TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679
JavaScript Jabber29 Touko 2025

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Jaksot(735)

151 JSJ Getting Started with a Career in Web Development with Tyler McGinnis

151 JSJ Getting Started with a Career in Web Development with Tyler McGinnis

02:21 - Tyler McGinnis IntroductionTwitter GitHub BlogDevMountain Programming Bootcamp@DevMtn Firebase Experts Program03:23 - Getting Started at DevMountainHack ReactorNeedle04:38 - DevMountain ConceptionCahlan Sharp05:37 - How Do I Learn How to Code?Struggle. Fail. Tears.[Confreaks] Tyler McGinnis: What I’ve Learned about Learning from Teaching People to Code08:03 - Resources => Consume ALL THE InformationKatya Eames[YouTube] Katya Eames: How to Teach Angular to your KidsA Smarter Way to Learn JavaScript: The new approach that uses technology to cut your effort in half by Mark Myers11:16 - Two Camps: Art (Creators) and Technicians <= Does DevMountain Cater to One or the Other?13:08 - Repetition as a Way to LearnThe Hard Way Series (Zed Shaw)Follow @lzsthw for book related news, advice, and politeness 15:23 - Letting People Struggle vs Helping Them    17:14 - Training/Finding Instructors / Teaching Teachers to be Better Teachers21:08 - Why Is JavaScript a Good Language to Learn?JSX24:11 - DevMountain Mentors26:30 - Student Success Stories28:56 - Bootcamp Learning EnvironmentsReact Week@reactweekRyan Florence34:11 - Oldest and Youngest Students (Success Stories Cont’d)37:18 - Bootcamp Alumni (Employment Rates and Statistics)Picks Costco Kirkland Brand Peanut Butter Cups (Dave) [Confreaks] Tyler McGinnis: What I’ve Learned about Learning from Teaching People to Code (Dave) [YouTube] Katya Eames: How to Teach Angular to your Kids (Dave) [YouTube] Misko Hevery and Rado Kirov: ng-conf 2015 Keynote 2 (Dave) Mandy’s Fiancé (AJ) [YouTube] Katya Eames: How to Teach Angular to your Kids (Joe) ng-conf Kids (Joe) Salt (Joe) [YouTube] Dave Smith: Angular + React = Speed (Tyler) [YouTube] Igor Minor: (Super)Power Management (Tyler) React.js Newsletter (Tyler) Dave Smith’s addendum to his talk (Joe)Special Guest: Tyler McGinnis. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

18 Maalis 201550min

150 JSJ OIMs with Richard Kennard, Geraint Luff, and David Luecke

150 JSJ OIMs with Richard Kennard, Geraint Luff, and David Luecke

Check out RailsClips on Kickstarter!! 02:01 - Richard Kennard IntroductionTwitter GitHubKennard ConsultingMetawidget02:04 - Geraint Luff IntroductionTwitter02:07 - David Luecke IntroductionTwitterGitHub02:57 - Object-relational Mapping (ORM)NoSQLDuplication10:57 - Online Interface Mapper (OIM)CRUD (Create, Read, Update, Delete) UI (User Interface)12:53 - How OIMs WorkForm GenerationDynamic GenerationStatic GenerationDuplication of DefinitionsRuntime Generation16:02 - Editing a UI That’s Automatically GeneratedShape Information => Make Obvious Choice23:01 - Why Do We Need These?25:24 - Protocol? Metawidget 27:56 - Plugging Into Frameworksbackbone-formsJSON Schema33:48 - Making Judgement CallsWebComponents, ReactJSON APIAngularJS49:27 - Example OIMsJSON SchemaMetawidgetJsonary 52:08 - TestingPicks The Legend of Zelda: Majora's Mask 3D (AJ) 80/20 Sales and Marketing: The Definitive Guide to Working Less and Making More by Perry Marshall (Chuck) A Wizard of Earthsea by Ursula K. Le Guin (Chuck) Conform: Exposing the Truth About Common Core and Public Education by Glenn Beck (Chuck) Miracles and Massacres: True and Untold Stories of the Making of America by Glenn Beck (Chuck) 3D Modeling (Richard) Blender (Richard) Me3D (Richard) Bandcamp (David) Zones of Thought Series by Vernor Vinge (David) Citizenfour (Geraint) Solar Fields (Geraint) OpenPGP.js (Geraint) forge (Geraint)Special Guests: David Luecke, Geraint Luff, and Richard Kennard. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

