JavaScript's Most Wanted

on YouTube ↗01h 04m

" summary

A live demo shows six concrete production failures and how to find and fix them: scripty joe is browser obfuscation from cross‑origin scripts — fix by adding CORS headers and the crossorigin attribute; a third‑party typo (getRandomAds) breaks pages unpredictably; clara context is lost this in callbacks — fix with var self=this or Function.prototype.bind/_.bind; a server sends numbers not strings (2000 errors from one user) so validate and log; intermittent script load failures (134 hits, 129 users) require feature checks; a memory leak from detached DOM listeners crashes browsers — use Chrome DevTools timeline, async stacks and TrackJS to diagnose.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 0:07JavaScript's MOST WANTED
3. 5:51WANTED Scripty Joe Characteristics: Script Error
4. 29:58Clara "This&That" Context Place of Origin: Functional Args Characteristics: Not Defined
5. 31:22WANTED Dolly Data Characteristics: Substr is not a

" related talks

• 26mScripting in the 3rd Party True Tales of Horror and HopeNoah Adams · CascadiaFest 2016
• 40mHostile JavaScript: Attacking and Defending the BrowserTodd H. Gardner · NDC London 2023
• 58mSquashing JavaScript bugsTodd H. Gardner · NDC London 2017
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 01h 08mSquashing JavaScript BugsTodd H. Gardner · NDC Sydney 2017
• 32mWriting Secure JavaScript CodeGuy Podjarny · View Source 2017
• 36mHTML5 JS SecurityMaty Siman · AppSec California 2014
• 32mJavaScript is weird. MythBusters specialMałgorzata Janeczek · jsday 2025