Logo
    Search

    Potluck — Video Hosting × Fake Names? × Portfolio Projects × Monorepos × APIs × TLDs × Recording Tips × More!

    enApril 07, 2021

    Podcast Summary

    • Handling Dependent API Calls with GraphQLEnsure data from previous API calls is valid before making subsequent requests to prevent errors. GraphQL allows for multiple API calls in a single request, reducing errors caused by outdated data.

      When handling multiple API calls that rely on each other, it's important to ensure that the data from previous requests is available and valid before making subsequent requests. This can help prevent errors caused by using outdated or invalid tokens. The speakers, Scott and Wes, discussed how GraphQL can be beneficial in this scenario as it allows for multiple API calls to be made in a single request, reducing the likelihood of errors caused by outdated data. They also mentioned that it's crucial to check the success of previous API responses before making subsequent requests. The speakers also shared their personal experiences and the feeling of productivity and efficiency that comes with having more time to work due to the kids going back to school. They were also grateful for the listener questions and encouraged listeners to submit their own questions through the podcast's website. The episode was sponsored by Sanity, Sentry, and Vonage.

    • Handling Dependent API Calls and Recommended Video Storage SolutionWhen working with multiple API calls that depend on each other, ensure data is present and correct before making subsequent calls. Catch errors, refresh tokens, and implement retry logic. For video storage and optimization, consider using Mux for its ease of use and streamlined process.

      When working with multiple API calls that rely on each other, it's crucial to ensure the data is present and correct before making subsequent calls. This can involve catching errors, refreshing tokens, and implementing retry logic. For instance, when dealing with a time-limited token, you may need to catch an unauthenticated error, refresh the token, and make the call again. Additionally, when it comes to video storage and optimization for a project, Mux (mux.com) is a recommended service due to its ease of use and time-saving capabilities. Unlike other video hosting solutions, Mux doesn't require you to store your assets elsewhere before connecting them, making the process more streamlined.

    • Streamlined video handling with MuxMux simplifies video handling by offering uploading, quality adaptation, and data management through a single API, making it a more efficient choice for video delivery compared to managing multiple services and databases. Vimeo can also be a cost-effective option for simpler video hosting needs.

      Using a video delivery platform like Mux simplifies video handling compared to managing video files and versions on services like AWS or Azure. With Mux, video uploading, quality adaptation, and data management are streamlined through a single API, eliminating the need for managing multiple services and databases. The speaker also mentions that services like Vimeo can be more cost-effective for simpler video hosting needs. Overall, the choice of video delivery platform depends on the specific requirements of the project, such as the need for user-uploaded videos or the volume of video content.

    • From copying code to writing your ownStarting with copied code is common for beginners, but eventually, the goal is to write your own code and solve problems independently. Different video hosting platforms offer various features and pricing.

      It's normal and part of the learning process for web developers to start by copying and pasting code from tutorials or other sources. However, as they gain more experience, they'll eventually feel the urge to solve problems on their own and write their own code. The speaker shared his personal experience of transitioning from relying heavily on others' code to becoming more self-reliant. He also discussed various video hosting platforms like Vimeo, Wistia, Cloudinary, and Cloudflare, and their respective features and pricing. When it comes to learning web development, it's important to remember that everyone starts somewhere, and the ability to learn from others' code is a valuable skill. As confidence and experience grow, so will the desire to tackle problems independently.

    • Understanding Others' Code: A Step-by-Step ApproachTo build confidence and improve skills, learn from others' code by breaking down complex problems into simple steps in plain English. Don't let imposter syndrome hold you back, ask questions and seek clarification. Utilize helpful resources like APIs and sponsors to make the process more efficient.

      Learning from others' code and understanding it through a non-code perspective can help in building confidence and improving skills. When faced with complex problems, breaking them down into simple steps in plain English can make the process less intimidating. It's common to feel anxious or slow when working with undocumented code, especially when starting a new job. Imposter syndrome can be a challenge, but asking questions and seeking clarification is a necessary part of the learning process. The speaker recommends taking a step-by-step approach, thinking about the problem from an outsider's perspective, and writing out the process in plain English before diving into the code. Additionally, sponsors like Vonage can provide helpful APIs and resources to make building apps easier and more efficient. Congratulations to Josiah on landing his first web development job and good luck in your new role!

