Node.js Core Technical Committee, 25 Jan 2017

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: 2017-01-25 Node.js Foundation Core Technical Committee (CTC) Meeting

Description

https://github.com/nodejs/CTC/issues/63

A

B

C

All right, this is the node ctc meeting for january 25th to go ahead and start peace. Stand up. My uncle culture info box you'll see the list Susie of this lamp, not even actually good for tourists.

A

D

C

E

She wrote no audio in the chat, so.

C

um So Bradley.

F

I, don't have any real updates we're just at tc39 next week we'll have the vote on sync vs, async loader.

C

Okay, next is Nikita I.

G

Don't have anything for domains from today here, so next one is cold.

G

H

Nothing as usual to say viewing issues and for quests opened a few poor quest. My next as I think Jeremiah.

B

I'm, just a sightings issues other not to me its modules stuff, the sink purses, async loader thing next would be stracy here.

B

So Fodor is module.

I

Okay, yeah, so uh not too much for me so I since the last time we talked it was quite a while ago, I worked on trend, hack, crack VHC within the process and externally. So it turns out. You can do it remotely yet so we are kind of safe. Also I was participating in a all nodes call with v8 team.

I

We, a team, is now aware of all note and I think so why cooked so, but I'll leave it up to them are also working, some iOS apps, which is completely unrelated to this call and as usual, fixing bugs movie report. Quests next is James.

C

This week, at tc39 been working on HTTP two more and reviewing a landing teeth or is Josh.

E

Yeah sorry, I missed last week, uh hmm so we held a diagnostics working group meeting at the end of last week, also generally trying to move inspector stuff and trace controller stuff forward. We got note, inspect moved into the foundation a couple days ago um and I've been doing a little work with security. Breaking group next is Michael Dawson right.

J

On catching up from being on vacation last week, so looking at some issues reviewing commenting landing a little bit of fix up for code coverage and benchmarking pages that were messed up by I, changed the style, location and starting to look at a mod to the smallest job. So we can land the updated via conversions, basically to make it not fail and just take it like basically not run on that on tomorrow s for 14 and but not fail. The job next is Julian here now, Michael Rogers here.

J

Brian wait.

A

Hey so I, mostly just was working on my optimization PRS that I had out there and landed some of them either that our last night other than that just normal reviewing pr's are coming and issues next is ally.

K

Yeah I'm, so I was working on a few things. They were some epi changes in v8 5.7. That I was with a relative debug that I'm working with me team one trying to figure out how to make them work with know it and they're. There was a regression in v8 5.7 on on acne here that I isolation, but a devotee and be a 77 and beyond that working with Matthew luring on FF I, pretty much it I'm on the phone, so I don't know who's next.

C

K

C

K

Up, if somebody else can.

C

Them: okay, maybe I dimethyl reboot, my computer, for showing interest.

A

I believe it's uh Michael yeah yeah.

L

Can you hear me yeah yeah, yes, so the usual the issue and for request, review and I've started working on the v8.

M

L

Dot 6 update, which would become stable next week, so I already opened the poor request to see how it works on the CI and that's it.

L

C

C

Is that all them than anything I'm.

J

Trevor occur, or next person is Phil. Things in is rich.

A

Yeah I think we've hit everybody yeah, okay,.

C

Well, my wife still coming up I can't see the review for watch to eat, so somebody wants to read that off and they will get a big agenda.

E

Yeah I could read it real quick I put the three items that are not on the agenda again next week at the top. So last week we reviewed the proposal to move the guides to noche esta org and I know that happened this week. So I guess that was ok growing the group of releasers, um we said, wasn't there last week, but I know.

E

Two weeks ago we said that we were gonna, bring in and eat a lo look at the two people and they note inspector on the foundation, the CTC and the TS able to prove that. So we did that this week and last week we talked about copyright, deprecation policy process, global being clobbered nes modules, which are all on the agenda again. Today,.

E

You want me to read the first 10 for the agenda. Jane, you see that I'm getting there right, I put the top that updating the copyright and the two things about process and deprecation policy right up at the top. So that's the first two year to have anything, though.

C

E

C

Say on the copyright stated: there's really no updates that is going before the board the board meeting next week on the 30th, where this is scheduled to be discussed, they're going to review the proposed changes and basically defect or some other things that this is but which one of those PRS they want to go basically automatically.

