. MySQL 5.7 is a year old, so this talk won't be an introduction to this version. We will be digging into 5.7 to see how to make the most of the tools available in it. Want to tackle important practical problem solving for your data, make your query performance analysis more efficient or look at how virtual columns can help you index data? This talk is for you!

5

Your mission, should you choose to accept it, is to support an application built on an older framework. Refactoring isn't an easy option. The code is untested and nowhere near best practices or standards. In this session, we'll talk about strategies to incorporate modern PHP coding practices to add features and functionality and retiring the older code in pieces. We'll review specific examples and code from a real project where we bootstrapped a legacy application that needed a lot of help to become useful to its users and simpler for developers to maintain. We'll talk about strategies to leave the existing code in place until the new code is ready to replace it in whole or in pieces.

MySQL now has a native JSON Data type. So like an Integer or a character, you can store an entire valid JSON document in a column of a table in a MySQL database. Sure you could store JSON data in a text field but then you end up using Regular Expressions to search that data and who needs that aggravation? This session will cover how JSON information is store in an optimized binary format, functions you need to know to use that JSON data (How many email fields are in that JSON document or how to update information), the usages of generated columns that take information from JSON documents to materialize a column that is indexed for searching, and lots of programming examples. Plus there is a new MySQL Protocol and X Devapi that allows you to use a MySQL database as a document store which means no writing queries, no structured query language, and the ability from your favorite programming language to do CRUD (Create, Replace, Update, Delete) directly.

1

Coding an admin panel is not the problem you love to face when you wake up in the morning, but is something you need to do very often. Having an environment that allows you to implement this efficiently, is something key for a developer. Symfony and SonataAdminBundle provide a way to do it that gives you as many out-of-the-box functionalities as you could dream of, plus the chance to customize every piece -if you know how to do it. The purpose of this talk is to show how easily can you get profit of SonataAdminBundle once you know how to deal with it. We will start with a clean installation of Symfony and SonataAdminBundle, showing how to build up form there, and how to solve the main problems and questions that you usually face when having a complex admin panel in your hands. The main purposes are to show how to use SonataAdminBundle in the most standard way, and how to build up from that point, customizing whatever you need to meet the exact requirements of the project.

Today, there is a huge focus on frameworks, web applications and micro services. As we focus on those, we look past something simple, a command line script that can take tasks and remove them from your plate. From something simple like exporting a database back up to sending out notifications to users via an API, a command line script can remove hours of work, and just sit in the background until called via cron or an action. Lets look at ways to automate your code, both production and tests and what libraries can help us write awesome CLI scripts!

10 years ago I was a lonely developer sitting in a small room quietly turning out code between 9am and 5pm, Monday to Friday. Fast-forward to now and you'll see me standing in front of audiences all around the world talking to developers about numerous topics."Why are you bragging like that at me?" I hear you ask. Because it could happen to you too. The question I always ask myself is "How the hell did that happen?!?!". The truth is that the only reason I've managed to advance my career so far in a decade is because of the people that make up the communities of open source projects. Not only do open source projects save you time and money, but the friendships and support groups that can be made within these communities is, frankly, staggering. Join me as I chart my journey from wage slave to conference speaker, and look at how you can leverage the power of open source to make real friends, real money, and real happiness.

Okay, you've made the move to containers and can now write Dockerfiles for everything. How do you manage all of those containers?. Have you found that you traded managing individual machines for managing individual containers? Kubernetes, an Open Source container orchestration engine, can be your answer. We'll explore Kubernetes and see how you can use it to run massive collections of containers that fix their own problems and allow you to move your setup wherever you need to be.

5

Modern browsers support a new standard call Websockets, which allow persistent connections between a browser and a server. We'll discuss how to implement Websockets with your client-side Javascript talking to your server-side PHP, using the ReactPHP framework.