    • Navigating internal code with no documentationAsk questions and communicate effectively to understand unfamiliar code, build confidence, and prevent misunderstandings.

      Working with internal teams on coding projects can sometimes mean dealing with code that doesn't meet the same standards as open-source projects. Managers prioritize getting projects completed over thorough testing and documentation, so developers may encounter confusing or poorly documented code. However, it's essential to keep learning and asking questions. Reading the source code and understanding how functions and systems work together can make developers less reliant on documentation and more confident in their abilities. It's a common challenge to jump into an existing project with no documentation, but developers should communicate with their team members and ask for clarification when needed. Good developers should be willing to explain their ideas and code, and clear communication can prevent misunderstandings and animosity. To get started, developers can ask their team members what they expect when they encounter unfamiliar code or need help. By building a strong foundation of understanding and communication, developers can become more effective and confident in their work.

    • Approaching other people's code with empathyWhen working with others' code, focus on improving documentation and understanding, rather than criticizing it. Monorepos offer benefits but also complexities, so consider the project and team before deciding to use one.

      When working with other people's code or projects, it's important to approach the situation with empathy and a positive attitude. The individuals who wrote the code have likely put time, effort, and even personal attachment into their work. Insulting the code or being critical can unintentionally hurt their feelings. Instead, focus on how you can improve the documentation or understanding of the project. Additionally, monorepos, which house multiple projects within one repository, can be a double-edged sword. They offer benefits like keeping everything co-located and simplifying development, but they can also lead to complexities and challenges, especially in larger open-source projects. Ultimately, the decision to use a monorepo depends on the specific project and team. Some developers find the benefits outweigh the drawbacks, while others prefer to use separate repositories. It's essential to consider the pros and cons and choose the approach that best fits your project and team.

    • Managing Monorepos in JavaScript and Preparing for Junior Developer RoleNavigating monorepos can be challenging, but tools like yarn workspaces help. To prepare for a junior developer role, focus on fundamentals, learn a few frameworks, and build a portfolio.

      Monorepos (single repository projects with multiple applications) in JavaScript can be simple to manage using built-in tools like yarn workspaces, but it can be challenging to navigate and find information across multiple repositories. For new developers, the key takeaway is that there's no definitive answer to knowing if you're ready to apply for a junior position. However, having a solid grasp of fundamentals, experience with a few frameworks, and a decent portfolio are good targets to strive for. Lastly, regarding domain names, ICANN (Internet Corporation For Assigned Names) is the authority that decides which top-level domains (TLDs) are possible, and there's currently no information on whether a .eat domain will be available.

    • Discussing the process and cost of creating a new top-level domain and the importance of real-world experience in a developer portfolioCreating a new TLD involves a $185,000 application fee and showing a business model, not all applicants sell second-level registrations, and real-world experience is highly valued in developer portfolios.

      Anyone can apply for a new top-level domain (TLD) through ICANN, but it comes with a hefty price tag of $185,000 for the application and a $5,000 deposit fee. The process involves showing a business model and revenue projections. Not all applicants sell the second-level registrations, meaning someone can own a TLD but not allow others to use it. For those looking to build a portfolio for job hunting as a full-stack developer, it's recommended to include projects from previous employers, as long as there are no NDAs preventing it. Real-world experience is highly valued by hiring managers. During the discussion, it was mentioned that the longest available TLD is dot construction, with 12 characters, while the shortest are just two letters like dot io. Some creative suggestions included dot boss, dot west, and dot dope. An interesting point was made about the concept of "asking for forgiveness rather than asking for permission" when it comes to using projects from previous employers in a portfolio. However, it's always best to ask for permission first if possible. Overall, the conversation touched on the possibilities and costs of creating a new TLD and the importance of showcasing real-world experience in a developer portfolio.