C

There are a couple of changes to the revised p are the ones that have to provide cheddars. I need to make this week, but those are more editorial might ask that anybody that this, because that has some feedback. Please get that data before friday, because in any significant changes we make after the board will chat it. London packing to be made, go to another board review which will take another month. So please don't like it. The comments in on this.

C

um Anyone have any questions, comments, I'll pay for discuss on the copyright stuff.

C

Next, one on here is 10 15 50 best when process global is clobbered.

C

The things which is a reminder, and so on, where, if process is click on find a null value, is getting up crashing, though that had a poor was out there for Mickelson change here that no Bradley who had some concerns about this? You want to kind of sure.

F

We talked about it last week. The PR just has an outstanding thing where it needs to revert the process global, so it is writable again and bin said he was okay with that last time, so I'm just waiting to play gonna change.

C

I'm, sorry, those those PR 101, please contact.

C

So is it pretty much, is waiting on been to make the change in PR or you.

F

Know and then I'll flick to approve.

C

I anyone have any other thoughts server news on that. One.

G

Sure that is not going to break something, or some of these cases and you'll still have to show that on some Leo, please so.

F

This PR only affects the native module rapper by creating a special closure, so native modules always get the proper process object. I am sure somebody is using this in order to change native behavior, but that's exactly what we don't want to allow.

G

Sometimes people define something like process.

G

J

G

Mean that sometimes they assign process or their own implementation to the process variable itself and we'll let you walk.

F

uh Once been changes, the outstanding thing preventing it from being merged, yes, it'll still be a writable global variable.

C

You it looks like look at. You know at this point, dis, wait for the review, our wait for the update a little bit more review and then effect just.

B

To clarify the the global variable will be writable, but the idea is that you can't change internal behavior by overriding correct.

B

D

D

um Okay, any other thoughts or opinions on that before we move on.

G

Also, the ride in the interim behavior is sometimes used in deaths like they're, one that I, which I actually that is broken or not. I think that still have to be shaped.

G

C

So we get, are you fine with this grand.

C

View in PR, or do you think, there's a decision we need to make here now.

G

It's letter to move that to github.

C

Okay: let's do that.

C

Alright, so PR 101 16. This is the one for adding need a code to earnings and adding deprecation codes. This has been out for a while I'd like to get this land it this week, come on the final call for any objections, and assuming there are no objections. I'll get. This landed on Friday.

L

But it's not a regression to the landing, but I I made a comment about the opening of.

L

File descriptor multiple times did you see it yeah.

C

I thought I was infidelity that you take on that tonight and updated to make any changes at a necessary.

C

Now I appreciate you taking a particular task for doing all of you.

C

Before we commit too much on the replication, IDs I want to make sure everyone's okay with basic format and interested prefix the bep, and then it's the beeps forward numbers here. Zuzu a lot of time, I've been increasing, I didn't run. It I really want to make it any more complicated than that. I'm ensure things ok without before we camp in stone.

C

C

Thank you. The new windows Ebony's, you know equipment. Please, please wait. I guess yet I want to get it rises on credit.

C

Any other comments on that here. Questions on that one before removal.

C

Next up is 7964 deprecation policy.

C

Again this is PR seeking to get clarity around our deprecation policy. I bet supposed to go in and make a couple extra notes. I know a little bit, that's difficult in you that I did not do that. I would do that today, mainly just need review. What I'd like to do is.

C

Good, we call for a vote next week on this. If we yeah, assuming we don't get review LG gems and get out there enough to come to teach you to land it. There then call for a vote next Wednesday to send later with an American, but please definitely take place sometime this week. We're getting that peel and lien on it. You got gmail.

C

Anyone have any comments or concerns on that.

C

Ok again to the agenda: pretty quick, the next one is 1028 to enforce type check and deep strip. T well I'm, not sure who put this one on and it fell the Commissioner for am unable to pull it out the template to added this one.

B

B

Looks like rich I did it.

C

If I can actually pull up here,.

B

um Just there's a comment associated with that does.

E

It say cember major, maybe that's it yeah.

B

I think she'll, but the looks of that.

