JS Party: JavaScript, CSS, Web Development

Party on PartyKit

With a name like PartyKit, you know we just had to get its founder and CEO Sunil Pai on the show! PartyKit is an open source tool that simplifies creating collaborative, multiplayer applications. Join us to learn all about it and the journey of Sunil and his team! Leave us a comment Changelog++ members get a bonus 4 minutes at the end of this episode and zero ads. Join today! Sponsors: Appwrite – Build Fast. Scale Big. All in One Place. Appwrite is a backend platform for developing Web, Mobile, and Flutter applications. Built with the open source community and optimized for developer experience in the coding languages you love. Featuring: Sunil Pai – Twitter, GitHub, LinkedIn, WebsiteAmal Hussein – Twitter, GitHubKevin Ball – Twitter, GitHub, LinkedIn, WebsiteChristopher Hiller – Mastodon, Twitter, GitHub, Website Show Notes: PartyKit PartyKit source code PartyKit pre-seed funding internal announcement PartyKit Tech Crunch pre-seed funding announcement TLDraw - a collaborative digital whiteboard TLDraw source code CRDTs - Conflict-free replicated data Yjs - A CRDT framework with a powerful abstraction of shared data Vite conf PartyKit at Vite Conf Cloudflare Durable Objects Cloudflare CDN XState - is a state management and orchestration solution for JavaScript and TypeScript apps Stately - a visualization platform for XState machines Drifting in Space Live Blocks Something missing or broken? PRs welcome! Timestamps: (00:00) - It's party time, y'all(00:39) - Sponsor: Appwrite(03:11) - Welcoming Sunil(05:37) - Getting to know Sunil(11:33) - Sunil on immigration(14:11) - What is PartyKit?(31:22) - How Cloudflare primitives help(36:25) - On durable objects(39:28) - More players is good(40:48) - PartyKit's value prop(43:30) - EVERYONE in the world(48:33) - The developer experience(52:19) - Success stories(59:09) - Is npm necessary?(1:05:22) - Audio/video plans(1:07:05) - Let's talk pricing(1:08:40) - Company structure(1:11:42) - On raising funds(1:16:28) - Game SDKs(1:18:29) - Talking to young Sunil(1:21:24) - Connecting with Sunil(1:22:35) - Next up on the pod

Reflecting on Bun's big launch

Fresh off Bun’s big 1.0 launch, Jarred Sumner goes one-on-one with Jerod to discuss the all-in-one JavaScript runtime that’s captured the interest of many. We get into it all: what problem he’s solving, how it’s so fast, why no Windows support, answering the critics, the (not real) beef between Bun and Node, how the VC-backed startup will sustain & more. Leave us a comment Changelog++ members save 4 minutes on this episode because they made the ads disappear. Join today! Sponsors: Appwrite – Build Fast. Scale Big. All in One Place. Appwrite is a backend platform for developing Web, Mobile, and Flutter applications. Built with the open source community and optimized for developer experience in the coding languages you love. Changelog News – A podcast+newsletter combo that’s brief, entertaining & always on-point. Subscribe today. Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs. Featuring: Jarred Sumner – Twitter, GitHubJerod Santo – Mastodon, Twitter, GitHub, LinkedIn Show Notes: Bun — A fast all-in-one JavaScript runtime Why Bun is going to “be the biggest problem” for Deno Bun hype. How we learned nothing from Yarn Bun Careers Something missing or broken? PRs welcome! Timestamps: (00:00) - It's party time, y'all(00:53) - Welcoming Jarred to the show(01:45) - Surprised by the success?(02:27) - Why so much interest?(03:07) - What problem was he trying to solve?(05:49) - Why Zig?(08:19) - Is Zig a barrier to contributing?(11:22) - What goes in to a 1.0?(12:30) - Less critics than expected?(13:49) - What about Windows support?(14:34) - What's the state of Node compat?(15:59) - Sponsor: Appwrite(18:33) - How are you so productive?(20:30) - Are Bun & Node enemies?(22:55) - How does Bun achieve its performance?(27:33) - Are there security trade-offs?(29:36) - Is Bun the new Yarn?(31:58) - What about the company behind Bun?(33:09) - Similar business model to Deno?(35:42) - Is Bun more vs Deno or Node?(36:36) - How does Oven approach community?(37:44) - Sponsor: Changelog News(39:11) - What happens to Bun if Oven dies?(42:40) - How do you balance business vs dev?(42:59) - What would you love to hack on next?(44:24) - Where does the name come from?(45:20) - Daniel Buckmaster: Hardest part of Node compat?(47:06) - What are people building with Bun?(48:57) - KBall: What role do you see Bun playing in JS ecosystem?(51:30) - How to get hired at Bun?(52:03) - Closing time(52:25) - Next up on the pod (JS Party 300!)

