Wes Bos & Scott Tolinski - Full Stack JavaScript Web Developers

Zpravodajství

Technologické zprávy

Technika

705: Is Running Random Code From npm Safe? With Feross Aboukhadijeh

Syntax - Tasty Web Development Treats

Full Stack Developers Wes Bos and Scott Tolinski dive deep into web development topics, explaining how they work and talking about their own experiences. They cover from JavaScript frameworks like React, to the latest advancements in CSS to simplifying web tooling.

In this Supper Club episode of Syntax, Wes and Scott talk with Feross Aboukhadijeh about his work on Socket which helps to make sure the code you get from npm is safe and secure. They also touch on his work on Wormhole and Web Torrent. <h3>Show Notes</h3> <ul> <li><a href="#t=00:30">00:30</a> Welcome</li> <li><a href="#t=00:57">00:57</a> Who is Feross Aboukhadijeh?</li> <li><a href="#t=01:33">01:33</a> What is Socket?</li> <li>[Socket.dev](https://socket.dev</li> <li><a href="https://github.com/dominictarr">dominictarr (Dominic Tarr)</a></li> <li><a href= "https://github.com/pull-stream/pull-stream">pull-stream/pull-stream: minimal streams</a></li> <li><a href="#t=03:59">03:59</a> Introducing AI package summaries</li> <li><a href="https://socket.dev/npm/package/lodash">Example of the AI summaries</a></li> <li><a href= "https://socket.dev/blog/introducing-ai-package-summaries">Introducing AI Package Summaries</a></li> <li><a href="#t=07:04">07:04</a> Is Socket’s focus on visibility of a open source project?</li> <li><a href="#t=10:01">10:01</a> What was the inspiration for Socket?</li> <li><a href= "https://socket.dev/blog/introducing-safe-npm">Introducing “safe npm”, a Socket npm Wrapper - Socket</a></li> <li><a href="#t=16:22">16:22</a> How does Socket detect possible security issues?</li> <li><a href="https://socket.dev/npm/category/removed">Removed packages</a></li> <li><a href= "https://socket.dev/npm/package/event-source-polyfill/diff/1.0.26">event-source-polyfill protestware attack</a></li> <li><a href= "https://socket.dev/blog/npm-registry-spam-john-wick">john wick spam attack</a></li> <li><a href="#t=18:55">18:55</a> How many projects are you injesting for Socket to scan?</li> <li><a href="#t=26:00">26:00</a> What kinds of things are people trying to inject in code?</li> <li><a href="https://cs253.stanford.edu/">CS253 Web Security</a></li> <li><a href="#t=29:54">29:54</a> How do I hook Socket up to my project or GitHub?</li> <li><a href="#t=32:08">32:08</a> Do we still need to use shrink wrap?</li> <li><a href="#t=36:34">36:34</a> How did you implement the torrent spec in JavaScript for WebTorrent?</li> <li><a href="https://webtorrent.io/desktop/">WebTorrent Desktop</a></li> <li><a href="https://webtorrent.io/faq">WebTorrent FAQ</a></li> <li><a href="#t=43:11">43:11</a> Why did you build Wormhole?</li> <li><a href="https://wormhole.app/">Wormhole</a></li> <li><a href="#t=47:33">47:33</a> How expensive is it to maintain Wormhole?</li> <li><a href="https://riverside.fm/">Riverside.fm - Record Podcasts And Videos From Anywhere</a></li> <li><a href="#t=50:37">50:37</a> What do you think of decentralized code repos?</li> <li><a href="https://radicle.xyz/">Radicle</a></li> <li><a href= "https://www.chromium.org/teams/web-capabilities-fugu/">Project Fugu</a></li> <li><a href="https://fugu-tracker.web.app/">Fugu Tracker</a></li> <li><a href="#t=54:29">54:29</a> Understanding passkeys</li> <li><a href="#t=56:15">56:15</a> Supper Club questions</li> <li><a href= "https://marketplace.visualstudio.com/items?itemName=GitHub.github-vscode-theme"> GitHub Theme - Visual Studio Marketplace</a></li> <li><a href= "https://developer.mozilla.org/en-US/docs/Web/API/Web_Serial_API">Web Serial API - Web APIs | MDN</a></li> <li><a href="#t=01:03:04">01:03:04</a> Sick Picks</li> </ul> <h3>Sick Picks</h3> <ul> <li><a href= "https://www.audible.com/search?searchNarrator=Jim+Dale&page=1&ref_pageloadid=Y232dKyXJGQwY3D1&ref=a_search_c4_pageBack&pf_rd_p=1d79b443-2f1d-43a3-b1dc-31a2cd242566&pf_rd_r=7R36W9E563TXEW646N1V&pageLoadId=pPGcJ2msQJM8cETD&ref_plink=not_applicable&creativeId=18cc2d83-2aa9-46ca-8a02-1d1cc7052e2a"> Harry Potter audio books</a></li> </ul> <h3>Shameless Plugs</h3> <ul> <li><a href="https://chat.openai.com/auth/login">ChatGPT</a></li> </ul> <h3>Hit us up on Socials!</h3> Syntax: <a href="https://twitter.com/syntaxfm">X</a> <a href= "https://www.instagram.com/syntax_fm/">Instagram</a> <a href= "https://www.tiktok.com/@syntaxfm">Tiktok</a> <a href= "https://www.linkedin.com/company/96077407/admin/feed/posts/">LinkedIn</a> <a href="https://www.threads.net/@syntax_fm">Threads</a> Wes: <a href="https://twitter.com/wesbos">X</a> <a href= "https://www.instagram.com/wesbos/">Instagram</a> <a href= "https://www.tiktok.com/@wesbos">Tiktok</a> <a href= "https://www.linkedin.com/in/wesbos/">LinkedIn</a> <a href= "https://www.threads.net/@wesbos">Threads</a> Scott: <a href="https://twitter.com/stolinski">X</a> <a href= "https://www.instagram.com/stolinski/">Instagram</a> <a href= "https://www.tiktok.com/@stolinski">Tiktok</a> <a href= "https://www.linkedin.com/in/stolinski/">LinkedIn</a> <a href= "https://www.threads.net/@stolinski">Threads</a>

