TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Jaksot(734)

Is JavaScript on the Backend a Mistake? - JSJ 596

Is JavaScript on the Backend a Mistake? - JSJ 596

Lane Wagner is the Founder of Boot.Dev. They delve into the world of JavaScript and backend development. They also share their experiences with API gateways and provide insights into both positive and negative implementations. Additionally, they uncover the challenges and benefits of using JavaScript and Node.js as a backend system and explore the fascinating concept of Back End for Front End (BFF). SponsorsChuck's Resume Template Developer Book Club Become a Top 1% Dev with a Top End Devs MembershipSocialsLinkedIn: Lane WagnerBackend BanterTwitter: wagslanePicksAJ - CoffeezillaAJ - Socket SecurityAJ - JS with TypesCharles - Living Forest | Board GameDan - Silicon Valley (TV Series 2014–2019)Dan - The Faithful and the Fallen Series by John GwynneLane - Boot.Dev - Learn Backend DevelopmentLane - CodeAestheticSteve - Better Off Dead... (1985)Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

29 Elo 20231h 33min

Why Should You Get Into The Web3 World - JSJ 595

Why Should You Get Into The Web3 World - JSJ 595

Julien Klepatch is the CEO and founder of EatTheBlocks. He joins the show to talk about Web3. He begins by sharing his past experiences and how he became a Software Developer. Additionally, he explains the reasons why developers should get into the Web3 world, its advantages, building web applications with Web3, its connection to Blockchain, and many more!SponsorsChuck's Resume Template Raygun - Application Monitoring For Web & Mobile AppsBecome a Top 1% Dev with a Top End Devs MembershipLinksIntroduction to Web3SocialsLinkedIn: Julien KlepatchEatTheBlocksTwitter: @jklepatchPicksAJ - Dash Cryptocurrency Libraries (can work cross-chain)- https://github.com/dashhive/dashphrase.js- https://github.com/dashhive/dashhd.js- https://github.com/dashhive/dashkeys.js- https://github.com/dashhive/dashtx.jsAJ - Harbor FreightAJ - CoffeezillaAJ - Socket SecurityCharles - Skyjo | Board GameCharles - Living Forest | Board GameSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

22 Elo 20231h 20min

The Evolution of Qwik - JSJ 594

The Evolution of Qwik - JSJ 594

Jack Herrington is a Principal Software Engineer. Misko Hevery is the Chief Technology Officer at Builder.io. They join the show to talk about "Qwik v1.0". Misko takes the lead as he shares its exciting new features. He explains what is the Panda CSS and how it works. Moreover, he dives into some of the "Qwiklabs projects", its benefits, and many more!SponsorsChuck's Resume Template Developer Book Club Become a Top 1% Dev with a Top End Devs MembershipLinksqwikQwiklabsPanda CSSSocialsLinkedIn: Jack HerringtonLinkedIn: Misko HeveryPicksAJ - The Legend of Zelda™Jack - Monkeytype Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

15 Elo 20231h 19min

Introducing The B2B SaaS Starter Kit - JSJ 593

Introducing The B2B SaaS Starter Kit - JSJ 593

Andrei Soroker is the CEO of Fogbender. Yaroslav Lapin is a Senior Software Engineer at Fogbender. They join the show to talk about the "B2B SaaS Starter Kit". It is an instructional bundle for assembling products designed to be used by teams of users. They begin by explaining the reason why they created it, the problem it solves, its advantages, how it helps the developers and many more! SponsorsChuck's Resume Template Raygun - Application Monitoring For Web & Mobile AppsBecome a Top 1% Dev with a Top End Devs MembershipLinksGitHub: B2B SaaS Starter KitB2B SaaS KitFogBenderSocialsTwitter: Yaroslav LapinLinkedIn Yaroslav Lapin Twitter: Andrei SorokerLinkedIn: Andrei SorokerPicksAJ - Are we made of math?AJ - Physics is still in crisisDan - Loki (TV Series 2021Dan - WandaVision (TV Mini Series 2021)Steve - Wix’s new tool can create entire websites from promptsSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