Today, cyber threats are everywhere, and are becoming more aggressive, complex and sophisticated. An attack can result in theft of information, exposure to sensitive information. A threat is something we cannot prevent, such as the threat of someone trying to launch a Cross Site Scripting Attack (XSS). However, we can reduce the risk by ensuring proper input validation on all data stored in the database. Web based applications represent an attack vector. As a developer, you should be aware of the most important security concerns when you develop your web interface, and the best practices you can take keep your servers, software, and data safe from threats that exist in today’s complex environment. I’ll provide an overview of security, list some of the top vulnerabilities, and get participants into a security mind set.

5

Learning about Command Query Responsibility Segregation (CQRS) and Event Sourcing can be both exciting and confusing. It sounds great, but how does it work in the real world? Won't it be a lot of work before you even get started? Will it be worth the investment and when will that investment start paying off? Are these technologies appropriate for building a minimum viable product (MVP)? Find out how these questions were answered for one team as they set out to build their MVP.

4

It’s common to hear people preach “plan in security from the start” and in an ideal world you can. Here in the real world, though, we have legacy code that’s gathered over time and comes with a host of problems - (in)security included. What do you do when you’ve been commissioned with securing an application that’s showing its age? Follow along with me as a I step you through a list of tips and tricks you can use to discover security issues in your application and effectively fix them and secure your application. Topics will include some of the most common vulnerability types, key places to look for potential issues and arm you with the tools and knowledge you’ll need to refactor that legacy application into something secure.

4

Ever got the message "Fatal error: Out of memory" when running your unit tests? Or do you have to wait for more than 5 minutes for all of your unit tests to complete? We're using Docker to mitigate these and other issues. In this session I will show you how we have split up a single testsuite of 3K+ tests into manageable unit modules which are executed by Docker micro instances in parallel. And with this set up we test our application on the current PHP version, but it also allows us to test against a new major PHP version the moment it is released or even is available in beta.

1

In this talk you will learn how to effectively store, retrieve and display geospatial data, such as roads, points of interests and more. First we will be importing an OpenStreetMap dataset covering London into MongoDB. This is not trivial due to the amount of data. After importing, we will look at which types of queries we can run to find things. Either by predicates, or with geospatial queries. And last we will have a look at how to display the data that we've requested, through a website using the Leaflet mapping library.

See the latest technology in brain computer interfaces and see a live demo of how you can control your applications with just your mind! As we seek better user interfaces, maybe future applications will no longer require a mouse and a keyboard, just your thoughts.

1

Congrats! You and your coworkers love Docker. Docker has become an increasingly helpful tool when it comes to devops. We can now build smaller, more robust local development setups with the promise of mirroring production. One thing that still plagues many situations is how to get those containers into production and update them over time. We will explore different tools for setting up, configuring, and maintaining containers as they go live.

5

Everyone tells you that you need to test. You know the theory, but you don't know where to begin. What to test? What cases to write? Through realistic and pragmatic examples, this presentation will take you away from var_dump and ease you into the testing business until you're ready to do TDD. All this without losing sight of the tight deadlines.

1

Software development has grown in the last 10 years, and with it the profession has also grown. This talk will cover the basic principles and mindset that differ from a software developer to a software engineer. Principles such as troubleshooting, toolsets, risk management, etc. The idea of the talk is to go over these base core principles and expose them to software developers starting in the profession or want to give a shift in their career improving it.

The performance of a web site is one of the criteria used by Google and other search engines to determine the site's ranking. Various studies have shown that there is a link between performance and conversion rates. These are just two of many reasons to make performance optimization a mandatory step in your development process. However advice that was relevant a few years ago is often made obsolete by new browser versions or new technologies like HTTP/2. We will cover several aspects of optimizing a site from a performance perspective, debunk some myths, and also present tools that help analyzing a web site's performance.

Humans learn most effectively through pain, like being shocked by a power outlet or touching a hot iron. The same reaction can be found in technology, but how can we attribute this to programming while minimizing the most painful mistakes? Adam Culp will share some life experiences that contributed to his ongoing journey to become a professional developer, and highlight techniques used to reduce the pain and still reap the benefits. This keynote encourages attendees to aspire to achieve more in their lives.