TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Jaksot(734)

Build Your Game Using JavaScript with Andrzej Mazur- JSJ 572

Build Your Game Using JavaScript with Andrzej Mazur- JSJ 572

Andrzej Mazur is a HTML5 Game Developer. He joins the show alongside AJ and Chuck to talk about creating games in JavaScript. He begins by outlining his past and current experiences as a game developer. He offers some of his techniques to individuals who want to start developing web games.Sponsors Chuck's Resume Template Developer Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksENCLAVE GAMESjs13kGamesGamedev.jsGamedev.js weeklyGamedev.js WarszawaFOREST CUTIESEnclaveGames/Enclave-Phaser-TemplateOpenGameArtUnity Asset StoreKenney Game AssetsGlobal Game Jamwebinstall.dev/aliasmanGitHub: end3rLinkedIn: Andrzej MazurTwitter: @end3rPicksAJ - OC RemixAJ - Ballarini (Granitium Non-Stick Cookware) setAJ - Utility Series Keychain KnifeAJ - EDC Fans Keychain KnifeAndrzej - NeuroshimaHex.plAndrzej - Gamedev.js Jam 2022Andrzej - PhaserChuck - Mysterium Chuck - Hold on to people you care about! Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

7 Maalis 20231h 20min

The State of JS Frameworks with Ryan Carniato: Part 2 - JSJ 571

The State of JS Frameworks with Ryan Carniato: Part 2 - JSJ 571

Ryan Carniato is the Principal Engineer OSS at Netlify. He is the author of the SolidJS UI library. He joins the show to talk about where the JavaScript Frameworks are headed. They share their insights on the changes that occurred in React. Additionally, they talk about their perspective on React and other JavaScript frameworks. On YouTubeThe State of JS Frameworks with Ryan Carniato: Part 2 - JSJ 571Sponsors Chuck's Resume TemplateDeveloper Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksRyan Carniato - DevRyan Carniato | YouTubeTwitter: @RyanCarniatoAJ ONeal - GitPicksAJ - ChatGPT-DanRyan - React.js: The Documentary - How it All BeganSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

28 Helmi 202350min

The State of JS Frameworks with Ryan Carniato: Part 1 - JSJ 570

The State of JS Frameworks with Ryan Carniato: Part 1 - JSJ 570

Ryan Carniato is the Principal Engineer OSS at Netlify. He is the author of the SolidJS UI library. He joins the show to talk about where the JavaScript Frameworks are headed. They share their insights on the changes that occurred in React. Additionally, they talk about their perspective on React and other JavaScript frameworks. Sponsors Chuck's Resume TemplateDeveloper Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksRyan Carniato - DevRyan Carniato | YouTubeTwitter: @RyanCarniatoSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

21 Helmi 20231h 3min

Web Performance With Alex Russell - JSJ 569

Web Performance With Alex Russell - JSJ 569

Alex Russell is the Partner Product Manager on Microsoft Edge. He joins the show to talk about web framework performance. He starts out by going over a few examples of user interactions from various web applications and how they affect their performance. Moreover, he gets into detail about the article he wrote, "The Performance Inequality Gap, 2023".Sponsors Chuck's Resume TemplateDeveloper Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksA Management Maturity Model for PerformanceThe Performance Inequality Gap, 2023Depth-and-frequencymulti-core scoressingle core scoresInfrequently NotedGitHub: slightlyoffTwitter: @slightlylatePicks AJ - webinstall.dev/vim-aleAlex - open web advocacyCharles - Harry Potter: Death Eaters Rising Charles - ARETE MEANS EXCELLENCEDan - Dan Shappir at @JSJabber Web Dev podcast PollSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

14 Helmi 20231h 26min

React Native & Every-Platform Embeddable UI With Taz Singh - JSJ 568

React Native & Every-Platform Embeddable UI With Taz Singh - JSJ 568

Taz Singh is the Founder of Guild. It is an all-in-one platform for Events, Presentations, and Discussions designed to reduce the burden as communities scale. He joins the show to talk about Guild and React Native. He begins by discussing his journey toward how he was able to create his company. He talks about their goals and what sets them apart from other platforms. Additionally, they tackle developing applications using React Native. About This EpisodeFuture projects for GuildUsing React Native to develop apps for MobileUsing React Native to develop apps for WebTamaguiSponsorsChuck's Resume TemplateDeveloper Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksGuildTamagui — React Native + Web UI kitTaz SinghLinkedIn: Taz SinghGitHub: tazsinghTwitter: @tazsinghTwitter: @guild__hostPicksAJ - AJScript ( (Moving to GPTScript)AJ - SNOWFLAKES ARE REAL!Charles - Top End DevsDan - TypeScript 5.0 Beta Deep DiveDan - React Streaming In Depth: NextJS! Remix! DIY!Taz - GuildSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

