993: It’s Been A Hell Of Week

Scott and Wes break down a chaotic week in dev news — the Claude Code source leak, a nasty Axios npm supply chain hack, and Railway’s private cache exposure — plus how to keep these nightmare scenarios from hitting your own projects. Show Notes 00:00 Welcome to Syntax! 00:55 Claude Code Leaked! Wes’ X Post Apple Source Code Video 05:42 Burning through Claude Code token limits. Reddit Thread 08:57 Axios hacked! Step Security pnpm Supply Chain Security pnpm minimumReleaseAge 16:13 Pretext blew up! Pretext.js Demos Wes’ Demo 27:24 Railway shared private cache. Railway Incident Report 31:54 Sick Picks & Shameless Plugs. Sick Picks Scott: Kindle Colorsoft Kids Wes: UGREEN 200W 8-Port GaN USB C Charger Block, Wyze Headphones Shameless Plugs Scott: Syntax on YouTube Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Scott Tolinski?

  This week has been absolutely crazy so far. There is just an endless amount of interesting things. So we thought we would break down some of the wildest stuff that has happened this week. Claude Code's source code got leaked. Axios was hacked and that's major for some various reasons. There's something called pretext, which had every single person on the internet tweeting about text rendering. It has been absolutely wild. My name is Scott Tylensky. I'm a developer from Denver. With me as always is Wes Boss. What's up Wes?

• 0:38Wes Bos?

  It's Tuesday and I can't believe everything's going down.

• 0:41Scott Tolinski?

  It's Tuesday, my dudes.

• 0:42Wes Bos?

  Unbelievable. By the time you listen to this, it'll probably be about a week later, but like we're gonna get into it and talk about, I think there's some good lessons to be learned here as well as just like interesting tidbits to dive into. So let's start with the first one, which is like Claude Code leaked. So what happened? It was the exact same thing that happened with the, the Apple App Store, which is when they publish a website, you have what's called a source map and a source map takes your like minified, bundled, mangled code. And then it will simply just like point to where in the, like the parts of the code where it was unminified. And when you do that, you're able to actually see what the unminified code looks like.

• 1:24Wes Bos?

  And then it also includes things that were maybe dropped during compiling. Most notably, that's often like comments and things that are, are dipping in there. And Claude Code published their source map. It was 60 meg file. They published it to NPM. In the case of Apple, it was just simply on their website. You open up DevTools and it downloaded. And generally, I don't know, this, it's not generally something you want on your website. If you're, you're like client code is something that is somewhat sensitive because like you're still shipping the code to the user, but you're essentially giving them access to the uncompiled version. You can see their folder structure, how they do CSS, all the comments, all that crazy stuff.

• 2:05Scott Tolinski?

  Yeah. You know, it's so funny when we, uh, when CJ put together that Apple source code video leaking, people were like, this isn't, this isn't leaked. This is just client side available code. Like, man, this source map stuff is real. And like, uh, it's, it's wild to see, definitely to peer inside of things. I, I, I've been like just waking up to see all of this information. So I haven't had a chance to dive into this thing yet.

• 2:34Wes Bos?

  Yeah, I, I did a quick little look and the first thing I do, of course, was I looked for the spinner verbs. So when you run Claude code, it'll say things like flummixing or envisioning or whatever. And I was always curious if those were like AI generated, but I've, I've seen specifically, I've seen hullabalooing more times than I can count. Um, so I immediately went in and looked for it. And yes, there's 187, uh, spinner verbs in there. And, and this is not something that like, you would have been able to find this out previously because like you can't, the thing about like strings is that you can't encrypt them or like compress them because they're, they're strings that need to make it into the final thing. So you probably could have found this previously, but I thought

• 3:15Wes Bos?

  it was kind of interesting to take a look at it. Um, another thing they had was there, they've, when they share like five character IDs, um, when you're, you're handling channel permissions, they just generate a random five thing from the alphabet, right? They take L out of it because it looks too close to a one. Um, and then they also have this like huge avoid substrings, which is just bad words that may possibly.

• 3:41Scott Tolinski?

  Wink, pee, poo. I'm not going to say any of the other ones. We gotta blur those. Some of those are actual slurs here. So.

• 3:49Wes Bos?

