Panel:

• Charles Max Wood

Special Guests: Evan Hahn

In this episode, the JavaScript Jabber panelists discuss securing Express apps with Helmet.js with Evan Hahn. Evan is a developer at Airtable, which is a company that builds spreadsheet applications that are powerful enough that you can make applications with. He has also worked at Braintree, which does payment processing for companies. They talk about what Helmet.js is, when you would want to use it, and why it can help secure your Express apps. They also touch on when you wouldn’t want to use Helmet and the biggest thing that it saves you from in your code.

In particular, we dive pretty deep on:

• Evan intro
• JavaScript
• What is Helmet.js?
• Node and Express
• Why would you use the approach of Middleware?
• Helmet is not the only solution
• Http headers
• Current maintainer of Helmet.js
• npm
• Has added a lot to the project, but is not the original creator
• Outbound HTTP response headers
• Helmet doesn’t fully secure your app but it does help secure it
• How does using Helmet work?
• Are there instances when you wouldn’t want to use Helmet?
• No cash middleware
• Where do you set the configuration options?
• Top level Helmet module
• 12 modules
• What is the biggest thing that Helmet saves you from?
• Content security policy code
• And much, much more!

Links:

• Airtable
• Braintree
• JavaScript
• Helmet.js
• Node
• Express
• npm
• Evan’s Website
• @EvanHahn
• Evan’s GitHub

Picks:

Charles

• Camera
• Zoom H6
• Shure SM58
• DevChat.tv Youtube
• React Round Up

Evan

• Clojure
• Fortune
• Kantaro: The Sweet Tooth Salaryman

Panel:

• Aimee Knight
• AJ O’Neal
• Charles Max Wood

Special Guest: PJ Evans

In this episode, the panel talks with PJ Evans who is a course developer and an instructor through Manning’s course titled, “Node.js in Motion.” This course is great to learn the fundamentals of Node, which you can check out here! The panel and PJ talk about this course, his background, and current projects that PJ is working on. Check out today’s episode to hear more!

Show Topics:

0:00 – Advertisement: KENDO UI

0:36 – Chuck: Welcome and our panel consists of Aimee, AJ, myself, and our special guest is PJ Evans. Tell us about yourself and your video course! NODE JS in Motion is the title of the course. Can you tell us more?

1:29 – PJ: It’s a fantastic course.

2:25 – Chuck: You built this course and there is a lot to talk about.

2:36 – Aimee: Let’s talk about Node and the current state. 

2:50 – Chuck: Here’s the latest features, but let’s talk about where do you start with this course? How do you get going with Node? What do people need to know with Node?

3:20 – Aimee.

3:24 – PJ talks about Node and his course!

4:02 – PJ: The biggest headache with Node is the...

4:13 – Chuck.

4:19 – PJ: I am sure a lot of the listeners are familiar with callback hell.

4:50 – Aimee: Let’s talk about the complexities of module support in Node!

5:10 – PJ: It’s a horrible mess.

5:17 – Aimee: Maybe not the tech details but let’s talk about WHAT the problem is?

5:31 – PJ: You are talking about Proper Native ES6 right?

They are arguing about how to implement it. 

6:11 – PJ: My advice is (if you are a professional) is to stick with the LT6 program. No matter how tensing those new features are!

6:46 – Aimee: It could be outdated but they had to come back and say that there were tons of complexities and we have to figure out how to get there.

7:06 – PJ: They haven’t found an elegant way to do it.

7:15 – Panel: If it’s a standard why talk about it?

Seriously – if this is a standard why not implement THE standard?

7:38 – PJ.

8:11 – Panel.

8:17 – Aimee: I would love to talk about this, though!

8:24 – Chuck: I want to talk about the course, please.

8:30 – PJ.

8:54 – Chuck: We will keep an eye on it.

9:05 – PJ.

9:16 – PJ: How is it on the browser-side?

9:33 – Aimee: I don’t want to misspeak.

9:41 – Chuck: I don’t know how complete the forms are.

9:49 – Aimee: I don’t want to misspeak.

9:56 – PJ: I just found the page that I wanted and they are calling it the .MJS or aka the Michael Jackson Script. You can do an import from...

Some people think it’s FINE and others think that it’s a TERRIBLE idea.