    • Exploring Sanity CMS: Versatile and CustomizableSanity CMS is a versatile headless CMS used by various entities, offering custom schemas, real-time updates, and integration with GraphQL and other platforms. Privacy and anonymity considerations may lead some to use pseudonyms, but having a unique name can contribute to professional recognition.

      Sanity is a versatile headless CMS used by various companies, from large corporations like Nike and National Geographic to smaller entities, offering many-to-many relationships with real-time updates. Developers can create custom schemas with data types and fields, and host the CMS themselves. Sanity offers a query language (Grok) and supports GraphQL, allowing integration with various platforms. Regarding the question about using real names online, privacy concerns and anonymity are valid reasons to consider using a pseudonym. However, having a unique and easily searchable name can also help professionals stand out. Ultimately, the decision depends on personal preferences and priorities. The speakers shared their experiences, and while they have unique names, they are also real. Some people might find it challenging to use their uncommon names, leading to potential benefits of using a pseudonym. However, it's essential to consider that having a unique name can also contribute to professional recognition.

    • Maintaining Uniqueness in Tech IndustryUse a unique name for personal branding, secure domain names and social media handles, stay informed through podcasts, experts, and trends.

      Maintaining privacy and uniqueness in the tech industry is important for developers. This was discussed in the context of having a common name, where the risk exists of being mistakenly attributed for someone else's actions. The speakers suggested using a unique name for personal branding, ensuring availability of domain names and social media handles. They also emphasized that keeping up with updates and libraries is a part of the job for developers, but it's not easy, and everyone doesn't have to be on top of everything. Instead, listening to podcasts, following experts on social media, and being aware of trends can help developers stay informed without having to build or implement everything themselves.

    • Soundproofing your recording spaceUse a shock mount, place a thick material under your keyboard, invest in a good preamplifier, consider using a dynamic microphone, reduce airflow, and add sound-absorbing materials to improve recording quality.

      Creating a high-quality recording for a programming tutorial requires a quiet environment. To achieve this, consider implementing some soundproofing techniques in your recording space. First, focus on reducing vibrations that can enter your microphone. Use a shock mount for your microphone and place a thick material, such as a t-shirt, under your keyboard to dampen sounds. Next, invest in a good preamplifier, like the DBX 286, which can help eliminate background noises, such as a baby monitor or a neighbor's tree being cut down. If you're in a particularly noisy environment, consider using a dynamic microphone, like the Electro Voice RE 20, which is better suited for noisier conditions than a condenser microphone. Additionally, think about reducing airflow into your room as much as possible, as even small gaps can let in unwanted sounds. Old doors may be a source of noise, so consider using weatherstripping or draft stoppers to seal any gaps. Lastly, if major construction to build a room within a room is not an option, consider adding sound-absorbing materials, such as acoustic panels or foam, to your walls to help reduce echo and improve overall sound quality.

    • Limits of Sound Insulation and Creativity in Web DevelopmentSound insulation isn't perfect, but sealing doors with a rubber sweep helps. In web development, clients value creativity and problem-solving skills beyond tutorial projects. Use Sentry for real-time error handling and a free 2-month trial with 'tasty treat'.

      Improving sound insulation in a room involves identifying and addressing areas of airflow, but complete soundproofing might not be achievable. A rubber door sweep, for instance, while helpful for sealing doors, can also clog a keyhole, creating an open pathway into the room. An audio engineer friend confirmed this limitation, suggesting practical solutions instead of expecting perfection. Sound is vibration, and vibration is sound, as illustrated in a favorite song. For those learning to build websites with Node Express, React, and Django, creating a portfolio beyond tutorial projects requires demonstrating creativity and problem-solving skills. Clients are more interested in seeing how you've applied your knowledge to unique situations, rather than just replicating common projects. Keep pushing yourself to innovate and adapt your learning to real-world scenarios. Another valuable tool mentioned was Sentry, a service that captures and handles errors and exceptions in real-time, providing performance insights and user misery scores. Sentry can save developers from unnecessary stress and downtime by quickly identifying and addressing issues. Use the coupon code "tasty treat" for a free 2-month trial.

