8 ms·

Node v8.8.0

199 points by nikolay 9y ago

nikolay 9y ago
Notable Changes * crypto: - expose ECDH class * http2: - http2 is now exposed by default without the need for a flag - a new environment varible NODE_NO_HTTP2 has been added to allow userland http2 to be required - support has been added for generic Duplex streams * module: - resolve and instantiate loader pipeline hooks have been added to the ESM lifecycle * zlib: - CVE-2017-14919 - In zlib v1.2.9, a change was made that causes an error to be raised when a raw deflate stream is initialized with windowBits set to 8. On some versions this crashes Node and you cannot recover from it, while on some versions it throws an exception. Node.js will now gracefully set windowBits to 9 replicating the legacy behavior to avoid a DOS vector.
- deleted 9y ago
  [deleted]
- chrisseaton 9y ago
  ‘Userland’ http2? As opposed to being implemented as a Linux kernel module?
  - gabrielcsapo 9y ago
    No, there is an npm package that has the same name. Userland === npm package
    - 10000100001010 9y ago
      I think it would be Userland instanceof npm package === true
      - the_gipsy 9y ago
        that might not work in an iframe ;)
partycoder 9y ago
Some info about CVE-2017-14919 here: http://nodejs.org/en/blog/vulnerability/oct-2017-dos/ http://nodejs.org/en/blog/vulnerability/oct-2017-dos/ To test if your version is affected: zlib.createDeflateRaw({windowBits: 8})
knocte 9y ago
How efficient is to have an HTTP2 server serving sever-push events to thousands of clients? Better than websockets I assume.
- meritt 9y ago
  I can't speak for exact performance comparisons but server-push isn't designed for events like SSE or websockets. It's designed for the client to make a request and the server to efficiently responded with multiple payloads to populate a client cache.
- pwdisswordfish 9y ago
  I'm pretty sure that's not how server push works. Client requests A, then server pushes B and C with A. Server just cannot push something to God knows where.
  - deleted 9y ago
    [deleted]
  - stabbles 9y ago
    Server-Sent Events (SSEs) are actually a thing. Sure, the client must establish a connection with the server first, but from then on data can be streamed from the server. Similar to websockets, but then a one-way connection from server to client.
    - k__ 9y ago
      But do SSEs have anything to do with HTTP/2 server push?
      - techdragon 9y ago
        They do not. https://en.m.wikipedia.org/wiki/Server-sent_events https://en.m.wikipedia.org/wiki/Server-sent_events
- manigandham 9y ago
sanxiyn 9y ago
Does anyone know what happened to Ayo.js?
- freedomben 9y ago
  It would be great to hear from an insider, but it seems to me like they are having a little difficulty establishing organization around roles/permissions. Also the GitHub repo hasn't seen any commits in a month.
  - threatofrain 9y ago
    https://github.com/ayojs/ayo/graphs/commit-activity https://github.com/ayojs/ayo/graphs/commit-activity
    - coldtea 9y ago
      Those "commits" are just bringing in stuff from Node.js as far as I can see
    - tinus_hn 9y ago
      You are in a maze of twisty pronouns, all alike. Seems like they got stuck on discussing codes of conducts and genders and forgot to do actual work.
      - syshum 9y ago
        Well they do use the slogan "Humans before technology." so I am sure "the community" is more important than any kind of actual technology, code or advancement of node
- monsieurbanana 9y ago
  I would be very surprise if people took that fork seriously.
- hasenj 9y ago
  Nothing. It was not even a newsworthy event. Someone somehow managed to get a story published somewhere about it.
nikcub 9y ago
I'd like to see the non-LTS version of node in 8.x move to OpenSSL 1.1 and expose more: scrypt, schnorr, curve25591, bn etc. There is no good internal password storage, and bitcoin operations require bringing in most libs
- jorangreef 9y ago
  scrypt: https://github.com/nodejs/node/issues/8417 https://github.com/nodejs/node/issues/8417
  - nikcub 9y ago
    Not sure if you read that issue because it was closed as it depends on OpenSSL 1.1. Fire up 8.8.0 and you'll find crypto.scrypt is undefined. nodejs will have to get the OpenSSL 1.1 upgrade in as the support period for nodejs 8.x exceeds the support period for OpenSSL 1.0.x First attempt was made here[0] [0] https://github.com/nodejs/node/pull/11828 https://github.com/nodejs/node/pull/11828
    - jorangreef 9y ago
      "Not sure if you read that issue because it was closed as it depends on OpenSSL 1.1." Sure, I opened the issue. I provided the link so you can follow it. It would be great to have scrypt in Node, as well as argon2 and DJB's chacha20+poly1305.
SimeVidas 9y ago
Does it server-push my Link preload header resources? (https://w3c.github.io/preload/#server-push-http-2 https://w3c.github.io/preload/#server-push-http-2)
- BillinghamJ 9y ago
  That would typically be implemented by a proxy or service like Cloudflare. The server itself should not do this based on header contents - instead the application should use the push protocol directly: https://nodejs.org/api/http2.html#http2_http2stream_pushstream_headers_options_callback https://nodejs.org/api/http2.html#http2_http2stream_pushstre... It wouldn't be appropriate for the http2 core module to do this implicitly, but I wouldn't be surprised if higher level server abstractions, such as Express, did implement such a feature (though imo it'd still be better to not use the Link header). It's also likely to work a lot better for a caching proxy to perform this action rather than the source server - since it can cache the contents of the resources being pushed.
raresp 9y ago
NodeJS will be way faster with the HTTP/2 support. GG!
darkhorn 9y ago
Can I use client side certificates with http2?
hanley 9y ago
Is version 8 still planned to enter active LTS on 10/31? Or does this release mark the beginning of LTS?
j_s 9y ago
In case anyone missed it, a Node module used in production at Bing to multi-thread shared memory for CPU-intensive work hit the big time last week. https://github.com/Microsoft/napajs/wiki/Why-Napa.js https://github.com/Microsoft/napajs/wiki/Why-Napa.js a bit edited: 1) quick iteration 2) multiple cores 3) share memory with structures 4) fine granularity parallelism, minimizing communication cost Discussion: https://news.ycombinator.com/item?id=15498219 https://news.ycombinator.com/item?id=15498219 (Oct 2017, 201 comments)