  Yeah. Randy, Randy will blur them. Um, and then the last one here was that when you swear at Claude code, it actually flags it with a red X, um, surprisingly. And so if you say like, Garbage, what the hell, and many other terrible things, which is like, don't swear at the robots, folks, they're gonna come get you. But basically, I was surprised to see that was an English-only red jacket. And then when they detect that it is a negative prompt, it's sent to their analytics server as a negative prompt. They probably use that for like reinforcement training. No, that was not a good one.

• 4:25Scott Tolinski?

  I think some of my most sent messages to AI are you [bleep] you eat [bleep].

• 4:30Wes Bos?

  Please bleep that out.

• 4:32Scott Tolinski?

  Yes.

• 4:33Wes Bos?

  Yeah. So my question is like, is this a big deal that this happened? Obviously, I feel bad for, they're like DMCA-ing it, they're taking it down, anyone that's forked it. Interestingly, somebody converted the entire thing to Python, and now they're having trouble having that taken down because it's not technically the code. There's this whole crazy world now where like

• 4:54Scott Tolinski?

  Interesting.

• 4:55Wes Bos?

  It is their code. You're just going around it by converting it to Python. But like, is this a big deal that this happened? Like, this is not their model. Their model did not leak.

• 5:05Scott Tolinski?

  No.

• 5:05Wes Bos?

  But it is all of the code behind the CLI, the desktop app, the SDK, all of that type of stuff. And this was code that they were just willingly giving you. But now it's simply just easier for you to deconstruct it because you have the source map. So I don't know that like somebody like OpenAI is gonna be like, ooh, now we have access to all of their components and things like that.

• 5:27Scott Tolinski?

  Yeah, yeah, yeah.

• 5:29Wes Bos?

  I don't know. There's probably a couple little tricks here and there, but I don't think that this is a like crazy game changer. You could always give Claude a bundled thing and ask it to decompile it, and it does a pretty good job at that.

• 5:42Scott Tolinski?

  Yeah. What's so funny here, Wes, is that this is kind of on the heels of this whole conversation about people hitting their Claude code limits way faster. So that's been a major topic of conversation. People have been leaving comments on our videos even asking about this, where in Claude code, what was happening is that you were hitting your limits much faster recently. Now, they haven't had any official statement here, but someone on Reddit did dive into this and found that there were two Major situations where cache invalidation was essentially ruining the prompt caching, causing you to hit your limits much faster. So this isn't necessarily the official explanation

• 6:26Scott Tolinski?

  from Claude that something is happening. But this was a, we'll put this link in the show notes for this Reddit post because it was a really interesting deep dive into what exactly is going on. Basically, part of their string replacement that they're using to, what I understand is to validate billing stuff is one of the bugs that is causing the cache to be invalidated on every request as far as I'm.

• 6:50Wes Bos?

  I did hear, I was talking to Kramer at our syntax meetup and he said, yeah, there was some, he said, he mentioned something about there being a cache issue and their, their bill went up like 10 grand in one day or something. I don't know what the, the output of that actually was, but maybe that that was related to this. They are also, Claude code is, is just like, like breaking at the seams. Everybody wants to use it. So they've been, they've been trying to like enforce off hours. Like if you have to do stuff that's not like mission critical. It's really funny. Like they literally say during these times, you may hit your limit faster. And it's just like,

• 7:28Wes Bos?

  there's like one hour of like, like California lunch where it just dips right down. That's, it's so funny to me that we have all of this power and you still see the lunch break goes down, you know, or you've heard of like, like tea breaks, the electricity grid in Britain, you know, they have to, during commercial breaks for like, I don't know what the Brits watch, you know, like Road to Avonlea or something like that. The electricity spikes as everyone turns their kettle on at the exact same time. Wild, wild, wild world, but.

• 8:04Scott Tolinski?

  It is. Yeah. I wonder if we're seeing the start of the subsidizing of these, these models starting to crack a little bit. I don't know. I'm not smart enough to have the answer for that.

• 8:17Wes Bos?

  Yeah. I think we'll, we'll probably get there at some point. I don't know if we're there yet because it's still a huge battle between OpenAI Codex, Claude Code, you know, Gemini, like I hear Grok's going to be dropping their own coding model relatively soon. So.

• 8:36Wes Bos?

  Everybody is just trying to like, capture that huge audience. So they're probably going to be subsidizing it for as long as possible.

