TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Avsnitt(735)

Introducing Codux With Nadav Abrahami & Tom Raviv - JSJ 573

Introducing Codux With Nadav Abrahami & Tom Raviv - JSJ 573

Nadav Abrahami Co-Founder & Head of Innovation at Wix. Tom Raviv is Head of Developer Relations for Codux.com & Team Lead on Stylable.io. They join the show to talk about the recent release of, "Codux", the first visual IDE for React. They begin the episode as they talk about how they came about building the tool and their experience. Moreover, they talk about its features, components, and impact on users Sponsors Chuck's Resume Template Developer Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksCodux | Visual IDE for ReactMeet CoduxTwitter: @CoduxIDETwitter: @NadavWixTwitter: @RavivTomPicksAJ - Earthing PadAJ - Speed ControllerAJ - Beyond Code Beta Course WorkshopsDan - 15: The Meta Framework Revolution with Dan Shappir by FedBitesDan - The ongoing war in UkraineNadav - Kung Fu for EngineersSteve - Hinshark Bluetooth BeanieTom - The Legend of Vox MachinaSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

14 Mars 20231h 13min

Build Your Game Using JavaScript with Andrzej Mazur- JSJ 572

Build Your Game Using JavaScript with Andrzej Mazur- JSJ 572

Andrzej Mazur is a HTML5 Game Developer. He joins the show alongside AJ and Chuck to talk about creating games in JavaScript. He begins by outlining his past and current experiences as a game developer. He offers some of his techniques to individuals who want to start developing web games.Sponsors Chuck's Resume Template Developer Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksENCLAVE GAMESjs13kGamesGamedev.jsGamedev.js weeklyGamedev.js WarszawaFOREST CUTIESEnclaveGames/Enclave-Phaser-TemplateOpenGameArtUnity Asset StoreKenney Game AssetsGlobal Game Jamwebinstall.dev/aliasmanGitHub: end3rLinkedIn: Andrzej MazurTwitter: @end3rPicksAJ - OC RemixAJ - Ballarini (Granitium Non-Stick Cookware) setAJ - Utility Series Keychain KnifeAJ - EDC Fans Keychain KnifeAndrzej - NeuroshimaHex.plAndrzej - Gamedev.js Jam 2022Andrzej - PhaserChuck - Mysterium Chuck - Hold on to people you care about! Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

7 Mars 20231h 20min

The State of JS Frameworks with Ryan Carniato: Part 2 - JSJ 571

The State of JS Frameworks with Ryan Carniato: Part 2 - JSJ 571

Ryan Carniato is the Principal Engineer OSS at Netlify. He is the author of the SolidJS UI library. He joins the show to talk about where the JavaScript Frameworks are headed. They share their insights on the changes that occurred in React. Additionally, they talk about their perspective on React and other JavaScript frameworks. On YouTubeThe State of JS Frameworks with Ryan Carniato: Part 2 - JSJ 571Sponsors Chuck's Resume TemplateDeveloper Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksRyan Carniato - DevRyan Carniato | YouTubeTwitter: @RyanCarniatoAJ ONeal - GitPicksAJ - ChatGPT-DanRyan - React.js: The Documentary - How it All BeganSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

28 Feb 202350min

The State of JS Frameworks with Ryan Carniato: Part 1 - JSJ 570

The State of JS Frameworks with Ryan Carniato: Part 1 - JSJ 570

Ryan Carniato is the Principal Engineer OSS at Netlify. He is the author of the SolidJS UI library. He joins the show to talk about where the JavaScript Frameworks are headed. They share their insights on the changes that occurred in React. Additionally, they talk about their perspective on React and other JavaScript frameworks. Sponsors Chuck's Resume TemplateDeveloper Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksRyan Carniato - DevRyan Carniato | YouTubeTwitter: @RyanCarniatoSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

21 Feb 20231h 3min

Web Performance With Alex Russell - JSJ 569

Web Performance With Alex Russell - JSJ 569

Alex Russell is the Partner Product Manager on Microsoft Edge. He joins the show to talk about web framework performance. He starts out by going over a few examples of user interactions from various web applications and how they affect their performance. Moreover, he gets into detail about the article he wrote, "The Performance Inequality Gap, 2023".Sponsors Chuck's Resume TemplateDeveloper Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksA Management Maturity Model for PerformanceThe Performance Inequality Gap, 2023Depth-and-frequencymulti-core scoressingle core scoresInfrequently NotedGitHub: slightlyoffTwitter: @slightlylatePicks AJ - webinstall.dev/vim-aleAlex - open web advocacyCharles - Harry Potter: Death Eaters Rising Charles - ARETE MEANS EXCELLENCEDan - Dan Shappir at @JSJabber Web Dev podcast PollSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