199 points by nikolay 9y ago

Notable Changes * crypto: - expose ECDH class * http2: - http2 is now exposed by default without the need for a flag - a new environment varible NODE_NO_HTTP2 has been added to allow userland http2 to be required - support has been added for generic Duplex streams * module: - resolve and instantiate loader pipeline hooks have been added to the ESM lifecycle * zlib: - CVE-2017-14919 - In zlib v1.2.9, a change was made that causes an error to be raised when a raw deflate stream is initialized with windowBits set to 8. On some versions this crashes Node and you cannot recover from it, while on some versions it throws an exception. Node.js will now gracefully set windowBits to 9 replicating the legacy behavior to avoid a DOS vector.

deleted 9y ago
[deleted]
chrisseaton 9y ago
‘Userland’ http2? As opposed to being implemented as a Linux kernel module?
- gabrielcsapo 9y ago
  No, there is an npm package that has the same name. Userland === npm package
  - 10000100001010 9y ago
    I think it would be Userland instanceof npm package === true
    - the_gipsy 9y ago
      that might not work in an iframe ;)

partycoder 9y ago

Some info about CVE-2017-14919 here: http://nodejs.org/en/blog/vulnerability/oct-2017-dos/ http://nodejs.org/en/blog/vulnerability/oct-2017-dos/ To test if your version is affected: zlib.createDeflateRaw({windowBits: 8})

knocte 9y ago

How efficient is to have an HTTP2 server serving sever-push events to thousands of clients? Better than websockets I assume.

meritt 9y ago
I can't speak for exact performance comparisons but server-push isn't designed for events like SSE or websockets. It's designed for the client to make a request and the server to efficiently responded with multiple payloads to populate a client cache.
pwdisswordfish 9y ago
I'm pretty sure that's not how server push works. Client requests A, then server pushes B and C with A. Server just cannot push something to God knows where.
- deleted 9y ago
  [deleted]
- stabbles 9y ago
  Server-Sent Events (SSEs) are actually a thing. Sure, the client must establish a connection with the server first, but from then on data can be streamed from the server. Similar to websockets, but then a one-way connection from server to client.
  - k__ 9y ago
    But do SSEs have anything to do with HTTP/2 server push?
    - techdragon 9y ago
      They do not. https://en.m.wikipedia.org/wiki/Server-sent_events https://en.m.wikipedia.org/wiki/Server-sent_events
manigandham 9y ago

sanxiyn 9y ago

Does anyone know what happened to Ayo.js?

