TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Jaksot(734)

React Server Components: Part 1 - JSJ 582

React Server Components: Part 1 - JSJ 582

Dan Abramov is a Front-end developer at Facebook and Joe Savona is a User Interface engineer at Facebook. They join the show to talk about React Server Components. They begin by explaining what it is, how it's implemented, the services it offers to the clients, and many more. On YouTubeReact Server Components: Part 1 - JSJ 582SponsorsChuck's Resume Template Raygun - Application Monitoring For Web & Mobile AppsBecome a Top 1% Dev with a Top End Devs MembershipSocialsDan Abramov GitHub: gaearonTwitter: @dan_abramovJoe SavonaLinkedIn: Joseph Savona josephsavona.comTwitter: @en_JSSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

16 Touko 202352min

SolidStart with Ryan Carniato - JSJ 581

SolidStart with Ryan Carniato - JSJ 581

Ryan Carniato is the CEO of Signals and the Principal Engineer OSS at Netlify. He is the author of the SolidJS UI library. He returns to the show to talk about SolidStart. He begins by explaining the difference between signals and observables. Along with that, he discusses how he came to develop the framework, its features, and his future plans. SponsorsChuck's Resume Template Developer Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinkssolidjs/solid-startSocialsRyan CarniatoTwitter: @RyanCarniatoSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

9 Touko 20231h 26min

Find Out More About Brad Westfall - BONUS

Find Out More About Brad Westfall - BONUS

Brad Westfall is a full-stack web developer and works at ReactTraining.com. He is one of the speakers at the upcoming JSNation conference. He joins Chuck in this bonus episode to provide an introduction to his topic at the conference. LinksThe main JS conference of 2023SocialsLinkedIn: Brad WestfallSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

9 Touko 20234min

What To Expect For JSNation -  BONUS

What To Expect For JSNation - BONUS

Chuck gives an overview of the events that will take place in the months of May and June for the JavaScript and React community. On YouTubeWhat To Expect For May and June 2023 - BONUSLinksJSNation – the main JavaScript conference of 2023Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

5 Touko 20233min

Cross Platform App Development with Simon Grimm - JSJ 580

Cross Platform App Development with Simon Grimm - JSJ 580

Simon Grimm is a Creator, Indie Maker & Solopreneur. He is currently working at The Ionic Academy. He joins the show to talk about "cross-platform development frameworks". He also tackles the difference between building native and hybrid apps. Additionally, he explains the different cross-platform apps. On YouTubeCross Platform App Development with Simon Grimm - JSJ 580SponsorsChuck's Resume Template Raygun - Application Monitoring For Web & Mobile AppsBecome a Top 1% Dev with a Top End Devs MembershipLinksThe Ionic AcademySocialsDevdacticGitHub: saimon24LinkedIn: Simon GrimmTwitter: @schlimmsonPicksAJ - Volume MasterAJ - videospeedAJ - SpeechifyAJ - bnna.netAJ - tauri-apps/awesome-tauriCharles - Jason Weimann - Learn Video Game Development with Chuck - BONUSCharles - game.coursesDan - ReactNext - ReactNext: Israel's largest React ConferenceDan - JNation 2023Dan - The main JS conference of 2023 - JSNation 2023Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

3 Touko 20231h 24min

Find Out More About Elliot Johnson - BONUS

Find Out More About Elliot Johnson - BONUS

Elliott Johnson is a Multi-stack data software generalist at Vercel. He is one of the speakers at the upcoming JSNation conference. He joins Chuck in this bonus episode to provide an introduction to his topic at the conference. LinksThe main JS conference of 2023SocialsLinkedIn: Elliott JohnsonSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

3 Touko 20238min

Getting to Know Bruce A. Tate - BONUS

Getting to Know Bruce A. Tate - BONUS

Bruce A. Tate is a Founder at Groxio, Elixir Expert, and a Technical Author. He joins the show alongside Charles Max Wood to talk about his book, "Seven Languages in Seven Weeks". He also delves into some of the preparations and anticipations that come with reading the book. LinksSeven Languages in Seven Weeksgrox.io SocialsLinkedIn: Bruce TateTwitter: redrapidsSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

26 Huhti 202331min

Everything Remult with Noam Honig and Yoni Rapoport - JSJ 579

Everything Remult with Noam Honig and Yoni Rapoport - JSJ 579

Noam Honig is the Founder & CEO of Firefly Migration. Yoni Rapoport is a CTO at Firefly Migration. They join the show to talk about "Remult". It builds Full-stack, End-to-end Type-safe CRUD Apps without the Boilerplate. They dive into how it functions in your apps and its useful features. SponsorsChuck's Resume Template Developer Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksRemultremultShort demo videoIntro blog postJS meetup talkTwitter: @RemultJsRemult | YouTubeSocialsLinkedIn: Yoni RapoportTwitter: @YoniRapoportLinkedIn: Noam HonigTwitter: @noamhonigPicksDan - The SolidJS April 1st tweetNoam - Thunder ClientYoni - Vite Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

25 Huhti 20231h 20min

Suosittua kategoriassa Liike-elämä ja talous

sijotuskasti
psykopodiaa-podcast
rss-rahapodi
mimmit-sijoittaa
inderespodi
taloudellinen-mielenrauha
ostan-asuntoja-podcast
rss-bisnesta-bebeja
pomojen-suusta
rss-rahamania
lakicast
rss-sisalto-kuntoon
rss-seuraava-potilas
rss-paasipodi
herrasmieshakkerit
juristipodi
jahtaa-unelmiasi
rss-ammattipodcast
rss-salonkipodi
rss-karon-grilli