Reports of Node's death are greatly exaggerated

Amal, KBall & Chris convene a “semi-emergency” pod to discuss the recent (deserved) hype over Bun and what it all means for Node’s community, maintainers & users. They’re joined by Node Technical Steering Committee members Matteo Collina & James Snell who are here to dispel Bun antagonism rumors, discuss the pros & cons of each runtime, explain how Node continues to thrive & even announce a VERY big upcoming feature! Leave us a comment Changelog++ members save 6 minutes on this episode because they made the ads disappear. Join today! Sponsors: Convex – Convex is a better type of backend — the full-stack TypeScript development platform that lets you replace your database, server functions, and glue code. Get started at convex.dev Appwrite – Build Fast. Scale Big. All in One Place. Appwrite is a backend platform for developing Web, Mobile, and Flutter applications. Built with the open source community and optimized for developer experience in the coding languages you love. Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs. Featuring: Matteo Collina – Mastodon, Twitter, GitHub, WebsiteJames Snell – Mastodon, Twitter, GitHub, WebsiteAmal Hussein – Twitter, GitHubKevin Ball – Twitter, GitHub, LinkedIn, WebsiteChristopher Hiller – Mastodon, Twitter, GitHub, Website Show Notes: Matteo’s tweet on Jarred Summer’s obsession with performance optimizations Bun’s claim to being a “drop in-replacement for Node.js” Platformatic 1.0 release annoucement AWS lambda quatas NodeTODO - your guide to getting started with how to contribute to Node.js Node.js’s new built-in test runner Node.js project governance by-laws Matteos recent newsletter which Amal magically connected with in the future OpenJS foundation Soon to be released PR for adding the new WebSocket lib to Node core Node.js supported binaries Node.js github issue #19308 “Adding Websocket support to core” which is 5+ years old and coincidentally closed on the day this podcast was released Something missing or broken? PRs welcome! Timestamps: (00:00) - It's party time, y'all(00:39) - Sponsor: Convex(03:15) - SEMI-EMERGENCY POD(04:23) - Welcoming Matteo & James(09:29) - How Node is structured(13:47) - Manufactured controversy(20:10) - Hints of Node's success(26:22) - diff node bun(31:54) - Paying for performance(40:20) - On scale and bottlenecks(45:26) - Sponsor: Appwrite(48:09) - Bun for tests & CI?(50:37) - Bun performance trade-offs(54:33) - Security features & compromise(56:01) - Node's legacy patina(1:03:39) - What breaking Node looks like(1:05:46) - Zig talk(1:10:00) - Node maintainers(1:14:12) - Amal's announcement(1:17:47) - The money question(1:22:37) - Node needs to learn what people want(1:26:18) - Announcement! Announcement!(1:29:18) - Listener Q: Eric Clemmons(1:34:54) - Listener Q: Kyle Beard(1:37:55) - Connecting with Matteo & James(1:39:01) - Wrapping up(1:39:31) - Next up on the pod