freedomben 9y ago
It would be great to hear from an insider, but it seems to me like they are having a little difficulty establishing organization around roles/permissions. Also the GitHub repo hasn't seen any commits in a month.
- threatofrain 9y ago
  https://github.com/ayojs/ayo/graphs/commit-activity https://github.com/ayojs/ayo/graphs/commit-activity
  - coldtea 9y ago
    Those "commits" are just bringing in stuff from Node.js as far as I can see
  - tinus_hn 9y ago
    You are in a maze of twisty pronouns, all alike. Seems like they got stuck on discussing codes of conducts and genders and forgot to do actual work.
    - syshum 9y ago
      Well they do use the slogan "Humans before technology." so I am sure "the community" is more important than any kind of actual technology, code or advancement of node
monsieurbanana 9y ago
I would be very surprise if people took that fork seriously.
hasenj 9y ago
Nothing. It was not even a newsworthy event. Someone somehow managed to get a story published somewhere about it.

nikcub 9y ago

I'd like to see the non-LTS version of node in 8.x move to OpenSSL 1.1 and expose more: scrypt, schnorr, curve25591, bn etc. There is no good internal password storage, and bitcoin operations require bringing in most libs

jorangreef 9y ago
scrypt: https://github.com/nodejs/node/issues/8417 https://github.com/nodejs/node/issues/8417
- nikcub 9y ago
  Not sure if you read that issue because it was closed as it depends on OpenSSL 1.1. Fire up 8.8.0 and you'll find crypto.scrypt is undefined. nodejs will have to get the OpenSSL 1.1 upgrade in as the support period for nodejs 8.x exceeds the support period for OpenSSL 1.0.x First attempt was made here[0] [0] https://github.com/nodejs/node/pull/11828 https://github.com/nodejs/node/pull/11828
  - jorangreef 9y ago
    "Not sure if you read that issue because it was closed as it depends on OpenSSL 1.1." Sure, I opened the issue. I provided the link so you can follow it. It would be great to have scrypt in Node, as well as argon2 and DJB's chacha20+poly1305.

SimeVidas 9y ago

Does it server-push my Link preload header resources? (https://w3c.github.io/preload/#server-push-http-2 https://w3c.github.io/preload/#server-push-http-2)

BillinghamJ 9y ago
That would typically be implemented by a proxy or service like Cloudflare. The server itself should not do this based on header contents - instead the application should use the push protocol directly: https://nodejs.org/api/http2.html#http2_http2stream_pushstream_headers_options_callback https://nodejs.org/api/http2.html#http2_http2stream_pushstre... It wouldn't be appropriate for the http2 core module to do this implicitly, but I wouldn't be surprised if higher level server abstractions, such as Express, did implement such a feature (though imo it'd still be better to not use the Link header). It's also likely to work a lot better for a caching proxy to perform this action rather than the source server - since it can cache the contents of the resources being pushed.

raresp 9y ago

NodeJS will be way faster with the HTTP/2 support. GG!

darkhorn 9y ago

Can I use client side certificates with http2?

hanley 9y ago

Is version 8 still planned to enter active LTS on 10/31? Or does this release mark the beginning of LTS?

j_s 9y ago

In case anyone missed it, a Node module used in production at Bing to multi-thread shared memory for CPU-intensive work hit the big time last week. https://github.com/Microsoft/napajs/wiki/Why-Napa.js https://github.com/Microsoft/napajs/wiki/Why-Napa.js a bit edited: 1) quick iteration 2) multiple cores 3) share memory with structures 4) fine granularity parallelism, minimizing communication cost Discussion: https://news.ycombinator.com/item?id=15498219 https://news.ycombinator.com/item?id=15498219 (Oct 2017, 201 comments)