TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Episoder(735)

JSJ 457: Career Transitioning with Laura Harvey

JSJ 457: Career Transitioning with Laura Harvey

This week the panel talks with a UK boot camp student about her decision to switch careers and learn to program. They discuss unique challenges such as being part of an underrepresented group and entering the field during a pandemic. Additionally, they discuss technology choices and overall, seek to gain a deeper understanding of the state of JavaScript for new developers.SponsorsRaygun | Click here to get started on your free 14-day trialAudible.comCacheFlyPanelAimee KnightDan ShappirSteve EdwardsSpecial GuestLaura HarveyPicksAimeeGoReleaserhttps://www.purpose.jobs/blog/hiring-tech-jobs-has-increased-in-midwestern-citiesDanTechnical Tweetstwitter.com/kentcdodds/statusLaura Harveyhttps://www.youtube.com/channel/lauracharveyhttps://dev.to/lauracharvey Follow JavaScript Jabber on Twitter: @JSJabber Special Guest: Laura Harvey.Sponsored By:Raygun: Raygun now offers Real User Monitoring of Core Web Vitals. Start your 14-day free trial now.Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

10 Nov 202057min

JSJ 456: Developer-First Security and Security Tooling For Developers with Liran Tal & Brian Vermeer

JSJ 456: Developer-First Security and Security Tooling For Developers with Liran Tal & Brian Vermeer

Liran Tal and Brian Vermeer from Snyk join the panel to discuss development of secure software in general, and secure JavaScript and web dev in particular. They explain what developer-first security actually means, and the types of security vulnerabilities to watch out for when using modern tools to develop websites and web apps. They also present several Open Source tools that developers can use to improve their code right from within their favorite development environments and IDEs.SponsorsAudible.comCacheFlyPanelAJ ONealAimee KnightDan ShappirSpecial GuestsLiran TalBrian VermeerLinksHttps://www.webpagetest.orghttps://snyk.io/security-scanner-vuln-cost/https://marketplace.visualstudio.com/items?itemName=wix.vscode-import-costPicksDanadd Alt Texts when tweeting code on twitter as an image,https://www.goodreads.com/series/46817-demon-cycleAJZalgohttps://www.cnet.com/news/the-shirt-with-the-most-incredible-amazon-reviews/The Friendly, Interactive ShellTomorrow Night Theme (Terminal, iTerm2, VSCode, vim, etc)Dracula Themehttps://github.com/JacksonGariety/toy-chest-themeJeff BezosLiran Talhttps://starship.rs/https://vuetifyjs.com/en/Pact frameworkhttps://docs.pact.io/https://en.wikipedia.org/wiki/RemoteAccessBrianhttps://carbon.now.sh/https://en.wikipedia.org/wiki/The_Umbrella_Academy_(TV_series) Follow JavaScript Jabber on Twitter: @JSJabber Special Guests: Brian Vermeer and Liran Tal. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

3 Nov 20201h 6min

JSJ 455: Introducing and Understanding Svelte and Sapper with Mark Volkmann

JSJ 455: Introducing and Understanding Svelte and Sapper with Mark Volkmann

This week the panel is joined by Mark Volkmann to discuss Svelte and how it compares and differs from front-end frameworks such as React and Angular. Mark has written a book and has given talks about Svelte and also about Sapper, an application framework built on top of Svelte. He explains to the panel how Svelte components are defined differently than other JavaScript frameworks, and how they are actually compiled into the production code, which isn’t dependent on any external libraries. He also explains why and how Svelte forgoes the use of a virtual DOM, using direct DOM manipulations instead. Finally he describes Sapper and explains how it can be used to quickly and easily create Web-apps that use SSR, static pages generation and dynamic routing.SponsorsFaithlife | Now Hiring Software DevelopersRaygun | Click here to get started on your free 14-day trialAudible.comCacheFlyPanelAimee KnightDan ShappirSteve EdwardsSpecial GuestMark VolkmannLinkshttps://github.com/sveltejs/svelte/issues/2546https://mvolkmann.github.io/blog/https://objectcomputing.com/resources/publications/mark-volkmannhttps://www.manning.com/books/svelte-and-sapper-in-actionPicksSteveKey Largohttps://gbdeclaration.org/AimeeLow Level AcademyTerraform Up and RunningDanMy daughter enlisting in the Israeli Militarywww.amazon.com/The-Boys-Season-1Mark Volkmannhttps://www.meteor.com/https://mvolkmann.github.io/blog/ Follow JavaScript Jabber on Twitter: @JSJabber Special Guest: Mark Volkmann.Sponsored By:Raygun: Raygun now offers Real User Monitoring of Core Web Vitals. Start your 14-day free trial now.Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