10:42 – Chuck: “It sounds like it’s a real THRILLER!”

10:52 – Panel.

11:25 – Panel: When you start calling things the Michael Jackson Solution you know things aren’t well.

11:44 – Aimee: Just to clarify for users...

11:57 – Chuck: I want to point us towards the course: NODE.JS.

Chuck asks two questions.

12:34 – PJ: The concepts aren’t changing, but the information is changing incredibly fast. The fundamentals are fairly settled.

13:22 – Chuck: What are those things?

13:28 – PJ talks about how he structured the course and he talks about the specifics.

15:33 – Chuck: Most of my backend stuff is done in Ruby. Aimee and AJ do more Java then I do.

15:55 – Panel: I think there is something to understanding how different Node is. I think that Node is a very fast moving train. Node has a safe place and that it’s good for people to know about this space.

16:34 – Aimee: Not everyone learns this way, but for me I like to understand WHY I would want to use Node and not another tool. For me, this talk in the show notes really helped me a lot. That’s the core and the nature of NODE.

17:21 – PJ: Yes, absolutely. Understanding the event loop and that’s aimed more towards people from other back ends. Right from the beginning we go over that detail: Here is how it works, we give them examples, and more.

18:08 – Aimee: You can do more than just create APIs.

Aimee mentions Vanilla Node.

18:50 – PJ: To get into frameworks we do a 3-line server. We cover express, and also Sequelize ORM.

19:45 – Advertisement – Sentry.io

20:43 – Chuck: I never used Pug.

20:45 – PJ: PUG used to be called JADE.

20:56 – Aimee.

21:14 – PJ: Express does that for you and I agree with you. I advocate a non-scripted approach, I like when frameworks have a light touch.

22:05 – Aimee: That’s what I liked about it. No offense, Chuck, but for me I didn’t like NOT knowing a lot of what was not happening under the hood. I didn’t want to reinvent the wheel, but I wanted to build at a lower level.

22:40 – PJ: I had the same experience. I wanted to figure out why something wasn’t working.

23:24 – Panel: I had a friend who used Rails...he was cautious to make a switch. This past year he was blown away with how much simpler it was and how fast things were.

24:05 – Aimee: I feel like if you want to learn JavaScript then Node might be easier on the frontend.

24:21 – Chuck: No pun intended.

No, but I agree. I like about Rails is that you had well-understood patterns. But the flipside is that you have abstractions...

To a certain degree: what did I do wrong? And you didn’t follow the pattern properly.

25:57 – Panel: With Node you get a little bit of both. To me it’s a more simple approach, but the downside is that you have 100’s of 1,000’s of modules that almost identical things. When you start reaching out to NPM that...

26:29 – PJ: Yes the module system of NPM is the best/worst thing about NODE. I don’t have an answer, honestly.

There is a great article written that made me turn white. Here is the article!

28:12 – Panel: The same thing happened with the ESLint. That was the very problem that he was describing in the article.

28:50 – PJ: Yep, I put that in the chat there – go ahead and read it! It’s not a problem that’s specific to Node, there are others. It’s the way we do things now.

29:23 – Chuck: We have the NODE Security project. A lot of stuff go into NPM everyday.

29:43 – PJ: We cover those things in the course.

29:53 – Chuck: It’s the reality. Is there a place that people get stuck?

30:00 – PJ answers the question.

30:23 – Aimee.

30:55 – PJ: I am coding very similar to my PHP days.

31:20 – Aimee.

32:02 – PJ: To finish off my point, I hope people don’t loose sight.

32:18 – Aimee.

32:20 – PJ: I am working on a project that has thousands of requests for...

32:53 – Chuck: Anything you WANTED to put into the course, but didn’t have time to?

33:05 – PJ: You can get pretty technical. It’s not an advanced course, and it won’t turn you into a rock star. This is all about confidence building. It’s to understand the fundamentals.

It’s a runtime of 6 hours and 40 minutes – you aren’t just watching a video. You have a transcript, too, running off on the side. You can sit there and type it out w/o leaving – so it’s a very interactive course.

34:26 – Chuck: You get people over the hump. What do you think people need to know to be successful with Node?

34:38 – PJ answers the question.