F

B

Because, technically it's on the assert API in this sort, a p.I is locked, yeah I! Think that's the.

C

Primary concern there's been a number of some discussion and that controls on it a bit, but that I think the key question was: do we want to make it physically breaking its Debra major change to a lock module I.

C

Think that's better key question.

B

Questions like what does this actually change.

N

Be Jesus some tests, expectations like it negates the expectation is also some days.

C

C

The change is stealth.

C

It makes sense it makes it all more big bust.

C

It does it does make the check mr.

C

I think that is what a great example break coming in or.

B

Not stricter in the case of reg ex as I guess so for from looking at the test. It looks like additional properties on reg. Exes are now ignored, which kind of makes sense, because I mean you're, usually just going to be checking like the actual. What's what's in blink, regular ex stuff, but.

C

Hey they don't turn upon accepting this, but it does go back to it. Is the models walked, I'm gonna, except in limited on it, does kind of a key issue.

C

C

C

Does anyone against the Keen exchange.

C

The silence ino or does that mean not sure.

I

I'm not quite sure about it, so I am really worried about changing this module because it has, it will have a big repercussions over take a system with everyone relies on. It grows browser fire alive. No, everyone liked that it does have a copy. Okay, so um I would be really careful with this. So I don't know if we could maybe start with something less intrusive. For now.

C

You all right, I think that's fair.

C

B

I mean it looks like there's a lot of sort of more general, reflecting here, I'm, not sure. If that's so I'm, seeing or not it might be uh well, I guess those five convincing it so maybe be best to have everything else sort of taken out and then, like the actual bits that could be some / major. Have those separately yeah I'm, not sure how much it does. It doesn't change here. So.

C

Let's actually think that's a good point. M2 I'd commit.

B

ah Mean so I assume run was run against this, but I think I'm not sure if they stop data from max it was fairly old. Now now we don't so that would need to rerun. I wonder if we really test enough to check whether we might not have more percussions from this than we'd like from what we currently testing such them.

D

B

D

Don't really expect.

B

The most of most of the large modules that we be chucking would run into these particular things that seem to have changed.

C

B

C

These big miles here in an hour after so I'll, ask.

I

C

P know that they, the models that were checking antigen right now make it be used. Third, any indicator is ill.

C

I'll just see what we can do there I think separating out these and Burma major mids, possibly even to a separate PR from whatever pier, is, would definitely make it better. It would be easier to be great suggestion.

C

C

Basically separate those out yeah, except the teacher Serena separated out the next, the assembler major parts do additional testing decision.

C

And then it's kind of the results from this okay, so that essentially, is still blocked.

D

C

The next one up is 8381 support for environment, to find proxy.

C

Let's see who added this one.

C

Can orbit you added it okay, but this has come up a number of times in the past um whether core should support the ability to set foxy, groove environment. Variable I know that there are eight figures. A couple of these are mine options for this already, but should it be in core? It's a pretty common thing. With some with a number of platforms, we've always going to taken the position quarter. That's not.

C

To serve to be in court, I guess the discussion. Is it wouldn't really visit that.

I

I feel very strongly about it, so I'm totally against having this high level functionality in core, because it will introduce many moving parts and in general will make user applications behave in a less. How do a worthless expected way so like so it does so many things under the hood. So it tried it's hard to expect it's hard to understand what's happening occasion, so I'm against this kind of functionality.

L

Does anyone know if it's possible to do it from a user land module to like something that you would require at the start of the application and modifies the HTTP module.

C

L

C

Are a couple of models to kind of you need funky things to make it comfortable there.

F

Are attempts yes, but mpm moved off those and has its own entire proxy logic. Because of this problem.

I

Okay, so how about is what if we would provide sort of an API hooks for the ethernet module so instead of having a full-blown perks, implementation we'll just have sort of API in HTTP module to use it internal in core for all modules. So some select, this I guess, could work.

A

Can you almost just do this by Rick replacing like? Can you do this like within an HTTP, a gender, so I'm just replaced the Colville Asian or something, or is that not work.

I

Synchrotron tool, work, yeah.

C

Anything I basically already have some so.

F

C

Lot that will work for this. The.

F

Problem with the global agent is sometimes people use modules that do HTTP requests on your behalf, and you can't really control their agents, usually so.