    • Create unique tech projects to showcase skillsBuilding simple yet creative tech projects can help demonstrate your problem-solving abilities and unique skills to potential employers

      Creating your own tech projects, no matter how small, can help demonstrate your unique skills and problem-solving abilities to potential employers. The speaker recommends starting with a few projects that are substantial enough to finish but not overly complex. For example, building a camera app that texts you when it detects motion or turning a photo into a coloring sheet using edge detection. These ideas show creativity and the ability to turn ideas into functional tech. Even if there are already similar apps on the market, the important thing is to build something unique to you and demonstrate your capabilities. So, identify your own needs and create solutions to solve them.

    • Finding creative solutions to make processes more efficientConsolidate projects when it makes sense, but keep marketing and actual app separate to maintain clarity and application logic.

      It's beneficial to solve your own problems and find creative solutions to make processes more efficient. The speaker shared an example of how they created an app to help them remember dance moves during competitions, and encouraged tweaking tutorials to make them unique and engaging. When it comes to web development, the decision of whether to combine multiple web apps into one or keep them separate depends on individual needs. The speaker shared their personal experience of consolidating different projects into one app to reduce maintenance efforts. However, they also suggested keeping marketing and actual app separate to prevent muddying up the application logic. The popular trend among sponsors like Sanity.io and LogRockets follows this approach as well. Overall, the key takeaway is to find innovative solutions to your problems, and consider consolidating projects when it makes sense for your specific situation.

    • Advantages of keeping blog or marketing website on same domain as main applicationMaintaining a consistent domain simplifies integration, makes HTTPS easier, and saves time and effort. Useful tools like MiniWare TS 80p soldering iron and Cam Link 4k can enhance productivity.

      Keeping a blog or marketing website on the same domain as the main application can offer several advantages. For instance, it simplifies integration, makes HTTPS easier, and allows for easier user authentication. Many larger companies follow this practice, such as Log Rockets with their Blog Rocket and Sentry with their blog and app on sentry.io. However, smaller companies or those with a larger product range, like Vonage, may choose to use separate domains. While it's possible to use different domains, keeping them consistent on the same domain can save time and effort. As for the "sick picks" segment, the speaker recommended a MiniWare TS 80p soldering iron. This compact, USB-powered soldering iron is perfect for small projects and can be powered by a USB-C charger or power bank. Its hackable firmware also adds to its appeal for those interested in tinkering and customization. Another recommendation was the Cam Link 4k, which the speaker mentioned in a previous episode about desk setups. The device allows users to connect multiple cameras with one cable, making it a convenient solution for those who need to manage multiple video sources. Overall, the key takeaway is that maintaining a consistent domain for a blog or marketing website, along with useful and innovative tools like the MiniWare TS 80p soldering iron and Cam Link 4k, can streamline processes and enhance productivity.

    • Using the Cam Link 4k for HDMI devicesThe Cam Link 4k enables users to connect HDMI devices to a computer and use them as webcams or stream games. It's easy to use and reliable.

      The Cam Link 4k is a versatile and convenient tool for connecting HDMI devices to a computer. The speaker shares his personal experience of using the Cam Link 4k with his 4k camera and Nintendo Switch, allowing him to use his camera as a webcam and stream games over Zoom. He also mentions the ease of use and reliability of the device. Additionally, he promotes his latest course, Node Fundamentals Authentication, which covers various authentication topics and concepts in-depth. He encourages listeners to check out leveluptutorials.com/forward/pro for a discount on the course. Overall, the discussion highlights the benefits of the Cam Link 4k and the value of learning authentication concepts through the Node Fundamentals Authentication course.

    Recent Episodes from Syntax - Tasty Web Development Treats

    790: State of JS 2023 Reactions

    790: State of JS 2023 Reactions

    Scott and Wes dive into the 2023 State of JavaScript survey, breaking down the latest trends and pain points in front-end frameworks, build tools, and JavaScript runtimes. Tune in for their hot takes and insights on what’s shaping the JavaScript landscape this year!