14 Feb 20231h 26min

React Native & Every-Platform Embeddable UI With Taz Singh - JSJ 568

React Native & Every-Platform Embeddable UI With Taz Singh - JSJ 568

Taz Singh is the Founder of Guild. It is an all-in-one platform for Events, Presentations, and Discussions designed to reduce the burden as communities scale. He joins the show to talk about Guild and React Native. He begins by discussing his journey toward how he was able to create his company. He talks about their goals and what sets them apart from other platforms. Additionally, they tackle developing applications using React Native. About This EpisodeFuture projects for GuildUsing React Native to develop apps for MobileUsing React Native to develop apps for WebTamaguiSponsorsChuck's Resume TemplateDeveloper Book ClubBecome a Top 1% Dev with a Top End Devs MembershipLinksGuildTamagui — React Native + Web UI kitTaz SinghLinkedIn: Taz SinghGitHub: tazsinghTwitter: @tazsinghTwitter: @guild__hostPicksAJ - AJScript ( (Moving to GPTScript)AJ - SNOWFLAKES ARE REAL!Charles - Top End DevsDan - TypeScript 5.0 Beta Deep DiveDan - React Streaming In Depth: NextJS! Remix! DIY!Taz - GuildSupport this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

8 Feb 20231h 32min

Providing The Best User Experiences on the Web With Vercel- BONUS

Providing The Best User Experiences on the Web With Vercel- BONUS

Lee Robinson is the VP of Developer Experience at Vercel. Vercel is the platform for frontend developers, providing the speed and reliability innovators need to create at the moment of inspiration. He joins Chuck on the show to talk about NextJS 13 and their company. He goes into great detail about how they continue to offer the finest user and development experience. Additionally, they talk about Vercel's features. LinksVercelNext.js Conf Keynote: Introducing Next.js 13 and TurbopackVercel Analytics: Real-time Insights, Peak PerformanceLee RobinsonLinkedIn: Lee RobinsonTwitter: @leeerob Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

3 Feb 202334min

Front-End Hydration - JSJ 567

Front-End Hydration - JSJ 567

Dan Shappir takes the lead for this week's panelist episode as he talks about hydration. Hydration is the technique of using client-side JavaScript to enhance server-rendered HTML with application state and interaction. In the context of Web performance, he explains why it is regarded as such an issue and its impact.The second part of this episode is reviewing various ways in which modern frameworks, such as Qwik, Astro, Remix, and NextJS are trying to alleviate the impact of hydration:Avoiding frameworks, to begin withFaster hydration, e.g. Svelte, SolidProgressive enhancement, e.g. RemixHydration slicing (+ progressive enhancement), e.g. Remix + React 18 (time slicing / isInputPending)Islands of hydration, e.g. Astro, FreshServer Components, e.g. NextJS 13 React Server Components (SPA and streaming)Resumability, e.q. Qwik, MarkoSponsorsChuck's Resume TemplateDeveloper Book Club starting with Clean Architecture by Robert C. MartinBecome a Top 1% Dev with a Top End Devs MembershipLinksBeyond Code Bootcamp: HomeApril 24 - 27, 2023 - JavaScript Conference LondonJSNation Conference 2023Qwik Part II With Misko Hevery - JSJ 563Mastering Linux Shell ScriptingThe Linux Command Line, 2nd Edition: A Complete IntroductionPicksAJ - Animal CrossingAJ - Yoshi's Crafted World™Charles- Harry Potter: Death Eaters Rising Dan - Don't Learn TypeScriptDan - JavaScript Frameworks in 2023Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

31 Jan 20231h 40min

Populärt inom Business & ekonomi

framgangspodden
badfluence
varvet
rss-borsens-finest
rss-jossan-nina
dynastin
avanzapodden
bathina-en-podcast
uppgang-och-fall
fill-or-kill
svd-tech-brief
rikatillsammans-om-privatekonomi-rikedom-i-livet
rss-placerapodden
kapitalet-en-podd-om-ekonomi
rss-svart-marknad
rss-veckans-trade
rss-borslunch
ekonomiekot-extra
rss-inga-dumma-fragor-om-pengar
tabberaset