731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton

731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton

Scott and Wes are joined by security expert, Alex Sexton of Stripe to cover all things: client security, XSS, attack vectors, and CSP (content security policy). Show Notes 00:00 Welcome to Syntax! 00:31 Brought to you by Sentry.io. 00:57 Who is Alex Sexton? 04:44 Stripe dashboard is a work of art. 05:08 Tell us about the design system. React Aria 08:59 Who develops the iOS app? 09:50 Stripe’s CSP (content security policy). 12:50 What even is a content security policy? Content Security Policy explanation 13:57 Douglas Crockford of Yahoo on security. Douglas on GitHub 15:13 Security philosophy. 16:59 What about inline styles and inline JavaScript? 19:41 How do we safely set inline styles from JS? 20:20 Setting up with meta tags. 22:52 What are common situations that require security exceptions? 26:24 Potential damage with inline style tags. 32:45 Looping vulnerabilities. 36:32 What about JavaScript injection? 37:09 Myspace Samy Worm. Myspace Samy Worm Wiki Sentry.io Security Policy Reporting 42:02 Does a CSP stop code from running in the console? 43:28 What are some general security best practices? 46:35 Strategies for rolling out a CSP. 51:49 Final tip, Strict Dynamic. Strict Dynamic 56:36 Where does the CSP live within Stripe? Original Black Friday story 59:35 One last story. 01:01:20 Sick Picks + Shameless Plugs Sick Picks + Shameless Plugs Alex: Wes Bos’ Instagram Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott:X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Jaksot(976)

952: VS Code, GitHub & Copilot - UNIVERSE 25 Announcements + Reactions

952: VS Code, GitHub & Copilot - UNIVERSE 25 Announcements + Reactions

Live from GitHub Universe, Wes, Scott, and CJ talk about the latest AI and developer tools from GitHub, including Agent HQ, Copilot integrations, and the new mission control for agents. They also shar...

5 Marras 202535min

951: A first look at Remix 3

951: A first look at Remix 3

Scott and Wes dive into Remix 3, exploring how it embraces native web standards like Events, Signals, and Streams to become a truly full-stack framework. They unpack what “LLM-ready,” thin APIs, and a...

3 Marras 202547min

950: Even SCARIER Web Dev Nightmares (Spooky Stories Pt. 2)

950: Even SCARIER Web Dev Nightmares (Spooky Stories Pt. 2)

In part 2 of this year’s Spooky Stories special, Wes and Scott discuss the most chilling developer horror stories—from six-month-old unprocessed donations and runaway dog-food orders to vanishing data...

29 Loka 202557min

949: Web Dev HORROR Stories + Spooky Trivia! (Spooky Stories Pt. 1)

949: Web Dev HORROR Stories + Spooky Trivia! (Spooky Stories Pt. 1)

It’s that time of year again, Scott (as Dracula) and Wes (as a big bad shark) return for their annual Spooky Stories special! They’re joined by a mysterious guest for a round of creepy coding trivia a...

27 Loka 202540min

948: Zed is Ready For Primetime

948: Zed is Ready For Primetime

Wes and Scott talk about what makes Zed—the hot new editor built in Rust—fast, beautiful, and finally ready for primetime. From Git UI to extensions and AI tools, they break down what Zed gets right, ...

22 Loka 202553min

947: S-Tier MCP Servers for Developers

947: S-Tier MCP Servers for Developers

Scott and Wes break down the top-tier MCP servers developers are using right now. From browser automation to debugging superpowers, they explore how these servers are changing what’s possible in moder...

20 Loka 202532min

946: We Got Roasted for Our Websites — Fair

946: We Got Roasted for Our Websites — Fair

In this potluck episode of Syntax, Wes and Scott answer your questions about why devs neglect their own websites, hosting shady projects (hypothetically), AI rules in version control, balancing side p...

15 Loka 202557min

945: Chrome Dev Tools MCP Server

945: Chrome Dev Tools MCP Server

Scott and Wes dive into Chrome’s new MCP server; a dev tools API powered by Puppeteer that gives your scripts, editors, and AI agents full access to Chrome. They break down how it works, what it can (...

13 Loka 202529min

Suosittua kategoriassa Politiikka ja uutiset

aikalisa
rss-ootsa-kuullut-tasta
tervo-halme
ootsa-kuullut-tasta-2
politiikan-puskaradio
viisupodi
otetaan-yhdet
rss-podme-livebox
rss-asiastudio
et-sa-noin-voi-sanoo-esittaa
rss-vaalirankkurit-podcast
the-ulkopolitist
linda-maria
rss-kaikki-uusiksi
rss-mina-ukkola
rss-pykalien-takaa
rss-merja-mahkan-rahat
rss-kuka-mina-olen
rss-raha-talous-ja-politiikka
rss-kyselytunti