I

Their agents inherit from like the global one in some sense, so if we could override the class definition for the agent, it will probably make it work for everyone.

F

Presumably I would check against type requests. As the canonical example.

C

You so you I mean the idea. There is not necessarily to have something that would be automatically inherited by everybody, but in avionics. That would allow those who want to tap into it to be able to.

I

Yeah, either way, I think we should not have the proxy called inside of the core I think we should just provide hooks in why one way or another.

C

You suspected that those hooks can be get in a way. It's not going to add too much of a negative impact on performance.

I

We'll probably have some negative impact, but are aiming hooks, sorry or proxy.

C

The hooks when I win the magic would be an additional picture. The potential.

I

Issues, no other things are any impact possible from introduction of the hooks.

C

And I think I'd be, gives a better place.

C

C

Is anyone hope feels strongly that we should listen.

C

But the environment variables haven't, we thought might be set.

C

C

The busines ecology, you said it seems like you- would be. Okay with having the environment variable theory evening. You can donate it.

F

Or I'm neutral I'm, just saying that we should probably test against a module. We know doesn't use the global agent.

C

Okay, well I'm. We can think that back is into that position back to the thread.

C

The door did you want to take some time to going to work with the are.

C

I

Posted some preliminary comment with brief description of what in suggested here so I, guess, that's probably enough for now. Let's see how it will evolve.

C

This you've comment: baby posted, ok, cool, okay; well, let's go ahead and move on continue the conversation there in github and see how valuable.

C

I want to talk about models, but I'm gonna push that to the very end. Let's do if you won 0187, add node. It affect.

C

Josh is this one yours.

E

Actually rich acts ask that we put on the agenda for today that one in particular is the is about well note inspect. We we've said that it's going to go in depth, I think that in that PR I think onna actually made of an extra commit that integrates it. Where node space debug is now like the CLI, debugger and I.

E

Guess rich is saying it take a look at that. It's I think it might be ready to land. I haven't looked at it for a month or two.

B

No I'm still not entirely sure about having it vendor din as a dependency rather than having it just in the source files like the previous debugger was.

C

This is it, would, it include node inspect with the default, build like super dear release. Build would notice that to be included in that deliverable in a profile. It.

B

I imagine so for either way.

C

Are we ready to take that step.

E

How'd it go I didn't know these I think we need a little more review on the. In fact, I would like to do review another one out, and you know if anyone else can do one I think that would be helpful to know I, don't I I think it needs a little more review before we can land. If that's the question.

C

But I'm I I would like more review for Lance, but I I'm thinking that I'd prefer it not to be enabled and it in a release, build and for a little while longer and you can have it in core and how people use me this experimental, just to kind of make sure everything this is working before we put you off every school. That's all I'm thinking, yeah.

B

It's probably good.

C

Basically, switching it so that it's off by default, it is not available by default. Emily's.

C

C

Now, if we can get that ready, then click include out quick and plastic and it would be fantastic addition before 800.

C

It would really like to promote a little more conservative, but.

C

C

Oh, okay, anyone have any concerns here.

C

C

C

Okay, so I guess it's just pretty much. Take the back to github. Do more review targeted at least been landed and master.

C

Fairly quickly, so we can get some people plan around.

I

Yep make sense: okay,.

C

um Modules node eps 339, so you have about 20 minutes left. Rarely do you want to do? Is it and update.

F

I mean there's not much going on update wise. We had a call last week discussing the differences of if we ship a sink or a sink loader and next week, I'm going to call for a vote on which people would like to do.

F

Basically we're not talking about import as a function ever being synchronous specifications, as that is always a synchronous, we're talking about how I Oh happens and if it blocks things and the return value for requiring an es module.

F

So in an async loader world requiring esm returns a promise which is a breaking change from how Babel works. But we also have several other breakages from babble like the named imports of comedy is not being something we can ship immediately.

F

So that vote will be next week. If you go and check a doodle I sent to the entire CTC, it's got some slides. You can review. If you have any questions. Let me know, as for tc39, that's going on this week today we should get to discussing a grammar change or disambiguating source texts, so that would mean given any source text. You would be able to figure out if it is a module or if it is a script.

