Syntax - Tasty Web Development Treats16 Feb 2024

731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton

Scott and Wes are joined by security expert, Alex Sexton of Stripe to cover all things: client security, XSS, attack vectors, and CSP (content security policy). Show Notes 00:00 Welcome to Syntax! 00:31 Brought to you by Sentry.io. 00:57 Who is Alex Sexton? 04:44 Stripe dashboard is a work of art. 05:08 Tell us about the design system. React Aria 08:59 Who develops the iOS app? 09:50 Stripe’s CSP (content security policy). 12:50 What even is a content security policy? Content Security Policy explanation 13:57 Douglas Crockford of Yahoo on security. Douglas on GitHub 15:13 Security philosophy. 16:59 What about inline styles and inline JavaScript? 19:41 How do we safely set inline styles from JS? 20:20 Setting up with meta tags. 22:52 What are common situations that require security exceptions? 26:24 Potential damage with inline style tags. 32:45 Looping vulnerabilities. 36:32 What about JavaScript injection? 37:09 Myspace Samy Worm. Myspace Samy Worm Wiki Sentry.io Security Policy Reporting 42:02 Does a CSP stop code from running in the console? 43:28 What are some general security best practices? 46:35 Strategies for rolling out a CSP. 51:49 Final tip, Strict Dynamic. Strict Dynamic 56:36 Where does the CSP live within Stripe? Original Black Friday story 59:35 One last story. 01:01:20 Sick Picks + Shameless Plugs Sick Picks + Shameless Plugs Alex: Wes Bos’ Instagram Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott:X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(1053)

1053: What’s in Our Home Lab

Scott and CJ tour their homelabs, from a fully 3D printed server rack to a custom OPNsense firewall load balancing two ISPs. They dig into Proxmox, Tailscale, Caddy, Synology vs. DIY ZFS storage, Home...

4 Nov 1h 20min

1052: Github Universe Keynote Recap

Scott, Wes, and CJ report live from GitHub Universe in San Francisco, breaking down GitHub’s re-architecture for agent-scale traffic, the GitHub Copilot app, Copilot Fusion, Projects, Automations, and...

2 Nov 39min

1051: Mourning the Death of Code

Scott and Wes tackle your potluck questions, from passing context between Claude Code and Codex to whether AI-generated skills are any good. Plus high-fidelity Figma builds, WebSerial reconnects on an...

28 Okt 58min

1050 - Everyone Is Hacking Their TV

Wes, Scott, and CJ run through the week’s biggest web dev news: everyone’s hacking their TVs, VoidZero open-sourced its Void framework with Cloudflare deploys, OpenCode got hacked, and Anthropic built...

26 Okt 1h 19min

1049: WTF is a Software Factory?

Scott and Wes talk with Adam Jacob about software factories: what they actually are, why they’re unique to each team, and how to build trust in agent-generated code. They dig into Swamp Club, black bo...

21 Okt 57min

1048: Deno Is Dead

Deno is shutting down and the team is heading to Cloudflare — Scott, Wes, and CJ break down what that means for the runtime, JSR, and workerd. Plus OpenCode 2.0 on durable objects, TanStack Start 1.0,...

19 Okt 1h 40min

1047: Adobe has a big problem

Someone just clean-room ported seven Adobe apps to Rust, and Wes is shocked at how good it is. Scott and Wes break down what it gets right, what’s still missing, and why copying software is easy but i...

14 Okt 35min

1046: The Pi Updates are insane

Scott, Wes, and CJ break down the latest Pi updates, including durable long-running agents, Codemode, and MCP support, then debate whether pull requests are dead in favor of issues. Plus Supabase pick...

12 Okt 1h 40min