• 8:44Scott Tolinski?

  Yeah, yeah. And in that regard, like, right now, just spend as much tokens as possible if you're not paying for the API, if you're on one of those max plans.

• 8:57Wes Bos?

  Next one we have here is Axios had a hack, which was, was kind of scary. So Axios, obviously, like a huge kind of fetch replacement. It is still, even though we've had for fetch for many, many years, it is still very big because it is a dependency of many things. People have older projects that they don't want to move off. And there are several little niceties of Axios that allow you to, that are much nicer than just using fetch. We did a show many years ago, like, why are people still using Axios? And I, I no longer use Axios in any of my products, simply because most of the stuff, like canceling requests, or having timeouts, most of those have been implemented in the platform now.

• 9:40Wes Bos?

  But, a lot of people still use it, bazillions of downloads every single day. And one of the core maintainers had his credentials stolen, or hacked, or something like that. They released a 4.2.0, which, nice hacker, that was, that was cool. Which is a clean, they call it a decoy copy. And there was no, there was nothing in there. And it basically just was like, like a full version. And then, what they did is they released a point version, which, if you know about Semver, if you release a point version and you have like 4.2.0 specified in your package JSON, then NPM installing will, will install any, it depends on if you have like the tilde or the squiggle. I have a whole video on it.

• 10:26Wes Bos?

  But basically, for most people, when you install it, it will just install the newest version. So there was a thing on here that dropped, it's called a RAT. I had to look this up. It stands for Remote Access Trojan. Essentially, what it does is, you install it, it runs a post-install script, and, and that will install a Remote Access Trojan on your machine. And then they can, they can do whatever they want on your machine, which is, is kind of scary. Luckily, I don't know, people caught it relatively quickly. I didn't hear of anybody getting hacked yet, but certainly people have installed this and run the code. So I would certainly check your package lock JSON for the specific versions mentioned here.

• 11:08Scott Tolinski?

  Yeah, it's so funny. I've never knowingly used Axios, as in like, I've never installed it myself. And not like what you're saying. Yeah, yeah, yeah. But I did a search for Axios on my computer just to see how many copies of it I have and which projects. And the thing that was the most interesting for me was that the only one I have, believe it or not, is my Claude bot, my Open Claw. It's the only one, which is probably not great, but yes.

• 11:38Wes Bos?

  Yeah. Well, that was a kind of the scary thing. Even if you don't use Axios, probably one of your packages uses Axios down the line. And if it's anywhere in your dependency tree, then you're going to get in trouble.

• 11:52Scott Tolinski?

  You know what I find interesting about the fact that it is Axios, besides the fact that so many things use Axios, is that if, since Open Claw does use Axios, I like wonder if that was a target. Now you've got all these like, people who aren't developers installing Open Claw and just YOLOing everything. It's like a slot factory. Like, was that like a target, you know?

• 12:15Wes Bos?

  Yeah. Like, what's the end game of these things? Previously, it was people trying to like, steal your crypto. But now, I think, like, I had somebody email me the other day, and they said, I can get you what's called residential proxies. And I was like, residential proxies? And I was like, oh, the hardest part of being a spammer is getting like, clean IP addresses. And if you're running these things on like a bot farm, on like some sketchy server farm, then your IP address is going to get flagged for that type of thing. But if you run them through IP addresses of like legitimate Like Comcast at someone's house, like that's, that's a huge asset.

• 12:57Wes Bos?

  So I almost wonder if these types of things are like, I simply just want to run a very quiet proxy on, they'll probably be looking for banking information and whatnot as well. But simply just having an army of computers is, is a huge thing. And an army of clean, clean IP addresses that can

• 13:15Scott Tolinski?

  Yeah.

• 13:16Wes Bos?

  I don't know, do all kinds of bad things.

• 13:19Scott Tolinski?

  Yeah.

• 13:19Wes Bos?

  The question of like, how, how do you stop this from happening? Right? Because every time this type of thing happens, everyone's like, oh, you shouldn't be doing that. You should be like hard coding, absolutely everything. And the reality is that like, the entire software ecosystem is built on dependencies. You know, this has happened to Linux. It happens to node a lot because our, our ecosystem is very big. And this whole like nested dependencies is a very big problem. There are many, like, it looks like the step security, I haven't heard of them, but they had a really good write up on it. Socket.dev for Ross, his stuff is really good. They seem like they caught a lot of that type of stuff. But the, the very minimum thing you should do is if you're using like PNPM, you can put a minimum release age on your things there.

