1008: Diffs, Trees, and VS Code 2.0
Scott and Wes sit down with Alex Sexton and Amadeus De Marzi from Pierre Computer to dig into the gnarly performance challenges behind building blazing-fast code review tools, covering virtualization, progressive rendering, and why GitHub’s UI feels so sluggish. They also chat about how major AI coding tools like Claude, Codex, and Cursor are adopting Pierre’s diffs library, plus the role of web components, benchmarking, and what it takes to build “VS Code 2.0.”
Show Notes
00:00 Welcome to Syntax!
04:00 The Need for Better Infrastructure
05:53 Understanding Diffs and Trees
diffs.com
Trees by the Pierre Computer Co
08:16 Performance Challenges in Code Review
10:49 Virtualization Techniques for Smooth Scrolling
15:04 In-Page Find and Virtualization Limitations
17:00 Browser Limitations and Content Visibility
19:29 Progressive Rendering and Syntax Highlighting
23:05 Tools and Techniques for Performance Testing
33:35 Optimizing Performance with AI
36:31 Mastering Auto Research for Efficiency
42:00 Exploring Web Components and State Management
44:05 Innovations in Rendering and Virtualization
49:12 Business Insights and Future Directions
53:58 Sick Picks
Hit us up on Socials!
Syntax: X Instagram Tiktok LinkedIn Threads
Wes: X Instagram Tiktok LinkedIn Threads
Scott: X Instagram Tiktok LinkedIn Threads
Randy: X Instagram YouTube Threads
731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton
Scott and Wes are joined by security expert, Alex Sexton of Stripe to cover all things: client security, XSS, attack vectors, and CSP (content security policy).
Show Notes 00:00 Welcome to Syntax!
00:31 Brought to you by Sentry.io.
00:57 Who is Alex Sexton?
04:44 Stripe dashboard is a work of art.
05:08 Tell us about the design system.
React Aria
08:59 Who develops the iOS app?
09:50 Stripe’s CSP (content security policy).
12:50 What even is a content security policy?
Content Security Policy explanation
13:57 Douglas Crockford of Yahoo on security.
Douglas on GitHub
15:13 Security philosophy.
16:59 What about inline styles and inline JavaScript?
19:41 How do we safely set inline styles from JS?
20:20 Setting up with meta tags.
22:52 What are common situations that require security exceptions?
26:24 Potential damage with inline style tags.
32:45 Looping vulnerabilities.
36:32 What about JavaScript injection?
37:09 Myspace Samy Worm.
Myspace Samy Worm Wiki
Sentry.io Security Policy Reporting
42:02 Does a CSP stop code from running in the console?
43:28 What are some general security best practices?
46:35 Strategies for rolling out a CSP.
51:49 Final tip, Strict Dynamic.
Strict Dynamic
56:36 Where does the CSP live within Stripe?
Original Black Friday story
59:35 One last story.
01:01:20 Sick Picks + Shameless Plugs
Sick Picks + Shameless Plugs Alex: Wes Bos’ Instagram
Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads
Wes: X Instagram Tiktok LinkedIn Threads
Scott:X Instagram Tiktok LinkedIn Threads
Randy: X Instagram YouTube Threads