11 Maalis 20151h 2min

149 JSJ Passenger Enterprise with Node.js with Hongli Lai and Tinco Andringa

149 JSJ Passenger Enterprise with Node.js with Hongli Lai and Tinco Andringa

Check out RailsClips on Kickstarter!! 02:39 - Hongli Lai IntroductionTwitter GitHub BlogPhusion03:08 - Tinco Andringa IntroductionGitHub03:23 - Phusion Passenger[GitHub] passenger06:13 - Automationnginx08:37 - Parsing HTTP HeadersHooking12:44 - Meteor Support15:37 - Future Added Features?17:12 - Passenger EnterpriseRuby Rogues Episode #143: Passenger Enterprise with Tinco Andringa and Hongli Lai About Phusion Passenger Documentation & Support20:03 - Concurrency and Multithreading  MultiprocessingThe Cluster ModuleWebSocketspassenger_sticky_sessions23:33 - Setting Up on a Server for a Node.js ApplicationDebian Packages25:06 - Union Station Monitoring Tool (Union Station Teaser)Introducing Union Station: our web app performance monitoring and behavior analysis service; now in open beta Using Google PolymerJavaScript Jabber Episode #120: Google Polymer with Rob Dodson and Eric BidelmanPolymer vs Facebook ReactPicks Emily Claire Reese: Playing Catch-Up (Jamison) Jason Punyon: Providence: Failure Is Always an Option (Jamison) Active Child: You Are All I See (Jamison) FFmpeg (Chuck) YouTube (Chuck) Developers' Box Club (Chuck) Ruby Remote Conf (Chuck) DevChat.tv Kickstarter (Chuck) Dash (Hongli) In the Balance: An Alternate History of the Second World War by Harry Turtledove (Hongli) phusion-mvc (Tinco) Union Station Teaser (Tinco) Radio 1's Live Lounge (Tinco)Special Guests: Hongli Lai and Tinco Andringa. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

4 Maalis 201543min

148 JSJ i.cx and EveryBit.js with Matt Asher and Dann Toliver

148 JSJ i.cx and EveryBit.js with Matt Asher and Dann Toliver

02:24 - Dann Toliver IntroductionTwitter GitHub Bento Miso02:35 - Matt Asher IntroductionTwitter GitHub Blog02:51 - EveryBit.js and I.CX[GitHub] everybit.js EveryBit.js Whitepaper 03:43 - ArchitectureEpisode #135: Smallest Federated Wiki with Ward Cunningham06:54 - Sustainability and The Pieces of the SystemContent “Puffs”AuthenticationStorageFirebaseDistributed Hash Table (DHT)The Chord Algorithm (Peer-to-Peer)21:56 - DecentralizationSpace MonkeyMadesafe25:20 - Audience: Why Should I Care?27:38 - Getting Started: Nuts and BoltsFrontend AgnosticStorage and PerformanceUsers and Data ManagementPayload PropertiesMetadataGraph DatabaseAdding New RelationshipsAdding HeuristicsResource Allocator ComponentLocal StorageRAM34:55 - Scaling and Server Cost36:23 - Cloud Storage and Management (Security & Trust)HTTPSSSL ModelGPG Model“Proof of Presence”"Self-verifying"Namecoin Project47:22 - Implementing Cryptographic Primitivesbitcoinjs-lib    Key Management CryptographyOAuth55:13 - The Firefox Sync Tool ProjectPicks [Twitch.tv] Kylelandrypiano (Jamison) "Visualizing Persistent Data Structures" by Dann Toliver (Jamison) Probability and Statistics Blog (Jamison) Seeed Studio (Tim) Adafruit Industries (Tim) SparkFun Electronics (Tim) American Sniper by Chris Kyle, Scott McEwen, and Jim DeFelice (Chuck) Introducing Relay and GraphQL (Dann) The Clojurescript Ecosystem (Dann) Read-Eval-Print-λove (Dann) React Native (Matt)Special Guests: Dann Toliver and Matt Asher. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

25 Helmi 20151h 5min

147 JSJ io.js with Isaac Schleuter and Mikeal Rogers

147 JSJ io.js with Isaac Schleuter and Mikeal Rogers

The panelists talk to Isaac Schleuter and Mikeal Rogers about io.js.Special Guests: Isaac Schleuter and Mikeal Rogers. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

18 Helmi 20152min

146 JSJ React with Christopher Chedeau and Jordan Walke

146 JSJ React with Christopher Chedeau and Jordan Walke

The panelists talk to Christopher Chedeau and Jordan Walke about React.js Conf and React Native.Special Guests: Christopher Chedeau and Jordan Walke. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

11 Helmi 201557min

145 JSJ Meteor.js with Matt DeBergalis

145 JSJ Meteor.js with Matt DeBergalis

The panelists talk to Matt DeBergalis about Meteor.js.Special Guest: Matt DeBergalis. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

4 Helmi 20151h 6min

144 JSJ Marionette.js 2.0 with Sam Saccone

144 JSJ Marionette.js 2.0 with Sam Saccone

The panelists talk to Sam Saccone about Marionette.js 2.0.Special Guest: Sam Saccone. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

28 Tammi 201538min

Suosittua kategoriassa Liike-elämä ja talous

sijotuskasti
psykopodiaa-podcast
mimmit-sijoittaa
rss-rahapodi
herrasmieshakkerit
ostan-asuntoja-podcast
hyva-paha-johtaminen
taloudellinen-mielenrauha
rss-lahtijat
sijoituskaverit
rss-rahamania
rss-huomisen-talous
rss-merja-mahkan-rahat
rss-sisalto-kuntoon
rss-lentopaivakirjat
rss-vaikuttavan-opettajan-vierella
rss-neuvottelija-sami-miettinen
kasvun-kipuja
rss-bisnesta-bebeja
rss-paasipodi