• 14:04Wes Bos?

  And what that will do is you can simply just wait one or two days to update your, your dependencies. And what, and what that'll do is it'll give you a couple of days to just make sure everything is, is good, you know, like this type of thing was caught within hours.

• 14:19Scott Tolinski?

  Yeah.

• 14:20Wes Bos?

  That way you're not accidentally NPM installing something that has a malicious value in it.

• 14:26Scott Tolinski?

  Yeah. And I would say PNPM does such a better job at this than most. Like there's the, the thing that I find to be annoying is probably for the best where there's, you have to approve scripts in PNPM.

• 14:40Wes Bos?

  Yeah.

• 14:40Scott Tolinski?

  Like sometimes after you install things, it will say, yeah, you need to run PNPM approve. Builds or proof scripts or whatever that is. So shout out to PNPM for actually doing something good.

• 14:53Wes Bos?

  That's a tricky thing because like, like a post install script is sometimes handy where like you install this thing and now you need to do a little bit of setup that is specific to your machine. But also it's kind of scary that simply just installing a package is able to like execute code on your computer.

• 15:11Scott Tolinski?

  Yeah, it's at least good to have that, even if it may be obnoxious at the time that like.

• 15:17Wes Bos?

  But I think the whole, I don't know, the whole sandboxing is going to get a lot more popular as we're just running random code from agents. I know a lot of people right now are just like YOLO-ing it, running everything on a single computer dangerously, except absolutely everything because that's just the fastest way and it has access to everything. But I think we're in for a couple, couple of years of hurt with, with stories like this until the models can get better at detecting like, because it's, code is so annoying when you have to like sit there and approve everything, you know, or you have to make an array of things that's allowed to do. Like, yeah, of course, you can, you can like read a file that is in this directory, but no, you shouldn't like RM my entire database.

• 16:02Scott Tolinski?

  Right. Yeah. It's, I think this is, this is, if you think this is a one-off thing, you know, this is just going to get more and more common for sure. Yeah. The next one we have here is pretext. Now pretext is a, a new library, or you could say a new package from the creator of React Motion. And was he a member of the React team itself at some point? Yes.

• 16:32Wes Bos?

  Core contributor to React, also was one of the guys behind, what's the O camel language?

• 16:39Scott Tolinski?

  Oh, Reason ML.

• 16:40Wes Bos?

  You know, smart guy. Yeah. Reason, smart guy to say the least.

• 16:45Scott Tolinski?

  Yes. And this library is basically a way to measure text in a highly performant way. And.

• 16:56Scott Tolinski?

  Wes, this is one of those ones where I see the demos and like many of other people at first I'm like, "Okay, but CSS can do some of this." Uh, like, like one of the, the, um, accordion example he had showed doing animating from zero to height auto. I'm like, "Oh, CSS can do that." Uh, at least modern CSS can. Like, what is this actually getting us? And you dove into it considerably more than I did. So I, I'm interested to hear what your thoughts are on this, considering, uh, a lot of people, what they did is they saw the demo, which was a bunch of orbs passing through text and the text moving around. And there's so many bad takes where they're just like, "Why would I ever want the text to move like this?" So it's like,

• 17:41Wes Bos?

  Yeah.

• 17:41Scott Tolinski?

  That's, it's a, it's a tech demo. It's not a, a UI demo.

• 17:45Wes Bos?

  Well, all of the demos were simply just like doing funny things with the text. Like this one where someone, the text is getting out of the way of your, your thumb, right?

• 17:55Scott Tolinski?

  Oh, that's pretty cool, actually.

• 17:57Wes Bos?

  Yeah, that actually was really cool. Um, I, I made a couple demos where I like, I did like a video of myself and the text was just falling around the video of myself. Um, there's some cool demos around different algorithms for justifying text, which is, I didn't even realize this was a thing, you know, like, like text align justify it. That, that is just a thing. But there are different algorithms that make

• 18:19Scott Tolinski?

  Of course.

