TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Episoder(735)

The Rise of No Code: A Deep Dive into Toddle's Revolutionary Web App Platform - JSJ 612

The Rise of No Code: A Deep Dive into Toddle's Revolutionary Web App Platform - JSJ 612

Andreas Møller is a software engineer and the creator of Toddle, a platform that lets you build web applications without traditional code. They dive into the world of web development and the exciting rise of no-code and low-code approaches. They discuss the power and complexity of Toddle, its unique visual programming language, and how it enables efficient web development. They talk about the nitty-gritty of visual programming and the complexities of version control, so stick around and join us for this deep dive into the ever-evolving world of web development.SponsorsChuck's Resume Template Raygun - Application Monitoring For Web & Mobile AppsMiroBecome a Top 1% Dev with a Top End Devs MembershipLinksToddle SocialsLinkedIn: Andreas MøllerPicksAJ - A Man Called OttoAJ - Jonathan BlowDan - Dan's tweet about Jesus being a Jew from JudeaDan - Lucky Hank TV showSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

19 Des 20231h 21min

Monitoring Performance and Core Web Vitals ft. Bianca Grizhar and Sumitra Manga  - JSJ 611

Monitoring Performance and Core Web Vitals ft. Bianca Grizhar and Sumitra Manga - JSJ 611

Bianca and Sumitra from Raygun join the panel to talk about Core Web Vitals and how tools like Raygun can help keep tabs on and monitor your performance stats as you change your web application to get you better results on Google.SponsorsChuck's Resume Template MiroBecome a Top 1% Dev with a Top End Devs MembershipLinksCrUX and Core Web Vitals – What to Measure on the Web with Rick Viscomi – JSJ 486JSJ 477: Understanding Search Engines and SEO (for devs) – Part 2Opinionated Core Web Vitals – JSJ 495Twitter: Raygun ( @raygunio )LinkedIn: Bianca GrizharLinkedIn: Sumitra MangaPicksAJ- How to ADHD - YouTubeAJ- The Biggest Myth In Education - YouTubeAJ- Brave SearchAJ- GitHub | go-gitea/giteaBianca- How to monitor and optimize Core Web Vitals - YouTubeCharles- Level Up | Devchat.tvCharles- Rhythm of WarDan- Is our universe the only universe? - Brian Greene - YouTubeSumitra- Formula 1: Drive to SurviveSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

12 Des 20231h 22min

Bit: Paving the Way for Component Management - JSJ 610

Bit: Paving the Way for Component Management - JSJ 610

Gilad Shoham is a developer and open-source leader at Bit. They explore the latest trends and insights in the world of development and technology. The conversation also delves into the complexities of managing and sharing software components, detailing the challenges and potential solutions, and exploring innovative ways to manage components and share code.SponsorsChuck's Resume Template Raygun - Application Monitoring For Web & Mobile AppsMiroBecome a Top 1% Dev with a Top End Devs MembershipLinksdira-lehaskilBit SocialsLinkedIn: Gilad ShohamTwitter: @ShohamGiladPicksAJ - Batman BeginsAJ - Mario Kart 8 DeluxeAJ - AlbaniaAJ - PrimeagenSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

5 Des 20231h 21min

Discovering ElysiaJS and The Duality of TypeScript and JavaScript - JSJ 609

Discovering ElysiaJS and The Duality of TypeScript and JavaScript - JSJ 609

SaltyAom is a cosplayer, developer, and creator of ElysiaJS. They deep dive into the complexities of JavaScript and TypeScript, offering insights into backend development, performance optimizations, and the evolving landscape of these programming languages.SponsorsChuck's Resume Template MiroBecome a Top 1% Dev with a Top End Devs MembershipLinksElysia.JSTwitter: @elysiaJSSocialsGitHub: SaltyAomTwitter: @saltyAomPicksAJ - Metal Shower Head HolderAJ - Super Mario RPGAJ - ThePrimeagenAJ - Zig (via Webi)Charles - AstraCharles - HoneybadgerSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