In this Supper Club episode of Syntax, Wes and Scott talk with Feross Aboukhadijeh about his work on Socket which helps to make sure the code you get from npm is safe and secure. They also touch on his work on Wormhole and Web Torrent.
 Show Notes 
00:30 Welcome

00:57 Who is Feross Aboukhadijeh?

01:33 What is Socket?
 [Socket.dev](https://socket.dev
 dominictarr (Dominic Tarr)
 pull-stream/pull-stream: minimal streams

03:59 Introducing AI package summaries
 Example of the AI summaries
 Introducing AI Package Summaries

07:04 Is Socket’s focus on visibility of a open source project?

10:01 What was the inspiration for Socket?
 Introducing “safe npm”, a Socket npm Wrapper - Socket

16:22 How does Socket detect possible security issues?
 Removed packages
 event-source-polyfill protestware attack
 john wick spam attack

18:55 How many projects are you injesting for Socket to scan?

26:00 What kinds of things are people trying to inject in code?
 CS253 Web Security

29:54 How do I hook Socket up to my project or GitHub?

32:08 Do we still need to use shrink wrap?

36:34 How did you implement the torrent spec in JavaScript for WebTorrent?
 WebTorrent Desktop
 WebTorrent FAQ

43:11 Why did you build Wormhole?
 Wormhole

47:33 How expensive is it to maintain Wormhole?
 Riverside.fm - Record Podcasts And Videos From Anywhere

50:37 What do you think of decentralized code repos?
 Radicle
 Project Fugu
 Fugu Tracker

54:29 Understanding passkeys

56:15 Supper Club questions
 GitHub Theme - Visual Studio Marketplace
 Web Serial API - Web APIs | MDN

01:03:04 Sick Picks
 Sick Picks  Harry Potter audio books
 Shameless Plugs ChatGPT
 Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads
 Wes: X Instagram Tiktok LinkedIn Threads
 Scott: X Instagram Tiktok LinkedIn Threads

Aplikace Youradio Talk

705: Is Running Random Code From npm Safe? With Feross Aboukhadijeh

Poslechněte si podcast