27 Okt 202056min

JSJ 454: Mongoose, Mongo and Object Document Mapping (ODM) with Valeri Karpov

JSJ 454: Mongoose, Mongo and Object Document Mapping (ODM) with Valeri Karpov

We talk about the Pros and Cons of using a database directly vs using an abstraction layer, common mistakes, optimistic concurrency, and a nice tangent into programming concurrency models to top it off.SponsorsFaithlife | Now Hiring Software DevelopersAudible.comCacheFlyPanelAJ ONealAimee KnightCharles Max WoodSteve EdwardsSpecial GuestValeri KarpovLinkshttps://en.wikipedia.org/wiki/Aspect-oriented_programminghttps://mongoosejs.com/PicksStevehttps://cesf.us/AimeeThe Cloud Girl Sketch NotesAJGraphQurlAPC UPS with USBCyberPower UPSGoogle Lighthouse overstepFrog ChessWSL (Windows Subsystem for Linux)Chuckhttp://podcastgrowthsummit.co/http://podcastplaybook.co/mostvaluable.devStormlight ArchiveValeri Karpovhttps://masteringjs.io/ebooks/mastering-mongoose-javascript-jabberhttps://www.npmjs.com/package/archetypeamazon.com/Cryptonomicon-Neal-Stephenson Follow JavaScript Jabber on Twitter: @JSJabber Special Guest: Valeri Karpov. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

20 Okt 202054min

JSJ 453: Debugging Third Party JavaScript with Ben Vinegar

JSJ 453: Debugging Third Party JavaScript with Ben Vinegar

Podcast: Play in new window | Download Many websites these days have to deal with the reality of incorporating third-party scripts. These could be tracking scripts or analytics or monitoring, or even scripts that add explicit features to a site, such as chat. Regardless of the purpose, such scripts add complexity and overhead, and can interfere with the proper operation of the site. In this episode Ben Vinegar, VP of engineering at Sentry, joins the panel to discuss the complexities and implications of third-party scripts, both from the perspective of website developers, as well as from the perspective of the developers creating such scripts.SponsorsFaithlife | Now Hiring Software DevelopersRaygun | Click here to get started on your free 14-day trialAudible.comCacheFlyPanelAJ ONealAimee KnightDan ShappirCharles Max WoodSpecial GuestBen VinegarLinksETAG Cookieshttps://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elementsPicksAimeehttps://github.com/hwayne/awesome-cold-showersAJAJQuery v2.0https://webinstall.dev/sdDropbox PaperWoody Zuill on Mob Programming and Influencing Change | Healthy Developer Interview #4Charles Max WoodScythehttps://www.thecreepyline.com/Ben Vinegarhttps://workers.cloudflare.com Follow JavaScript Jabber on Twitter: @JSJabber Special Guest: Ben Vinegar.Sponsored By:Raygun: Raygun now offers Real User Monitoring of Core Web Vitals. Start your 14-day free trial now.Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