• 18:20Wes Bos?

  it much more readable, um, to enjoy. So what this is, is it's a library for simply measuring text without having to append it to the DOM. So right now, like, here's a little demo I have with like, something like fit text. This is the way fit text works is that you, you just increase the font size every time. And then as soon as you hit the font size that is larger than

• 18:44Scott Tolinski?

  That overflows the container. Yeah.

• 18:46Wes Bos?

  Yeah, I'm, I'm too big here. Then you, you back it up one and then you're, you're at your final value. Um, and, and that requires you to update the DOM, in this case, I don't know, nine times, read the DOM size and then like, even if, this is obviously slowed down here to, to show the visual, but even then, if you were to do it instantly, it's still a visual flicker. Whereas this, you can simply just measure how big text will be. Um, it does it via canvas. It parses every single word. It measures them all. It caches them. It does it, does it really quickly.

• 19:20Scott Tolinski?

  This to me is why I know this is like one of the minor use cases for this, but I I had, I actually maintain svelte fit text, which is like an action that does. So I have experience with fit text to see that is like, oh, that rules because I always found that process to be unusual where you're just like looping and making it bigger. Oh, it's too big. All right, back off. And then you have to choose what that interval is. So, yeah.

• 19:45Wes Bos?

  Yeah. It's a very cool implementation. And I think the use case of it is, is not yet revealed. I'm doing a video on what I think it is, but this is, this is one of the guys that worked on the virtual DOM for React. Basically, someone that looked at the browser and looked at the DOM and said, I'm going to build my own. Now he's looking at the DOM and sizing text and goes, I'm going to build my own. So there's, there's kind of like two things I'm thinking here is, is either he's making the entire, this is a primitive to something that is much bigger, like, like a React native, where he's building an entire

• 20:26Wes Bos?

  UI ecosystem that renders not to the DOM, but will render to like, like Canvas or OpenGL or Metal or, or like, like something that is native. Or, and I think, I think that this is probably it is that I think that he works at Mid Journey and I think Mid Journey is working on like a Figma competitor. And a lot of these new Figma killers that are coming out right now, they are all built in web tech. And what that allows you to do is you, you can use Claude or whatever to build something in these apps, like paper pencil is one. And then when you go, when it comes time from going from design to code, it's a lot easier

• 21:10Wes Bos?

  because your design was done in, in web tech. And then the other way is, is great as well as if you had Claude make a website and you want to bring that into a design app, it's a lot easier to take an existing website and put it into like a Figma, you know, it goes both ways. So I bet. That Midjourney is working on something like this. And part of their app that they need to do, they hired the like rendering guy, you know? They're probably building some super performant Figma-like application. And part of that is you have to figure out how to do text. You gotta figure out how to size text properly and know how big things are and figure out if it should wrap or not. Like that's what, that's exactly what this thing does.

• 21:55Wes Bos?

  So I bet that this is a primitive for that type of thing. And also, if you go to the Midjourney website,

• 22:03Wes Bos?

  look at, look at right here, it says, "Projects. Over the coming months, we're unveiling a wide range of ambitious projects over the themes of imagination, coordination, reflection, beauty, and human flourishing." But look at this one, TBA software. What's that? A pen. TBA software, what's that? If you inspect element on this image, it says people.png. So this is going to be a collaborative app for doing designs. And then you-

• 22:26Scott Tolinski?

  Look at this investigative dev work here.

• 22:29Wes Bos?

  Well, yeah, I could be wrong. I thought, I thought Dino was gonna get bought by OpenAI and I was wrong about that. But this is just my crazy-

• 22:38Scott Tolinski?

  Yeah, no, I like, I like all these, uh, cuz you're, you're not like just shooting in the dark here. I do find this, the, one of the things that I think a lot of people had a question about is cuz when they see some of these things, they think, oh, is this using Canvas, right? Is Canvas involved here? And Canvas is doing the measure, that measuring, that's correct? Yeah.

• 22:58Wes Bos?

  Canvas is doing the measuring, yep.

• 23:00Scott Tolinski?

  But it's not doing the actual, uh, rendering at the end of the day. Because I did see comments being like, how could this be accessible if you're just doing Canvas? But all of the demos have text on the DOM. They're just getting the measurements via Canvas.

• 23:18Wes Bos?