27 Nov 20231h 30min

How To Recession Proof Your Job - BONUS

How To Recession Proof Your Job - BONUS

Get the Black Friday/Cyber Monday "Double Your Productivity by 5pm Today" DealCoupon Code: "THRIVE" for a GIANT discountAre you looking at all the layoffs and uncertainty going on and wondering if your company is the next to cut back? Or, maybe you're a freelancer or entrepreneur who is trying to figure out how to deliver more value to gain or retain customers?Mani Vaya joins Charles Max Wood to discuss the one thing that both of them use to more than double their productivity on a daily basis.Mani has read 1,000's of productivity books over the last several years and has formulated a methodology for getting more done, but found that he lacked the discipline to follow through on his plans.The he found the one thing that kept him on track and made him so productive that he is now getting all of his work done and was able to live the life he wants.Chuck also weighs in on how Mani's technique has worked for him and allows him to spend more time with his wife and kids, run a podcast network, and a nearly full time contract.Join the episode to learn how Chuck and Mani get into a regular flow state with their work and consistently deliver at work.Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

21 Nov 20231h 12min

Next-Level Web Performance with Patrick Meenan - JSJ 608

Next-Level Web Performance with Patrick Meenan - JSJ 608

Patrick Meenan works at Google Chrome. They explore the latest techniques in web performance and optimization. They dive deep into the world of asset compression and delivery optimization. They also explore the challenges and considerations when it comes to bundling, caching, delta updates, and many more!SponsorsChuck's Resume Template Raygun - Application Monitoring For Web & Mobile AppsBecome a Top 1% Dev with a Top End Devs MembershipSocialsLinkedIn: Patrick MeenanTwitter: @patmeenanPicksCharles - Living Forest | Board GameDan - Twitter: @DanShappirDan - Quora | Dan ShappirPatrick - Web Conferences AmsterdamSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

21 Nov 20231h 13min

RPC Resurgence: From Client-Server Applications to Next.js and Meta Frameworks - JSJ 607

RPC Resurgence: From Client-Server Applications to Next.js and Meta Frameworks - JSJ 607

AJ, Chuck, and Dan join this week's panelist episode. They dive into the resurgence of RPC (Remote Procedure Call) in JavaScript frameworks and the potential benefits and drawbacks of combining front-end and back-end code. They navigate the complexities and possibilities of modern development practices.SponsorsChuck's Resume Template Developer Book Club Become a Top 1% Dev with a Top End Devs MembershipPicksAJ - Zen of PythonAJ - OllamaAJ - Fastest Alone, Farthest TogetherAJ - WebiCharles - First Rat | Board GameCharles - First RatCharles - The Ultimate Business Tune UpSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

14 Nov 20231h 39min

Mastering ORM with TypeScript - JSJ 606

Mastering ORM with TypeScript - JSJ 606

Lars-Erik Roald is a software developer at Systor. He shares his insights and experiences in creating ORM and the evolution of the technology. They dive into the world of ORMs, TypeScript, and a variety of programming and personal ventures. From discussions about the challenges and advantages of ORMs and navigating the complexities of TypeScript to lighthearted banter about swimming, triathlon training, and even some dad jokesSponsorsMiroRaygun - Application Monitoring For Web & Mobile AppsBecome a Top 1% Dev with a Top End Devs MembershipLinksalfateam/rdbSocialsTwitter: Lars-Erik RoaldGitHub: Lars-Erik RoaldPicksCharles - TimpCon 2023Charles - AkropolisSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

7 Nov 202357min

Populært innen Business og økonomi

stopp-verden
dine-penger-pengeradet
rss-penger-polser-og-politikk
e24-podden
lydartikler-fra-aftenposten
rss-borsmorgen-okonominyhetene
pengepodden-2
utbytte
tid-er-penger-en-podcast-med-peter-warren
pengesnakk
morgenkaffen-med-finansavisen
lederpodden
rss-markedspuls-2
rss-investering-gjort-enkelt
voksenpoeng-en-guide-til-voksenlivet
finansredaksjonen
livet-pa-veien-med-jan-erik-larssen
rss-finanslunsj
okonomiamatorene
paretopodden