13 Okt 202016min

JSJ 452: Caddy 2 Web Server with Matthew Holt

JSJ 452: Caddy 2 Web Server with Matthew Holt

Today the panel talks with Matt Holt who works full time on the Caddy Web Server. The panel discusses things such as how it compares to other popular tools as well as lessons learned while working on it.SponsorsFaithlife | Now Hiring Software DevelopersThe Complete Software Developer’s Career Guide – Grab a Copy TodayAudible.comCacheFlyPanelAJ ONealAimee KnightCharles Max WoodSpecial GuestMatthew HoltLinkshttps://www.papaparse.com/OSI modelhttps://apilayer.com/https://github.com/mholtPicksAimeeCloud flare ball indication sectionLearning about other culturesAJhttps://webinstall.dev/caddy/https://webinstall.dev/serviceman/https://insights.stackoverflow.com/survey/2020https://www.beyondcodebootcamp.com/CharlesMost Valuable Programmer (MVP Program)https://podcastplaybook.coLightbringer seriesMatthew HoltSourcegraph Follow JavaScript Jabber on Twitter: @JSJabber Special Guest: Matthew Holt. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

6 Okt 20201h 12min

JSJ 451: Are Software Bugs Inevitable with Ran Levi

JSJ 451: Are Software Bugs Inevitable with Ran Levi

Ran Levy, a well known and prolific technology podcaster joins the show to talk with the panel about software bugs. Topics of discussion include the inevitability of software bugs – are they an intrinsic part of software development? Also, can they be minimized and their impact mitigated? And what can software companies, and the developers themselves, do in order to deliver properly working software.SponsorsRaygun | Click here to get started on your free 14-day trialThe Complete Software Developer’s Career Guide – Grab a Copy TodayFaithlife | Now Hiring Software DevelopersCacheFlyPanelCharles Max WoodAJ ONealAimee KnightDan ShappirSteve EdwardsSpecial GuestRan LeviLinksAre Software Bugs Inevitable?The Wix Engineering PodcastPicksDanThe Explosion of the Ariane 5Mars Climate OrbiterAJMagic Keyboard & Trackpad 2Final Fantasy 1GameCube + GBA + HDMIHomebrew GuideCharles Max WoodMUDList of MUDs Follow JavaScript Jabber on Twitter: @JSJabber Special Guest: Ran Levi.Sponsored By:Raygun: Raygun now offers Real User Monitoring of Core Web Vitals. Start your 14-day free trial now.Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

29 Sep 20201h 19min

JSJ 450: Native Features Inside The Browser - Introducing Google's Project Fugu with Thomas Steiner

JSJ 450: Native Features Inside The Browser - Introducing Google's Project Fugu with Thomas Steiner

For Web apps to be useful and successfully compete with native applications, they need to be able to access device features, such as the camera, local file system, Bluetooth, and more. Obviously such a mechanism needs to be secure and respect user privacy. In this episode Thomas Steiner, a Developer Advocate for the Web at Google, joins to discuss Project Fugu, and the benefits and capabilities that it already provides, and will provide in the future. Thomas, who is actively involved in this project, explains the design and development process for this project, and how it’s being rolled out and tested.SponsorsRaygun | Click here to get started on your free 14-day trialThe Complete Software Developer’s Career Guide – Grab a Copy TodayAudible.comCacheFlyPanelCharles Max WoodAJ ONealAimee KnightDan ShappirSteve EdwardsSpecial GuestThomas SteinerLinksWICGWake LockChrome Origin Trials GatekeepingMicrosoft Origin TrialsWebOTPPicksAimee Knighthttps://github.com/lebinh/nginx-confSteveGod’s Battalions: The Case for the CrusadesAJwebinstall.dev/comrakThomashttps://excalidraw.com/xxx Follow JavaScript Jabber on Twitter: @JSJabber Special Guest: Thomas Steiner.Sponsored By:Raygun: Raygun now offers Real User Monitoring of Core Web Vitals. Start your 14-day free trial now.Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

22 Sep 202053min

Populært innen Business og økonomi

stopp-verden
dine-penger-pengeradet
lydartikler-fra-aftenposten
e24-podden
rss-borsmorgen-okonominyhetene
rss-penger-polser-og-politikk
utbytte
finansredaksjonen
tid-er-penger-en-podcast-med-peter-warren
pengepodden-2
morgenkaffen-med-finansavisen
okonomiamatorene
lederpodden
pengesnakk
rss-finansforum-2
rss-investering-gjort-enkelt
rss-fa-makro
livet-pa-veien-med-jan-erik-larssen
lederskap-nhhs-podkast-om-ledelse
rss-andelige-tanker-med-camillo