  It can be either. So essentially, there is a prepare function, which will measure all the words. And then there's a layout function that you pass it a width. So you say, "lay this out given a 500 pixel width." And then it will- Figure out where the wrapping and everything goes and what it gives you at the end of the day is simply just the text and the words, the end with for that one. And then it's up to you to figure out what to do with that. So you could just write this to canvas, which I think this is a huge use case. Writing text to canvas right now sucks because there's no word wrapping. But now we have word wrapping in canvas. You could just use this. But all, most of the demos, people are simply just absolute positioning this. So this is B movie.

• 24:02Wes Bos?

  I absolute position every single word in B movie and it took 42 milliseconds.

• 24:08Scott Tolinski?

  Crazy.

• 24:09Wes Bos?

  To parse and then one millisecond to layout. And then that means if the layout changes, you don't have that initial 42 milliseconds. And, and that's why all of these demos are like stupid, like things. Because he wanted to show how fast it was, that you can literally lay out text at 120 frames a second, no problem. And, and that's why it was, but nobody's actually building these like silly editorial layout type of things.

• 24:36Scott Tolinski?

  Yeah, I think there's, there's a couple of classes of bad takes on this. One, there was the CSS can do this already, or this is dumb kind of.

• 24:45Wes Bos?

  Yeah.

• 24:46Scott Tolinski?

  Because that's not really what this is about. Two, the, the bad take on the demos being unusable. The demos are just tech demos, folks. They're just there to illustrate how like the, the limits that you can push this type of thing. They're not meant to be like, oh yes, we should be reading a blog post with moving text. That's not like what these are about. Another bad take I saw on this was this changes absolutely everything. The web will no longer be the same.

• 25:17Wes Bos?

  So many things like that.

• 25:19Scott Tolinski?

  They're crazy. The, like, what's so weird about this is for being something that is like. Nerd interesting. It really blew up in an odd way of people either hating on it or thinking it's like going to be, you know, curing all disease.

• 25:39Wes Bos?

  It's unbelievable that people would would say CSS is dead because like you do not want to be laying out your text where everything is absolutely positioned and you give up all of the benefits of the flow of the DOM. In some cases, yeah, you do. But in most cases, no, like if we were the other way around, where we were manually looping over segments and laying out sentences one by one, and then somebody came out with the fact that you have relative positioning, game changer, a game changer. What you just put a paragraph and the image goes below it, you don't have to position it, you know, like, that would be hilarious.

• 26:17Scott Tolinski?

  Yeah.

• 26:18Wes Bos?

  But yeah, here's one more thing. A lot of people were saying CSS can do this and they're linking all these demos. Here's one of them where we have shape outside in CSS, which allows you, if you have an image, you can float it left or right, and then your text will wrap around it. And I was like, I was working on a video a couple of months ago, being like, why is nobody using this? And then I started like building something? I was like, oh, it's because this sucks. It doesn't actually work very well. Like this example right here, there's a girl and then text is going around it. First of all, there's two columns. You have to manually figure out which what text goes in those two columns, right? And so you're kind of out of luck there. And then also, this girl is like literally had split in half so that you can float one left and one right. There's, there's no way,

• 27:02Wes Bos?

  there's no like clear both in CSS where you can like wrap text around and objects. It either goes to the left or to the right. So like, again, this is a cool demo, but like, there's a reason why you don't see websites using this because it doesn't work very well.

• 27:16Scott Tolinski?

  Yeah. And to me, that's like, that type of layout is maybe even like the least captivating part of any of this. So.

• 27:24Wes Bos?

  Last one here, and this one is not to necessarily dunk on Railway, but it's more of like an interesting thing I think all developers should know, because this is kind of a scary security thing that people don't necessarily think about. So Railway had an incident where they changed something with their CDN, and they accidentally cached private pages and then shared them between that domain. So the way that this works is if you have like a page where like, I'm logged in to mybank.com forward slash accounts, and I render out the page that shows all of my account balances.

• 28:07Wes Bos?

  If you cache that page, like just simply the caching, the HTML or any other resource, you're putting, you can throw that into, either cache it in the browser, you can cache it in a private CDN, or you can cache it on a public CDN. And things like your homepage for your bank maybe want to be cached, but stuff that has private information, you shouldn't be sharing that cache between the two, right?

• 28:36Scott Tolinski?

