4 ms·

Why didn't they foresee this before releasing Node.js 16? OpenSSL 1.1.1's lifecycle[0] was known well in advance of the Node.js 16 release. Why did they release

Why didn't they foresee this before releasing Node.js 16? OpenSSL 1.1.1's lifecycle[0] was known well in advance of the Node.js 16 release. Why did they release it with an EOL date they could have known was impossible, and then later change the EOL date? This seems like a release engineering failure. Communication now is great but they had an opportunity to get this right from the beginning. As a result, we can all now be certain that Node.js's LTS support dates don't mean anything; they don't have the engineering discipline to make support promises they can keep. On multiple occasions now they've shortened their published LTS support periods after the fact. [0] http://web.archive.org/web/20210403090336/https://www.openssl.org/policies/releasestrat.html http://web.archive.org/web/20210403090336/https://www.openss... -- this is prior to Node.js 16's release

sanjayio 4y ago
I’d cut the Node team some slack, they’ve been doing phenomenally scheduling EOL and LTS support over the years. They’re notifying everyone 1.5 years in advance. They have some of the best backwards compatibility I’ve witnessed in software which means updating will be easy.
linkgoron 4y ago
I think that this is a quite harsh. The EOL for Node 16 is more than a year away, there's a good reason for the EOL change, and Node 18 will be LTS almost a year by then.
saghul 4y ago
Chill. To err is human. They are communicating this welll in advance so everyone has about a full year to update to Node 18 LTS. I’d say that is a very reasonable timeframe.
joshmanders 4y ago
You realize they have a schedule pattern right and they probably didn't realize openssl EOL was in the middle of a LTS lifecycle.
- linkgoron 4y ago
  The dates were known in advance - however, the Node.js team expected OpenSSL 3 to be out before the release of Node 16, but it didn't happen - so they had to release with OpenSSL 1.1.1. I think that there was some minor hope of maybe upgrading, but obviously it was too backwards-compatibility breaking to land without a new major. https://github.com/nodejs/TSC/issues/1222 https://github.com/nodejs/TSC/issues/1222 https://github.com/nodejs/TSC/pull/859 https://github.com/nodejs/TSC/pull/859
ldoughty 4y ago
According to your linked article: > The OpenSSL 3.0 release schedule is documented on the OpenSSL 3.0 Release Schedule wiki page. We expect the final release to be in early Q4 2020. Node 16 Release date: > 2021-04-20 They gave themselves 3-6 months buffer from 3.0 release to Node 16 release, and decided to move forward when OpenSSL was 4-6 months behind schedule, with no idea when 3.0 would release OpenSSL was then released in SEPTEMBER of 2021, nearly a year late, and 4 months after Node 16's LTS start date.... As of April, the Node team could not know if OpenSSL was going to be released tomorrow, next month, or next year I think they made the right choice to keep moving forward instead of halting work waiting on OpenSSL to get back on schedule... by April 2021, when SSL 3.0 was already ~5-6 months behind, I would have expected them to extend support for 1.1.1 for another few months... they didn't but that's mostly a moot point -- OpenSSL has committed to security fixes through the Node 16 end-of-life.. but the Node team isn't comfortable with that, so they made a change
- electroly 4y ago
  It seems I didn't make my suggestion clear, since you seem to be arguing against a point I didn't make. I'm saying they could have, and should have, announced the shortened LTS period when they released Node 16, after having already made the decision to ship with OpenSSL 1.1.1. The support period for OpenSSL 1.1.1 was known at the time -- why did it take this long for them to notice and pull back their LTS date accordingly? It could have been known on the day of Node 16's release. The important part of LTS releases is being able to make plans around firm dates; the specific length isn't important as long as it's known up front.
charcircuit 4y ago
>known was impossible It's not impossible. They just have to support more.

sanjayio 4y ago

I’d cut the Node team some slack, they’ve been doing phenomenally scheduling EOL and LTS support over the years. They’re notifying everyone 1.5 years in advance. They have some of the best backwards compatibility I’ve witnessed in software which means updating will be easy.

linkgoron 4y ago

I think that this is a quite harsh. The EOL for Node 16 is more than a year away, there's a good reason for the EOL change, and Node 18 will be LTS almost a year by then.

saghul 4y ago

Chill. To err is human. They are communicating this welll in advance so everyone has about a full year to update to Node 18 LTS. I’d say that is a very reasonable timeframe.

joshmanders 4y ago

You realize they have a schedule pattern right and they probably didn't realize openssl EOL was in the middle of a LTS lifecycle.

linkgoron 4y ago
The dates were known in advance - however, the Node.js team expected OpenSSL 3 to be out before the release of Node 16, but it didn't happen - so they had to release with OpenSSL 1.1.1. I think that there was some minor hope of maybe upgrading, but obviously it was too backwards-compatibility breaking to land without a new major. https://github.com/nodejs/TSC/issues/1222 https://github.com/nodejs/TSC/issues/1222 https://github.com/nodejs/TSC/pull/859 https://github.com/nodejs/TSC/pull/859

ldoughty 4y ago

According to your linked article: > The OpenSSL 3.0 release schedule is documented on the OpenSSL 3.0 Release Schedule wiki page. We expect the final release to be in early Q4 2020. Node 16 Release date: > 2021-04-20 They gave themselves 3-6 months buffer from 3.0 release to Node 16 release, and decided to move forward when OpenSSL was 4-6 months behind schedule, with no idea when 3.0 would release OpenSSL was then released in SEPTEMBER of 2021, nearly a year late, and 4 months after Node 16's LTS start date.... As of April, the Node team could not know if OpenSSL was going to be released tomorrow, next month, or next year I think they made the right choice to keep moving forward instead of halting work waiting on OpenSSL to get back on schedule... by April 2021, when SSL 3.0 was already ~5-6 months behind, I would have expected them to extend support for 1.1.1 for another few months... they didn't but that's mostly a moot point -- OpenSSL has committed to security fixes through the Node 16 end-of-life.. but the Node team isn't comfortable with that, so they made a change

electroly 4y ago
It seems I didn't make my suggestion clear, since you seem to be arguing against a point I didn't make. I'm saying they could have, and should have, announced the shortened LTS period when they released Node 16, after having already made the decision to ship with OpenSSL 1.1.1. The support period for OpenSSL 1.1.1 was known at the time -- why did it take this long for them to notice and pull back their LTS date accordingly? It could have been known on the day of Node 16's release. The important part of LTS releases is being able to make plans around firm dates; the specific length isn't important as long as it's known up front.

charcircuit 4y ago

>known was impossible It's not impossible. They just have to support more.