PJ: I think it’s a lot of practice and the student to go off and be curious on their own terms.

35:13 – Chuck: You talked about callbacks – I am thinking that one is there to manage the other?

35:31 – PJ answers the question.

PJ: You do what works for you – pick your style – do it as long as people can follow you. Take the analogy of building a bridge.

36:53 – Chuck: What are you working on now?

37:00 – PJ: Educational tool called SCHOOL PLANNER launched in Ireland, so teachers can do their lesson planning for the year and being built with Express.

Google Classroom and Google Calendar.

39:01 – PJ talks about Pi and 4wd. See links below.

40:09 – Node can be used all over the place!

40:16  - Chuck: Yes, the same can be said for other languages. Yes, Node is in the same space.

40:31 – PJ: Yep!

40:33 – Chuck: If people want to find you online where can they find you?

40:45 – PJ: Twitter! Blog!

41:04 – Picks!

41:05 – Advertisement – eBook: Get a coder job!

Links:

• JavaScript
• jQuery
• React
• Elixir
• Elm
• Vue
• ESLint
• Node.js
• Node Security Project
• Node Security Project - Medium
• Manning Publications: Course by PJ Evans
• PUG
• JSConf EU – talk with Philip Roberts
• Medium Article by David Gilbertson
• Hackster.io – Pi Car
• Pi Moroni
• Holding a Program in One’s Head
• PJ Evans’ Twitter

Sponsors:

• Kendo UI
• Sentry
• Cache Fly
• Get a Coder Job

Picks:

Aimee

• Paul Graham - Blog

AJ

• Rust

Charles

• Tweet Mash-up
• The Diabetes Code

PJ

• Music - Max Richter

Panel:

Charles Max Woods

Special Guests: Donovan Brown

In this episode, the Charles speaks with Donovan Brown. He is a principal DevOps Manager with Microsoft with a background in application development. He also runs one of the nation’s fastest growing online registration sites for motorsports events DLBRACING.com. When he is not writing software, he races cars for fun. Listen to today’s episode where Chuck and Donovan talk about DevOps, Azure, Python, Angular, React, Vue, and much, much more!

Show Topics:

1:41 – Chuck: The philosophies around DevOps. Just to give you an idea, I have been thinking about what I want to do with the podcasts. Freedom to work on what we want or freedom to work where we want, etc. Then that goes into things we don’t want to do, like fix bugs, etc. How does Microsoft DevOps to choose what they want to do?

2:37 – Guest: We want to automate as much as we can so the developer has less work. As a developer I want to commit code, do another task, rinse and repeating.

Minutes and not even hours later then people are tweeting about the next best thing. Do what you want, where you want. Code any language you want.

4:15 – Chuck: What has changed?

4:19 – Guest: The branding changed. The name wasn’t the most favorite among the people. The word “visual” was a concerned. What we have noticed that Azure will let me run my code no matter where I am. If you want to run Python or others it can run in Azure.

People didn’t need all of it. It comes with depositories, project management, and so much more! People could feel clumsy because there is so much stuff. We can streamline that now, and you can turn off that feature so you don’t have a heart attack. Maybe you are using us for some features not all of them – cool.

7:40 – Chuck: With deployments and other things – we don’t talk about the process for development a lot.

8:00 – Guest talks about the things that can help out with that.

Guest: Our process is going to help guide you. We have that all built into the Azure tab feature. They feel and act differently. I tell all the people all the time that it’s brilliant stuff. There are 3 different templates. The templates actually change over the language. You don’t have to do mental math.

9:57 – Chuck: Just talking about the process. Which of these things we work on next when I’ve got a bug, or a ...

10:20 – Guest: The board system works like for example you have a bug. The steps to reproduce that bug, so that there is no question what go into this specific field. Let the anatomy of the feature do it itself!

11:54 – Chuck comments.

12:26 – Chuck: Back to the feature. Creating the user stories is a different process than X.

12:44 – Guest – You have a hierarchy then, right? Also what is really cool is we have case state management. I can click on this and I expect this to happen...

These are actual tasks that I can run.

13:52 – Chuck: Once you have those tests written can you pull those into your CI?

14:00 – Guest: “Manual tests x0.”

Guest dives into the question.

14:47 – I expect my team to write those test cases. The answer to your question is yes and no.