  Yeah.

• 28:36Wes Bos?

  And what happened with Railway here is that they changed something with how their CDN worked, and then people were loading pages of applications and realizing, this is not my data. Like, why am I seeing stats for somebody else? There were several incidences where people had like medical information, and people were seeing medical information for other ones. And that's because the cache was not scoped to the user. It was a public cache, which is a huge security issue, right?

• 29:10Scott Tolinski?

  Caching. How many of these issues are caching?

• 29:13Wes Bos?

  Cache ruins everything around me. Cache is always the biggest problem that I have here. So that sucks. I want to talk real quick about like, how can you avoid this? Because this kind of happened to us. Luckily, it wasn't a security issue, but this happened to us on the Syntax website where we had user-specific themes. So you go to the Syntax website. You set a theme to be like dark or like synthwave or something like that. And then when you visit a page, we, the, the theme is sent in a cookie. And then we server render that theme with all of the classes on it.

• 29:52Wes Bos?

  And the first person who would go to like, like a random page, if they had a different theme than what you had, what, what, what happened is that that person's page would be the cache. And we stored that in the cache, you know? But really that person's theme in their CSS that was specific to them. And that shouldn't have been like shared amongst other people, right? And we were trying to be smart by like server rendering the theme so you wouldn't get that flicker.

• 30:20Scott Tolinski?

  Yeah, no, all, all, all in the, just to improve the server response there. The, remove the flash of unstyled content. Luckily this wasn't tied to user accounts or anything.

• 30:33Wes Bos?

  No, just user preferences and you would just get a random like flash of somebody else's theme on random pages. So how do you avoid this? Don't cache private pages or, or maybe cache the templates, but don't cache the actual data. Use the cache control private header. So meaning that it's not cache control public. It's not going to be shared amongst a, a public one. You can also, there's also a vary header where if you're like caching a resource, you can set a vary header on it for like something like the user ID or the user cookie, something like that. And then, and then that will make sure that, okay, I will cache it, but I'm going to use this specific

• 31:17Wes Bos?

  piece of information to cache for that specific person. Although Cloudflare doesn't support the vary header. I know Netlify does. I was talking to Matt from Netlify about this specific problem when we had it on our theme as well. So essentially just like, I would probably say don't cache sensitive information like that. Cause that's a whole nother HIPAA compliance problem that you're going to have.

• 31:43Scott Tolinski?

  Yeah, man, this stuff is tough. Uh, we're dealing with all kinds of stuff on the web, but uh, be careful out there, folks.

• 31:51Wes Bos?

  Stay safe.

• 31:52Scott Tolinski?

  Stay safe. Yeah, stay safe. Uh, let's get into the point of the show where we talk about sick picks. Wes, do you have a sick pick for us today?

• 32:01Wes Bos?

  Boy, do I. So.

• 32:03Scott Tolinski?

  Ooh, I like that intro.

• 32:05Wes Bos?

  Do I? Man, so every couple of years I go through like, like a Chargers. And I think, man, I need, I need like a better charger for this type of thing. And like, one thing I hate is super dog slow Chargers that can't like, oh, you can't charge your laptop on this one. It's not as good or like, uh, my phone is dead. I can, I can charge to 80% in like 20 minutes, but I don't have the proper charger. So a couple of months ago, I bought this Ugreen 200 watt eight port GAN charger. And it has one, two, three, six USB Cs, two USB As. It's like super high quality. It's all metal. If you go on Amazon and you search for chargers, you're going to see like, people are like 700 watts for 20 bucks.

• 32:48Wes Bos?

  And like, be very suspicious of high claiming chargers that are very cheap because they, they don't exist. But I've landed on this Ugreen eight port one. And I got it for all the kids because all of our kids, we've got what? Three or four iPads. We've got, they all have headphones that need to charge. And then there's several other things like, um, we got a Meta Quest VR thing.

• 33:14Scott Tolinski?

  You did? Yeah.

• 33:15Wes Bos?

  Awful. Absolutely. Oh, man. Makes me want to puke. We'll talk about more about that later. I want to see if I can get React Native running on it, but.

• 33:24Scott Tolinski?

  Oh, my God.

• 33:25Wes Bos?