    Show Notes

    Sick Picks

    Shameless Plugs

    Hit us up on Socials!

    Syntax: X Instagram Tiktok LinkedIn Threads

    Wes: X Instagram Tiktok LinkedIn Threads

    Scott: X Instagram Tiktok LinkedIn Threads

    Randy: X Instagram YouTube Threads

    789: Do More With AI - LLMs With Big Token Counts

    789: Do More With AI - LLMs With Big Token Counts

    Join Scott and CJ as they dive into the fascinating world of AI, exploring topics from LLM token sizes and context windows to understanding input length. They discuss practical use cases and share insights on how web developers can leverage larger token counts to maximize the potential of AI and LLMs.

    Show Notes

    Hit us up on Socials!

    Syntax: X Instagram Tiktok LinkedIn Threads

    Wes: X Instagram Tiktok LinkedIn Threads

    Scott: X Instagram Tiktok LinkedIn Threads

    CJ: X Instagram YouTube TwitchTV

    Randy: X Instagram YouTube Threads

    788: Supabase: Open Source Firebase for Fullstack JS Apps

    788: Supabase: Open Source Firebase for Fullstack JS Apps

    Scott and CJ chat with Paul Copplestone, CEO and co-founder of Supabase, about the journey of building an open source alternative to Firebase. Learn about the tech stack, the story behind their excellent documentation, and how Supabase balances business goals with open-source values.

    Show Notes

    • 00:00 Welcome to Syntax!
    • 00:30 Who is Paul Copplestone?
    • 01:17 Why ‘Supa’ and not ‘Super’?
    • 02:26 How did Supabase start?
    • 08:42 Simplicity in design.
    • 10:32 How do you take Supabase one step beyond the competition?
    • 12:35 How do you decide which libraries are officially supported vs community maintained?
      • 15:17 You don’t need a client library!
    • 16:48 Edge functions for server-side functionality.
    • 18:51 The genesis of pgvector.
    • 20:59 The product strategy.
    • 22:25 What’s the story behind Supabase’s awesome docs?
    • 25:26 The tech behind Supabase.
    • 35:46 How do you balance business goals with open source?
    • 42:01 What’s next for Supabase?
    • 44:15 Supabase’s GA + new features.
    • 48:24 Who runs the X account?
    • 50:39 Sick Picks + Shameless Plugs.

    Sick Picks

    Shameless Plugs

    Hit us up on Socials!

    Syntax: X Instagram Tiktok LinkedIn Threads

    Wes: X Instagram Tiktok LinkedIn Threads

    Scott: X Instagram Tiktok LinkedIn Threads

    CJ: X Instagram YouTube TwitchTV

    Randy: X Instagram YouTube Threads

    787: You Should Try Vue.js

    787: You Should Try Vue.js

    Scott and CJ dive deep into the world of Vue.js, exploring what makes this frontend framework unique and why it stands out from React and Svelte. CJ gives a comprehensive tour, covering everything from getting started to advanced features like state management and Vue’s built-in styles.

    Show Notes

    Vue.js: The Documentary.

    Sick Picks

    Shameless Plugs

    Hit us up on Socials!

    Syntax: X Instagram Tiktok LinkedIn Threads

    Wes: X Instagram Tiktok LinkedIn Threads

    Scott: X Instagram Tiktok LinkedIn Threads

    Randy: X Instagram YouTube Threads

    786: What Open Source license should you use?

    786: What Open Source license should you use?

    Scott and CJ dive into the world of open source, breaking down its meaning, benefits, and the various types of licenses you’ll encounter. From permissive licenses like MIT and Apache 2.0 to copy-left licenses such as GNU GPLv3, they’ll help you choose and apply the right license for your project.

    Show Notes

    Hit us up on Socials!

    Syntax: X Instagram Tiktok LinkedIn Threads

    Wes: X Instagram Tiktok LinkedIn Threads

    Scott: X Instagram Tiktok LinkedIn Threads

    Randy: X Instagram YouTube Threads

    785: What’s Next for NextJS with Tim Neutkens

    785: What’s Next for NextJS with Tim Neutkens

    Scott and Wes dive into the world of Next.js with special guest Tim Neutkens from Vercel. They explore the latest updates, including the React Compiler and React Server Components, discussing their impact on developer workflows and the future of Next.js development.