8 Helmi 20231h 32min

Providing The Best User Experiences on the Web With Vercel- BONUS

Providing The Best User Experiences on the Web With Vercel- BONUS

Lee Robinson is the VP of Developer Experience at Vercel. Vercel is the platform for frontend developers, providing the speed and reliability innovators need to create at the moment of inspiration. He joins Chuck on the show to talk about NextJS 13 and their company. He goes into great detail about how they continue to offer the finest user and development experience. Additionally, they talk about Vercel's features. LinksVercelNext.js Conf Keynote: Introducing Next.js 13 and TurbopackVercel Analytics: Real-time Insights, Peak PerformanceLee RobinsonLinkedIn: Lee RobinsonTwitter: @leeerob Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

3 Helmi 202334min

Front-End Hydration - JSJ 567

Front-End Hydration - JSJ 567

Dan Shappir takes the lead for this week's panelist episode as he talks about hydration. Hydration is the technique of using client-side JavaScript to enhance server-rendered HTML with application state and interaction. In the context of Web performance, he explains why it is regarded as such an issue and its impact.The second part of this episode is reviewing various ways in which modern frameworks, such as Qwik, Astro, Remix, and NextJS are trying to alleviate the impact of hydration:Avoiding frameworks, to begin withFaster hydration, e.g. Svelte, SolidProgressive enhancement, e.g. RemixHydration slicing (+ progressive enhancement), e.g. Remix + React 18 (time slicing / isInputPending)Islands of hydration, e.g. Astro, FreshServer Components, e.g. NextJS 13 React Server Components (SPA and streaming)Resumability, e.q. Qwik, MarkoSponsorsChuck's Resume TemplateDeveloper Book Club starting with Clean Architecture by Robert C. MartinBecome a Top 1% Dev with a Top End Devs MembershipLinksBeyond Code Bootcamp: HomeApril 24 - 27, 2023 - JavaScript Conference LondonJSNation Conference 2023Qwik Part II With Misko Hevery - JSJ 563Mastering Linux Shell ScriptingThe Linux Command Line, 2nd Edition: A Complete IntroductionPicksAJ - Animal CrossingAJ - Yoshi's Crafted World™Charles- Harry Potter: Death Eaters Rising Dan - Don't Learn TypeScriptDan - JavaScript Frameworks in 2023Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

31 Tammi 20231h 40min

Marvels Of Using Svelte and SvelteKit - JSJ 566

Marvels Of Using Svelte and SvelteKit - JSJ 566

Tracy Lee is the CEO of This Dot Labs, a JavaScript-focused agency, and Adam L Barrett is a Developer Consultant at This Dot Labs. They join the show to talk about the wonders of Svelte and SvelteKit. It is a tool for creating fast web applications. Additionally, they explain how these allow excellent user and developer experiences.About this EpisodeAll about Svelte and SvelteKitThe internals of SvelteBenefits of Svelte compared to other frameworksDifference between Framework and MetaFrameworkOn YouTubeMarvels Of Using Svelte and SvelteKit - JSJ 566SponsorsChuck's Resume TemplateDeveloper Book Club starting with Clean Architecture by Robert C. MartinBecome a Top 1% Dev with a Top End Devs MembershipLinksThis Dot LabsTwitter: @adamlbarrettTwitter: @ladyleetTwitter: @ThisDotLabsPicksAdam - Zod Schema ValidationAdam - Frosthaven | Board Game | BoardGameGeekAJ - Silicon Power 1TB MicroSD under $100AJ - MBP M1 Storage ExpansionDan - Svelte Origins: A JavaScript DocumentaryDan -  State of JS 2022 gender gapDan - Sneaky Pete TV show on Amazon PrimeDan - "We Hate Perfect Things" by AJDan - War in UkraineCharles - Karma | BoardGameGeekCharles - 1923 (TV Series 2022–2023)Charles - XeroCharles - This Dot LabsTracy - Women in TechSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

24 Tammi 20231h 26min

Suosittua kategoriassa Liike-elämä ja talous

sijotuskasti
psykopodiaa-podcast
rss-rahapodi
mimmit-sijoittaa
inderespodi
taloudellinen-mielenrauha
ostan-asuntoja-podcast
rss-bisnesta-bebeja
pomojen-suusta
rss-rahamania
lakicast
rss-sisalto-kuntoon
rss-seuraava-potilas
rss-paasipodi
herrasmieshakkerit
juristipodi
jahtaa-unelmiasi
rss-ammattipodcast
rss-salonkipodi
rss-karon-grilli