We got so good at it that we found something that didn’t even exist, yet.

16:19 – Guest: As a developer it might be mind

16:29 – Chuck: I fixed this bug 4x, I wished I had CI to help me.

16:46 – Guest: You get a bug, then you fix a code, etc., etc. You don’t know that this original bug just came back. Fix it again. Am I in Groundhog Day?

They are related to each other. You don’t have a unit test to tell you. When you get that very first bug – write a unit test. It will make you quicker at fixing it. A unit test you can write really fast over, and over, again. The test is passing. What do you do? Test it. Write the code to fix that unit test. You can see that how these relate to each other. That’s the beauty in it.

18:33 – Chuck: 90% of the unit tests I write – even 95% of the time they pass. It’s the 5% you would have no idea that it’s related. I can remember broad strokes of the code that I wrote, but 3 months down the road I can’t remember.

19:14 – Guest: If you are in a time crunch – I don’t have time for this unit test.

Guest gives us a hypothetical situation to show how unit tests really can help.

20:25 – Make it muscle memory to unit test. I am a faster developer with the unit tests.

20:45 – Chuck: In the beginning it took forever. Now it’s just how I write software now.

It guides my thought process.

21:06 – Guest: Yes! I agree.

22:00 – Guest: Don’t do the unit tests

22:10 – Chuck: Other place is when you write a new feature,...go through the process. Write unit tests for the things that you’ve touched. Expand your level of comfort.

DevOps – we are talking about processes. Sounds like your DevOps is a flexible tool. Some people are looking for A METHOD. Like a business coach. Does Azure DevOps do that?

23:13 – Guest: Azure DevOps Projects. YoTeam.

Note.js, Java and others are mentioned by the Guest.

25:00 – Code Badges’ Advertisement

25:48 – Chuck: I am curious – 2 test sweets for Angular or React or Vue. How does that work?

26:05 – Guest: So that is Jasmine or Mocha? So it really doesn’t matter. I’m a big fan of Mocha. It tests itself. I install local to my project alone – I can do it on any CI system in the world. YoTeam is not used in your pipeline. Install 2 parts – Yo and Generator – Team. Answer the questions and it’s awesome. I’ve done conferences in New Zealand.

28:37 – Chuck: Why would I go anywhere else?

28:44 – Guest: YoTeam  was the idea of...

28:57 – Check out Guest

29:02 – Guest: I want Donovan in a box. If I weren’t there then the show wouldn’t exist today.

29:40 – Chuck: Asks a question.

29:46 – Guest: 5 different verticals.

Check out this timestamp to see what Donovan says the 5 different verticals are. Pipelines is 1 of the 5.

30:55 – Chuck: Yep – it works on my Mac.

31:04 – Guest: We also have Test Plant and Artifacts.

31:42 – Chuck: Can you resolve that on your developer machine?

31:46 – Guest: Yes, absolutely! There is my private repository and...

33:14 – Guest: *People not included in box.*

33:33 – Guest: It’s people driven. We guide you through the process. The value is the most important part and people is the hardest part, but once on

33:59 – Chuck: I am listening to this show and I want to try this out. I want a demo setup so I can show my boss. How do I show him that it works?

34:27 – Azure.com/devops – that is a great landing page.

How can I get a demo going? You can say here is my account – and they can put a demo into your account. I would not do a demo that this is cool. We start you for free. Create an account. Let the CI be the proof. It’s your job to do this, because it will make you more efficient. You need me to be using these tools.

36:11 – Chuck comments.

36:17 – Guest: Say you are on a team of developers and love GitHub and things that integration is stupid, but how many people would disagree about...

38:02 – The reports prove it for themselves.

38:20 – Chuck: You can get started for free – so when do you have to start paying for it?

38:31 – Guest: Get 4 of your buddies and then need more people it’s $6 a month.

39:33 – Chuck adds in comments. If this is free?

39:43 – Guest goes into the details about plans and such for this tool. 

40:17 – Chuck: How easy it is to migrate away from it?

40:22 – Guest: It’s GITHub.

40:30 – Chuck: People are looing data on their CI.

40:40 – Guest: You can comb that information there over the past 4 years but I don’t know if any system would let you export that history.