    Show Notes

    • 00:00 Welcome to Syntax!
    • 00:30 What does the React Compiler do?
    • 05:04 Will React Compiler help with managing Context?
    • 06:39 What happens if you’re not using a React Compiler?
    • 09:30 Will this work on any NextJS version?
    • 12:18 What are React Server Components?
    • 16:28 Shipping all the data inside an encapsulated component.
    • 20:17 Clearing up the frustrations around retrofitting server components.
    • 23:13 Handing migration.
    • 28:30 Is this just a fetch request with props?
    • 36:41 How closely are the NextJS and React teams working?
    • 41:53 Will we ever get Async Client Components?
    • 43:52 Async Local Storage API.
    • 45:31 Turbopack.
    • 57:51 Sick Picks & Shameless Plugs.

    Sick Picks

    Shameless Plugs

    Hit us up on Socials!

    Syntax: X Instagram Tiktok LinkedIn Threads

    Wes: X Instagram Tiktok LinkedIn Threads

    Scott: X Instagram Tiktok LinkedIn Threads

    Randy: X Instagram YouTube Threads

    784: Logging × Blogging × Testing × Freelancing

    784: Logging × Blogging × Testing × Freelancing

    In this Potluck episode, Scott and Wes tackle listener questions on modern blogging, website environmental impact, and using LangChain with LLMs. They also cover CSS hyphens, unit vs. integration testing, and balancing web development with new parenthood.

    Show Notes

    Sick Picks

    Shameless Plugs

    Hit us up on Socials!

    Syntax: X Instagram Tiktok LinkedIn Threads

    Wes: X Instagram Tiktok LinkedIn Threads

    Scott: X Instagram Tiktok LinkedIn Threads

    Randy: X Instagram YouTube Threads

    783: How We Built a Netflix Style “Save for Offline” Feature Into Syntax

    783: How We Built a Netflix Style “Save for Offline” Feature Into Syntax

    Scott and Wes dive into the world of browser caching for audio files, exploring the File System API and the Cache API. They discuss size restrictions across different browsers, how tools like Riverside.fm leverage IndexedDB, and walk through code examples for creating, retrieving, and managing cached audio data.

    Show Notes

    Hit us up on Socials!

    Syntax: X Instagram Tiktok LinkedIn Threads

    Wes: X Instagram Tiktok LinkedIn Threads

    Scott:X Instagram Tiktok LinkedIn Threads

    Randy: X Instagram YouTube Threads

    782: The Developer’s Guide To Fonts with Stephen Nixon

    782: The Developer’s Guide To Fonts with Stephen Nixon

    Scott and CJ are joined by Stephen Nixon of ArrowType to delve into the world of fonts and type for developers. They explore the intricacies of font creation, the utility of variable fonts, and offer tips for making visually appealing typography on the web.

    Show Notes

    Sick Picks

    Shameless Plugs

    Hit us up on Socials!

    Syntax: X Instagram Tiktok LinkedIn Threads

    Wes: X Instagram Tiktok LinkedIn Threads

    Scott:X Instagram Tiktok LinkedIn Threads

    Randy: X Instagram YouTube Threads

    781: Potluck - The Value of TypeScript × Vue vs Svelte × Leetcode

    781: Potluck - The Value of TypeScript × Vue vs Svelte × Leetcode

    In this potluck episode of Syntax, Scott and CJ serve up a variety of community questions, from the nuances of beginner vs. advanced TypeScript to the pros and cons of SvelteKit. They also discuss falling out of love with React, shipping private packages via NPM, and the eternal struggle of always starting but never finishing projects.

    Show Notes

    Sick Picks

    Shameless Plugs

    Hit us up on Socials!

