Syntax - Tasty Web Development Treats16 Feb 2024

731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton

Scott and Wes are joined by security expert, Alex Sexton of Stripe to cover all things: client security, XSS, attack vectors, and CSP (content security policy). Show Notes 00:00 Welcome to Syntax! 00:31 Brought to you by Sentry.io. 00:57 Who is Alex Sexton? 04:44 Stripe dashboard is a work of art. 05:08 Tell us about the design system. React Aria 08:59 Who develops the iOS app? 09:50 Stripe’s CSP (content security policy). 12:50 What even is a content security policy? Content Security Policy explanation 13:57 Douglas Crockford of Yahoo on security. Douglas on GitHub 15:13 Security philosophy. 16:59 What about inline styles and inline JavaScript? 19:41 How do we safely set inline styles from JS? 20:20 Setting up with meta tags. 22:52 What are common situations that require security exceptions? 26:24 Potential damage with inline style tags. 32:45 Looping vulnerabilities. 36:32 What about JavaScript injection? 37:09 Myspace Samy Worm. Myspace Samy Worm Wiki Sentry.io Security Policy Reporting 42:02 Does a CSP stop code from running in the console? 43:28 What are some general security best practices? 46:35 Strategies for rolling out a CSP. 51:49 Final tip, Strict Dynamic. Strict Dynamic 56:36 Where does the CSP live within Stripe? Original Black Friday story 59:35 One last story. 01:01:20 Sick Picks + Shameless Plugs Sick Picks + Shameless Plugs Alex: Wes Bos’ Instagram Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott:X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(1024)

1024: Open Models Replace Big AI

A huge week for open models: Inkling (the first big US open-weight model since Gemma 4), Qwen 3.8, and Kimi 3 all dropped. Plus Vue 3.6 RC + Vapor Mode, the slow death of Stack Overflow, a decoy font ...

27 Jul 1h 7min

1023: Mosh, Caddy & Tailscale: A Remote Dev Deep Dive

Running your dev process off your main machine doesn’t have to mean the cloud. Scott and Wes break down how to host projects on a box you can reach from any device, close your laptop mid-build, and ke...

22 Jul 48min

1022: Bun re-written in Rust, Zig team big mad

CJ and Scott break down the biggest week in web dev: TypeScript 7 ships with a 10x-faster native port, Bun gets rewritten in Rust (much to the Zig team’s dismay), and Better Auth joins Vercel. Plus GP...

20 Jul 1h 15min

1021: We got addicted to an AI model we can't talk about

Dax Raad, co-founder of OpenCode, joins Scott and Wes to talk remote dev servers, OpenCode 2.0, and why his team is “addicted” to AI models they’re not even allowed to name yet. Show Notes 00:00 In...

15 Jul 51min

1020: Do You Read The Code?

Auto-accept on, brain off? We’re getting into whether anyone actually reads the code they ship anymore — then it’s HTTP’s first new method in 16 years (meet QUERY) and OpenAI’s compute-hungry “Sol Ult...

13 Jul 1h 27min

1019: LGTM, Ship It: The AI Code Review Problem

This episode tackles the growing pains of AI-assisted development, from the struggle of reviewing thousands of lines of agent-generated code to the mounting technical debt when teams merge PRs without...

8 Jul 39min

1018: Google fires Workspace CLI Creator

Google fires the engineer behind its Workspace CLI tool, OpenAI previews GPT-5.6 with three new model tiers, and Astro 7 lands with a full Rust rewrite. Plus: Coinbase cuts token costs with smarter ro...

6 Jul 1h 17min

1017, We need to stop calling it “AI”

Scott and Wes raid the listener mailbag to settle the pnpm vs. npm debate, decode how web standards sneak into your browser, and ask the big one: is “AI” even intelligent, or just fancy autocomplete? ...

1 Jul 56min