41:08 – Chuck: Yeah, you are right.

41:16 – Guest adds more into this topic.

41:25 – Chuck: Yeah it’s all into the machine.

41:38 – Chuck: Good deal.

41:43 – Guest: It’s like a drug. I would never leave it. I was using TFS before Microsoft.

42:08 – Chuck: Other question: continuous deployment.

42:56 – When I say every platform, I mean every platform: mobile devices, AWS, Azure, etc.

Anything you can do from a command line you can do from our build and release system.

PowerShell you don’t have to abandon it.

45:20 – Guest: I can’t remember what that tool is called!

45:33 – Guest: Anything you can do from a command line. Before firewall. Anything you want.

45:52 – Guest: I love my job because I get to help developers.

46:03 – Chuck: What do you think the biggest mistake people are doing?

46:12 – Guest: They are trying to do it all at once. Fix that one little thing.

It’s instant value with no risks whatsoever. Go setup and it takes 15 minutes total. Now that we have this continuous build, now let’s go and deploy it. Don’t dream up what you think your pipeline should look like. Do one thing at a time. What hurts the most that it’s “buggy.” Let’s add that to the pipeline.

It’s in your pipeline today, what hurts the most, and don’t do it all at once.

49:14 – Chuck: I thought you’d say: I don’t have the time.

49:25 – Guest: Say you work on it 15 minutes a day. 3 days in – 45 minutes in you have a CSI system that works forever. Yes I agree because people think they don’t “have the time.”

50:18 – Guest continues this conversation.

How do you not have CI? Just install it – don’t ask. Just do the right thing.

50:40 – Chuck: I free-lanced and setup CI for my team. After a month, getting warned, we had a monitor up on the screen and it was either RED or GREEN. It was basically – hey this hurts and now we know. Either we are going to have pain or not have pain.

51:41 – Guest continues this conversation.

Have pain – we should only have pain once or twice a year.

Rollback.

If you only have it every 6 months, that’s not too bad.

The pain will motivate you.

52:40 – Azure.com/devops.

Azure DevOps’ Twitter

53:22 – Picks!

53:30 – Advertisement – Get a Coder Job

Links:

• Donovan Brown’s GitHub
• Donovan Brown’s Twitter
• Donovan Brown
• Donovan Brown – Channel 9
• Donovan Brown – Microsoft
• Azure
• YoTeam
• Azure.com/devops
• GitHub
• Azure DevOps’ Twitter

Sponsors:

• Angular Boot Camp
• Digital Ocean
• Get a Coder Job course

Picks:

Charles

• Jet Blue
• Beta Testers

Donovan

• YoTeam
• VSTeam Powershell Module

Sponsors

•  Datadog

• Sentry use code “devchat” for 2 months free

Panel

• Aimee Knight

• Chris Ferdinandi

• Christopher Beucheler

• AJ O’Neal

With Special Guest: Javan Makhmali

Episode Summary

Today’s guest is Javan Makhmali, who works for Basecamp and helped develop Trix. Trix is a rich text editor for the web, made purposefully simple for everyday use instead of a full layout tool. Trix is not the same as Tiny MCE, and Javan discusses some of the differences. He talks about the benefits of using Trix over other native browser features for text editing. He talks about how Trix has simplified the work at Basecamp, especially when it came to crossing platforms. Javan talks more about how Trix differs from other text editors like Google Docs and contenteditable, how to tell if Trix is functioning correctly, and how it works with Markdown.

The panel discusses more specific aspects of Trix, such as Exec command. One of the features of Trix is it is able to output consistently in all browsers and uses semantic, clean HTML instead of classnames. Javan talks about how Trix handles getting rid of the extraneous cruft of formatting when things are copy and pasted, the different layers of code, and the undo feature. He talks about whether or not there will be more features added to Trix. The panel discusses who could benefit from using Trix. The show finishes with Javan talking about Basecamp’s decision to make Trix open source and why they code in CoffeeScript. 