    Syntax: X Instagram Tiktok LinkedIn Threads

    Wes: X Instagram Tiktok LinkedIn Threads

    Scott:X Instagram Tiktok LinkedIn Threads

    Randy: X Instagram YouTube Threads

    Related Episodes

    2019-035-Matt_szymanski-attack and defense of GraphQL-Part1

    2019-035-Matt_szymanski-attack and defense of GraphQL-Part1




    Derbycon Discussion (bring Matt in)

     

    Python course: 

    https://brakesec.com/brakesecpythonclass 



    PDF Slides: https://drive.google.com/file/d/1wmxrfgbaHu56kfccLoOd5M3Zz6bNP6Qi/view?usp=sharing 

     

    GraphQL High Level

    https://graphql.org/

    Designed to replace REST Arch

    Allow you to make a large request, uses a query language

    Released by FB in 2012

    JSON 

     

    Learn Enough to be dangerous

    https://blog.bitsrc.io/13-graphql-tools-and-libraries-you-should-know-in-2019-e4b9005f6fc2

     

    WSDL: https://www.w3.org/TR/2001/NOTE-wsdl-20010315

     

    Vulns in the Wild

     

    Abusing GraphQL 

     

    OWASP Deserialization Cheat Sheet - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html



    Attack Techniques

    https://www.apollographql.com/docs/apollo-server/data/data/

    https://github.com/graphql/graphiql



    Protecting GraphQL

     

    https://github.com/maticzav/graphql-shield

     

    Magento 2 (runs GraphQL), hard to update…

     

    https://github.com/szski/shapeshifter - Matt’s tool on Shapeshifter

     

    GraphQL implementations inside (ecosystem packages?)

     

    Infosec Campout 2020 occurring (28-29 Aug 2020, Carnation, WA)

    Patreon supporters  (Josh P and David G)

    Teepub: https://www.teepublic.com/user/bdspodcast

     

    For Amanda next:

    https://www.cybercareersummit.com/

    & keynote @grrcon oct 24/25

     

    Check out our Store on Teepub! https://brakesec.com/store

    Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

    #Brakesec Store!:https://www.teepublic.com/user/bdspodcast

    #Spotifyhttps://brakesec.com/spotifyBDS

    #RSShttps://brakesec.com/BrakesecRSS

    #Youtube Channel:  http://www.youtube.com/c/BDSPodcast

    #iTunes Store Link: https://brakesec.com/BDSiTunes

    #Google Play Store: https://brakesec.com/BDS-GooglePlay

    Our main site:  https://brakesec.com/bdswebsite

    #iHeartRadio App:  https://brakesec.com/iHeartBrakesec

    #SoundCloudhttps://brakesec.com/SoundcloudBrakesec

    Comments, Questions, Feedback: bds.podcast@gmail.com

    Support Brakeing Down Security Podcast by using our #Paypalhttps://brakesec.com/PaypalBDS OR our #Patreon

    https://brakesec.com/BDSPatreon

    #Twitter@brakesec @boettcherpwned @bryanbrake @infosystir

    #Player.FM : https://brakesec.com/BDS-PlayerFM

    #Stitcher Network: https://brakesec.com/BrakeSecStitcher

    #TuneIn Radio App: https://brakesec.com/TuneInBrakesec

    2019-036-RvrShell-graphql_defense-Part2

    2019-036-RvrShell-graphql_defense-Part2

    Secure Python course: 

    https://brakesec.com/brakesecpythonclass 

    PDF Slides: https://drive.google.com/file/d/1wmxrfgbaHu56kfccLoOd5M3Zz6bNP6Qi/view?usp=sharing 

     

    GraphQL High Level

    https://graphql.org/

    Designed to replace REST Arch

    Allow you to make a large request, uses a query language

    Released by FB in 2012

    JSON 

     

    Learn Enough to be dangerous

    https://blog.bitsrc.io/13-graphql-tools-and-libraries-you-should-know-in-2019-e4b9005f6fc2

     

    WSDL: https://www.w3.org/TR/2001/NOTE-wsdl-20010315

     

    Vulns in the Wild

     

    Abusing GraphQL 

     

    OWASP Deserialization Cheat Sheet - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html

     

    Attack Techniques

    https://www.apollographql.com/docs/apollo-server/data/data/

    https://github.com/graphql/graphiql

     

    Protecting GraphQL

     

    https://github.com/maticzav/graphql-shield

     

    Magento 2 (runs GraphQL), hard to update…

     

    https://github.com/szski/shapeshifter - Matt’s tool on Shapeshifter

     

    GraphQL implementations inside (ecosystem packages?)