8 Elo 20231h 26min

The CSS Universe with Austin Gil - JSJ 592

The CSS Universe with Austin Gil - JSJ 592

Austin Gil is a Senior Developer Advocate. He joins the show to talk about CSS-in-JS. He begins by explaining all things CSS, in a way that developers can easily understand it. He discusses the Evolution of CSS, the challenges you may encounter, CSS branches or specificities, and many more!SponsorsChuck's Resume TemplateDeveloper Book Club Become a Top 1% Dev with a Top End Devs MembershipLinksAST ExplorerParticles CSSSocialsAustin GilLinkedIn: Austin GilPicksAustin - $100 linode creditAustin - local meetups to engage with people in your local communityAustin - Panda CSSAustin - Jury DutyDan - Participating in conferences, especially for the "hallway track"Dan - "The Recruit" on Netflix Dan - The Faithful and the Fallen" fantasy book series by John GwynneDan - Ongoing war in UkraineSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

26 Heinä 20231h 15min

Progressive Enhancement with Elliott Johnson  - JSJ 591

Progressive Enhancement with Elliott Johnson - JSJ 591

Elliott Johnson is a Multi-stack data software generalist and works in Vercel. He joins the show to talk about "Progressive Enhancement". He begins by explaining Svelte & SvelteKit and how it's different from the other frameworks. He goes into more depth about Progressive Enhancement, and how it works. Moreover, he tackles Progressive form enhancement with SvelteKit and many more!SponsorsChuck's Resume Template Raygun - Application Monitoring For Web & Mobile AppsBecome a Top 1% Dev with a Top End Devs MembershipSocialsLinkedIn: Elliott JohnsonPicksAJ - StarsightElliot - Spider-Man: Across the Spider-VerseSteve - I'm done with Red Hat (Enterprise Linux)Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

18 Heinä 20231h 1min

Things Coming Down the Pipe From TC39 - JSJ 590

Things Coming Down the Pipe From TC39 - JSJ 590

Dan and Steve join this week's panelist episode to talk about the TC39. Dan starts off as he explains the stages of adding features to the ECMAScript language specification to be added to the JavaScript language.SponsorsChuck's Resume TemplateDeveloper Book Club Become a Top 1% Dev with a Top End Devs MembershipLinksTC39 processTC39 ECMAScript proposalsUpcoming Proposals for ECMAScript (PART 1) - JSJ 532Stage 3: using keywords for automatic resource disposal (objects with lifetime)(Sync) Iterator Helpers intent to shipSet methodsDecorators (for Aspect Oriented Programming for the separation of cross-cutting concerns, e.g. logging and serialization)ShadowRealmsStage 2: Async Iterator HelpersIterator.rangeStage 1: do expressionsSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

13 Heinä 20231h 17min

Million.js with Aiden Bai and Tobiloba Adedeji  - JSJ 589

Million.js with Aiden Bai and Tobiloba Adedeji - JSJ 589

Aiden Bai is a Web Performance Engineer and Creator of Million.js. Tobiloba Adedeji is a Software Engineer. They join the show to talk about Million.js. They begin by explaining what it is all about, its purpose, the problem it solves, and many more!SponsorsChuck's Resume Template Raygun - Application Monitoring For Web & Mobile AppsBecome a Top 1% Dev with a Top End Devs MembershipLinksMillion.jsSocialsLinkedIn: Tobiloba AdedejiLinkedIn: Aiden BaiTwitter: toby_solutionsPicksAiden - Top End DevsCharles - Shadow Hunters | Board GameCharles - Legendary: A Marvel Deck Building Game (2012)Charles - GitNation EventsSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

4 Heinä 202353min

Suosittua kategoriassa Liike-elämä ja talous

sijotuskasti
psykopodiaa-podcast
rss-rahapodi
mimmit-sijoittaa
inderespodi
taloudellinen-mielenrauha
ostan-asuntoja-podcast
rss-bisnesta-bebeja
pomojen-suusta
rss-rahamania
lakicast
rss-sisalto-kuntoon
rss-seuraava-potilas
rss-paasipodi
herrasmieshakkerit
juristipodi
jahtaa-unelmiasi
rss-ammattipodcast
rss-salonkipodi
rss-karon-grilli