F

It's going to be hard to pass just given some concerns about it, but tc39 has mixed feelings generally. What I've seen when they have mixed feelings? Is you don't go ahead? The default route is not to change the standard, so we'll see how it goes.

F

So those are the two decisions we have really is a sink versus sink loader, and if we get the grammar change, do we want to do double parsing versus file extension, which we had a vote a long time ago about doing the double parsing will be the preferred approach. So that is our current stance. Unless something has changed and somebody wants to bring up that the file extension it's their preferred way to do.

F

Yes, that's it.

F

D

You need anybody, have any questions. Spot.

C

C

C

Of the season, do you have anybody watching the live stream? Dreamer yep. We put out a call for questions yeah, so.

B

I posted it already, there's hellos from Tunisia, China and Germany, and then someone has a fairly large question. So someone asks if essentially, if there would ever be code protection in no GF, so um I sent so some sort of form of way of protecting so source code that you would run with nodejs. um So say you ship this to a client and you didn't want them to be able to read some code for an odious server.

B

um It would there ever be any sort of plans or ideas, or is there any way to do that? I.

F

Know of two existing solutions for this, so I I'm hesitant that it would ever make it in the course, since there are companies built upon this already, that would be significantly difficult to create something in court. It would be safe in the sense that they couldn't leave code reliably.

F

C

Yeah I would it would be very surprised if we were ever able to add that to core orbit, something that you would necessarily want to do.

F

But just for the record I know: JX core uses make snapshot to try to hide it, but it's still accessible from any sort of debugging context and required out Cashin access things.

F

J/S rambler is the other big wig in this area and they do a lot of code munging and inserting things to make it hard to debug I.

M

Mean I guess once whether whoop assembly supported, if Yuri, translate your JavaScript web assembly, then at least they wouldn't get the JavaScript code out of it.

C

It's just being able to provide those kind of protections. Reasonably is really really freaking complicated and being able to make assurances, and they would require some fairly significant changes to Cork I. Don't think that you'd be willing to make yeah.

B

I I think personally, that if you really need to do this, and no other option will work, probably your best in bet is best bet is to go a sort of like embedded style rut with no Jess, where you like, modify nodejs a bit to essentially read like some other encoding part of the file that you know is then like JavaScript or maybe in the future web assembly or whatever.

B

That's like scrambled, not like in-plane source or whatever, and have like in the binary like have like parts of the binary protected that are for reading that and get rid of like debugging parts of node and stuff. It be fairly involved, be honest.

F

The main problem is the way JavaScript has to stream on scripts, so you can just read scripts. They are permanently stored in memory as large strings. Even if you do all of that.

D

Then we need them that went out before.

C

We even make do a man next to this there's so many candidates we made you we'd, have to be able to have ability to only run trusted code and be able to verify that it only trusted code is running. You have to be able to secure a memory.

M

C

Or you can do exactly what, rather just describing just turn extract it, what a memory or even used JavaScript built-in api's to get it.

C

That would be a massive change.

C

Hopefully that answers the question: if somebody wants to work on it and propose it, you want to they come up with a PR that you know just how to do it. That I'm sure he'll be happy to look at.

C

Any other questions.

C

B

No I don't think so. I.

E

Was going to mention day, I put it in the thread for the meeting today. Maybe we should try to use pc review for some of the items like gah the copyright discussion and deprecation policy where they're mainly just to say, hey, everybody know that Patty's on the radar and review them I'll, make it easier for people preparing for the meeting or reviewing the notes and stuff look.

O

So you know, there's no difference between labeling at ctc agenda and CDC review. Then, if we're going to like be talking about the meeting, the UM the purpose of the ctc review label initially, although it seems to have evolved into not doing this anymore, which was to flag things that we actually don't want to review at the meeting that we want to try to process on get up only and that's unnecessary, contradicting what you're saying Josh, but just providing a little bit of context. It.

B

Might be a useful actually to.

B

Essentially, have a like a list of them for the meeting and just like list off what they are but not discuss them. Would that would that make the entire thing a little bit more visible, I yeah.

C

B

C

K

I think that concludes the public open of you thanks. Everyone.

C

Was listening for joining in.

C

Go ahead and adjourn the public portion Jeremih, let me know when raw.

B