Web dev security school

This week, we’re joined by Ron Perris, a Security Engineer at Reddit and software security enthusiast. Together, we dive into best practices and common pitfalls, covering topics from dangerous URLs to JSON injection attacks. Tune in for an educational conversation, and don’t forget to bring your notebooks! Leave us a comment Changelog++ members get a bonus 4 minutes at the end of this episode and zero ads. Join today! Sponsors: Convex – Convex is a better type of backend — the full-stack TypeScript development platform that lets you replace your database, server functions, and glue code. Get started at convex.dev Appwrite – Build Fast. Scale Big. All in One Place. Appwrite is a backend platform for developing Web, Mobile, and Flutter applications. Built with the open source community and optimized for developer experience in the coding languages you love. Changelog News – A podcast+newsletter combo that’s brief, entertaining & always on-point. Subscribe today. Featuring: Ron Perris – Twitter, GitHubAmal Hussein – Twitter, GitHubChristopher Hiller – Twitter, GitHub, Website Show Notes: 10 React Security Best Practices Cheatsheet (by Ron Perris & Liran Tal) ZAP - the worlds most widely used web app scanner Loco Moco Security Conference in Hawai’i Node.js Ecosystem Security Working Group Node.js Security Bug Reporting Node.js Hacker One Page Node.js Third Party Labs Hacker One Page (now disabled) Python’s Advocate Library - for making secure HTTP requests on behalf of a third party DOMPurify - DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG ESLint Security Plugin Content Security Policy Something missing or broken? PRs welcome! Timestamps: (00:00) - It's party time, y'all(00:39) - Sponsor: Convex(04:10) - Welcoming Ron Perris(04:46) - Ron's background(14:55) - NodeJS Security Working Group(23:47) - Sponsor: Appwrite(26:35) - Where to get started with security(34:17) - String injectiony stuff(39:42) - XSS protection(43:40) - URL-based script injection(50:41) - Who's responsible for security?(52:38) - Sponsor: Changelog News(54:19) - On security teams(58:00) - On project security(59:51) - Sanitize & render HTML(1:04:45) - Secure server-side rendering(1:05:55) - Avoid JSON injection attacks(1:08:50) - User linter configs(1:10:54) - Thomas Eckert's question(1:13:57) - Why aren't people taught this?(1:16:10) - The Loco Moco conference(1:17:14) - Frontend vs backend security(1:24:14) - Connecting with Ron(1:25:45) - Next up on the pod (Join ++!)

Type War (what is it good for?)

Love it or hate it, TypeScript is here to stay for the foreseeable future. But, what happens when widely adopted packages go completely Type free or remove TypeScript in favor of JS with type annotations? Join us to unpack these recent events with Rich Harris, creator of Svelte, as he walks us through the nuanced decision his team made for the Svelte project, and ofc, lots of laughs along the way. Leave us a comment Changelog++ members get a bonus 7 minutes at the end of this episode and zero ads. Join today! Sponsors: Convex – Convex is a better type of backend — the full-stack TypeScript development platform that lets you replace your database, server functions, and glue code. Get started at convex.dev Caisy – Caisy is the headless CMS that gives developers endless possibilities. Learn more at caisy.io Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs. Featuring: Rich Harris – Twitter, GitHubAmal Hussein – Twitter, GitHubJerod Santo – Mastodon, Twitter, GitHub, LinkedIn Show Notes: News article from May 2023 when Svelte switched from TS to JSDoc type annotations DHH’s blog post “Open Source Hooliganism and the TypeScript Meltdown” DHH’s tweet announcing Turbo’s removal of TS Rich’s quote tweet of DHH Turbo announcement JSDoc docs Official TS docs highlighting support for JS Doc type annotations ECMA proposal for Type Annotations Alternate Episode Titles Type me a river To type or not to type Someone is typing in the community… Different types (or not) for different gripes The script schism Web Dev D Day Going off (Type)Script Losing the (Type)Script Not my type Can’t type this You fought in the Type Wars? Something missing or broken? PRs welcome! Timestamps: (00:00) - It's party time, y'all(00:39) - Sponsor: Convex(04:10) - EMERGENCY POD(04:56) - Welcoming Rich Harris(06:32) - Svelte's TypeScript decision(12:18) - Team "Idiomatic JavaScript"(18:24) - "TypeScript good, JavaScript bad"(21:36) - Nick's dramatic foil(23:15) - It's all situational(23:39) - What exactly Svelte ships(24:41) - Why the hate on JavaScript?(32:50) - Sponsor: Caisy(36:00) - Getting anthropological(41:55) - Amal's psychologist hat(45:10) - Twitter is the molotov cocktail app(48:28) - Jay-Z not realizing he's Jay-Z(49:37) - Rich Harris reads mean tweets(52:45) - Some Turbo 8 nuance(54:37) - DHH's blog post(59:48) - Listener questions (join Slack!)(1:00:16) - Kyle Beard says...(1:01:46) - Daniel Buckmaster says...(1:03:29) - Schalk Neethling says...(1:06:06) - Rich's magic wish(1:07:43) - Closing time(1:08:35) - Next up on the pod (Join ++!)