Links

• Trix

• Tiny MCE

• Contenteditable

• Markdown

• SVG

• HTML

• CoffeeScript

Follow DevChat on Facebook and Twitter

Picks

Javan Makhmali:

• API for form submissions

Chris Ferdinandi:

• CSS Grid

• Alex Russel Twitter thread

• How To Live a Vibrant Life with Early Stage Dementia

AJ O’Neal:

• Mario and Chill

• Chip Tunes 4 Autism: Catharsis

• Toilet Auger

Christopher Beucheler: 

• Medium to Own blog

Aimee Knight:

• Absolute Truth Unlearned as Junior Developer

Sponsors

• Sentry– use the code “devchat” for $100 credit 

Panel

• Charles Max Wood

• AJ O’Neal

• Joe Eames

• Aimee Knight

With Special Guest: Evan Weaver

Episode Summary

Evan Weaver is the CEO and cofounder of FaunaDB, a serverless database and a great way to get started with GraphQL. Evan talks about what went into building the FaunaDB and his background with Twitter. FaunaDB arose from trying to fix Twitter’s scalability issues, and the panel discusses scalability issues encountered in both large and small companies. They talk about the difference between transient and persistent data. They discuss how to develop locally when using a serverless database and the importance of knowing why you’re using something. Evan talks about how developing locally works with FaunaDB. He addresses concerns that people might have about using FaunaDB since it is not backed by a tech giant. Evan talks about some of the services FaunaDB offers and talks about the flexibility of its tools. He talks about how to get started with FaunaDB and what the authentication is like. Finally, Evan talks about some well known companies that are using FaunaDB and what they are doing with it. 

Links

• FaunaDB

• GraphQL

• Netlify

• AWS Lambda

• Apollo.io

• SQL

• Jamstack 

• Akkeris

• Graphile

Follow DevChat on Facebook and Twitter

Picks

Charles Max Wood:

• Captain Sonar

• Canny

• JSJ Reccomendations

Aimee Knight:

• Falling in Reverse

Joe Eames:

• Battlestations

Evan Weaver

• Forza Motorsport

• Follow Evan on Twitter and Github @evan

This week, My Javascript Story welcomes Javan Makhmali,a Programmer at Basecamp from Ann Arbor, Michigan. Javan attended Community College to study Computer Science but then decided to work as a Freelancer developer. Javan and Charles debate whether having a 4-year college degree is better to become a developer and conclude that it depends on the person. Some people prefer a structured 4 year degree to feel ready for a full time jo and some people do better with bootcamps. Javan mentions he knows several people that switched careers after completing an 8 week bootcamp and that the industry was really flexible to accomodate both options.

Charles and Javan then continue talking about Javan's journey as a developer and particularly his journey with Basecamp. Javan started out working with Ruby on Rails and after a couple of years applied for a job at Basecamp (then known as 37 Signals). Javan then started working with CoffeeScript which helped him understand working with JavaScript.

Charles and Javan talk about the projects Javan is working on currently at Basecamp. Outside of work Javan, is a new parent and enjoys spending time with his daughter. He feels ever since he has become a parent, his work life balance has been better.

Host: Charles Max Wood

Joined by Special Guest:  Javan Makhmali

Links

• JSJ 376: Trix: A Rich Text Editor for Everyday Writing with Javan Makhmali

• Javan's Twitter

Sponsors

• Sentry use the code “devchat” for 2 months free on Sentry small plan

• Dev Ed Podcast

• Adventures in Blockchain

• CacheFly

Picks

Charles Max Wood:

• https://maxcoders.io/

Lipschitz, Oded

Spencer, Scott, 1975-

McKinney, Gordon B., 1943-

Hayden Library - PQ7296.J6 Z8928 2018

Australia. Bureau of Meteorology

Perk, Marcel van der, author

NATO Advanced Study Institute on Nanostructured and Advanced Materials for Applications in Sensors, Optoelectronic and Photovoltaic Technology (2004 : Sozopol, Bulgaria)

Online Resource

Hayden Library - TP248.B55 S55 2017

Barker Library - TP1151.R43 K47 2018

Online Resource

Online Resource

Hayden Library - TP248.25.M645 Z63 2018

Online Resource

Online Resource

Online Resource

Online Resource

Online Resource

Online Resource

Online Resource

Online Resource

Vanhoye, Albert, author

Pervo, Richard I

Lee-Barnewall, Michelle, 1966- author

Chilton, Hugh, author

Furlong, Dean, author

Weaver, John, 1980- author

Godfrey, Paul C., author