     

    Infosec Campout 2020 occurring (28-29 Aug 2020, Carnation, WA)

    Patreon supporters  (Josh P and David G)

    Teepub: https://www.teepublic.com/user/bdspodcast

     

    For Amanda next:

    https://www.cybercareersummit.com/

    & keynote @grrcon oct 24/25

     

    Check out our Store on Teepub! https://brakesec.com/store

    Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

    #Brakesec Store!:https://www.teepublic.com/user/bdspodcast

    #Spotifyhttps://brakesec.com/spotifyBDS

    #RSShttps://brakesec.com/BrakesecRSS

    #Youtube Channel:  http://www.youtube.com/c/BDSPodcast

    #iTunes Store Link: https://brakesec.com/BDSiTunes

    #Google Play Store: https://brakesec.com/BDS-GooglePlay

    Our main site:  https://brakesec.com/bdswebsite

    #iHeartRadio App:  https://brakesec.com/iHeartBrakesec

    #SoundCloudhttps://brakesec.com/SoundcloudBrakesec

    Comments, Questions, Feedback: bds.podcast@gmail.com

    Support Brakeing Down Security Podcast by using our #Paypalhttps://brakesec.com/PaypalBDS OR our #Patreon

    https://brakesec.com/BDSPatreon

    #Twitter@brakesec @boettcherpwned @bryanbrake @infosystir

    #Player.FM : https://brakesec.com/BDS-PlayerFM

    #Stitcher Network: https://brakesec.com/BrakeSecStitcher

    #TuneIn Radio App: https://brakesec.com/TuneInBrakesec

    La Maison du très très Vieux

    La Maison du très très Vieux

    Cette année, Romy ne veut pas de cadeaux. Romy veut rencontrer le Père Noël.

    Cela tombe bien ! Son super copain de classe, Eliott, est persuadé de savoir où il habite...


    Badaboum & Patatras est un podcast pour les enfants de 3 à 6 ans.  

    Dans ce podcast, on fait la course avec le vent, on pique-nique sur les nuages, on voyage dans une larme. 

    Dans ce podcast, il y a des oiseaux qui piaillent, des bulles qui explosent, des ours qui grognent...

    Derrière chaque son, il y a des tas d'histoires. Des histoires que j'ai plaisir à vous raconter alors suivez ma voix et plongez dans l'univers de Badaboum & Patatras.  

    Pour plus d'infos: https://www.instagram.com/badaboum_et_patatras/

    Crédits:

    Écriture et réalisation : Agathe Welcomme

    Musique originale : Alexandre Barberon et Sylvain Legeai

    Visuel : Lola Bogelmann  

    Episode 3 - High Strangeness in the California Desert

    Episode 3 - High Strangeness in the California Desert

     

    Release Date: 21 March 2014

    This is the 3rd episode of API Case Files - the podcast by and for UFO Investigators. Your host for this Episode is Marsha Barnhart, API Chief of Investigations, who opens the show with a report on API’s 2014 case-load, and provides a snapshot view of API investigator’s currently assigned cases.  Marsha Barnhart produced a segment on a “high strangeness” case, 14-027-AN4, that illuminates possible linkage between UFO experiencers and coinciding  anomalous events.  Paul Carr hosts a Conversation with a Skeptic, “Eric the Red”.  They discusses various aspects of skeptic philosophy and how it bears scrutiny with regards to the UFO question.  Antonio Paris talks about his second book “Space Science,  and Paul Carr presents his 3rd installment of Unidentified Science.  Marsha Barnhart chats briefly with Investigator Nancy Doty regarding her latest case, 14-030

    See Full Show Notes