  We got to charge all that stuff and it's so nice having a like high quality charger that would charge nice and fast. You can put, plug your laptop into it. I know USB C has been around for a long, long time, but I'm like, we're almost at a point now where the whole world is USB C and it will just, everything will charge on it. So I bought another one because I was like, I want one from beside my bed. And I want to be able to, I was having problems where like some stuff wouldn't charge or it wasn't charging fast enough with like a crappy old one I have. And I'm like, I'm sick of this. So get the Ugreen eight port. Big fan of it.

• 34:00Scott Tolinski?

  Yeah, I need one, uh, by my bed to charge my computer while my agents run while I'm trying to sleep.

• 34:06Wes Bos?

  Well, that's the thing is like beside my bed, I've got like an Apple Watch charger. And then I have like a dock, like a MagSafe dock, but then I also have USB C to charge my phone. And I have another one if I want to charge my computer at the same time. And then like, there's several other things and it's kind of getting away from me. And then I also realized that you can get these like USB C to barrel connectors. And like, if you have something that is running on like a 12 volt, eight volt, you can just change out your barrel connectors for USB C. So I might do that as well.

• 34:37Scott Tolinski?

  Yeah, just standardize.

• 34:39Wes Bos?

  Yeah, the Google Home has a little barrel jack on there and you have to plug it into the wall. I was like, I could probably get a USB C for that. Yeah.

• 34:45Scott Tolinski?

  Yeah. Okay. I'm going to stick pick something along, something that you might charge with that, which is for Christmas, we got our kids Color Soft Kindles. They make Kindles for kids and we got these Color Soft. So it's a Color Kindle for kids. They have a kids account and they are just downloading all kinds of graphic novels and comics on here. You can do audiobooks on these. Now, the only problem with the audiobook stuff is that they do need Bluetooth headphones for some stupid reason. There's no headphone jack on them. So our kids have to use Bluetooth headphones and then we have to keep the Bluetooth headphones charged.

• 35:27Scott Tolinski?

  But like, both of our kids have been going nuts for these because they're just at the right age where my daughter can read now and my son is like really getting into comic books and graphic novels. And he's like reading all these different kinds of comic books that are available on here. And I gotta say the, the product, I've never had a Kindle personally, but the product is really good. Now you are locked into the whole Amazon ecosystem of things.

• 35:55Wes Bos?

  Yeah.

• 35:55Scott Tolinski?

  And there is that, that Bluetooth headphones thing, but the actual device and reading experience on this is so good. And our kids just cannot put theirs down. They are reading every single night. So for me, that's like a huge, huge win to see them so like interested in reading as opposed to watching TV or playing games or something.

• 36:15Wes Bos?

  Cool. Man, I'm gonna give you another sick pick right now. We've had these for a long time. The Wise Noise Cancelling Bluetooth headphones. I was like a Bluetooth headphone hater for the longest time for the kids because A, they break everything that you give them. Like, they're so rough on them. And like, B, like, I was at a point where I was putting replaceable headphone jacks in all of our headphones because like, they would always like mash the end. And then finally, when they got new iPads, there's no headphone jack, obviously. So I was like, alright, we gotta get some Bluetooth headphones. And they have been fantastic. So we had, for two years, we had Wise Noise Cancelling headphones. They're super high quality. They held up to all of the abuse.

• 36:59Wes Bos?

  And after two years, we, like, one of our kids broke them. And I had to glue them back together. And we got them another set because they go on sale. Right now, they're on sale for 35 bucks. And the battery lasts forever. They're the most comfortable headphones. Aside from my Bose QC35s, they're probably the most comfortable headphones I've ever worn. And they're noise cancelling, the kids love them. And like, if you need headphones for your kids, get them. Like, they leave them on all the time, you know? But it doesn't matter, battery lasts forever and they charge USB-C.

• 37:33Scott Tolinski?

  Yeah, very interesting. Cool, I've never even seen that.

• 37:37Wes Bos?

  That's, yeah, they're fantastic. We're on like, almost three years with them now, so. I almost tempted to buy like, a whole stock extra of them. They're so good.

• 37:49Scott Tolinski?

  One to stock and one to rock, I gotcha. Alright, cool. Well, anything else before we get out of here?

• 37:55Wes Bos?

  That's it. Use sentry, sentry.io/syntax. Peace.

• 38:01Scott Tolinski?

  Peace.