Node.js Node.js Interactive North America 2016, 15 Dec 2016

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: KEYNOTE: Mission Critical Node.js - Security, Reliability, Efficiency by Joe, McCann, Node Source

Description

KEYNOTE: Mission Critical Node.js - Security, Reliability, Efficiency - Joe, McCann, Node Source

Node.js powers an astonishing amount of everyday software - applications on the web and desktop, the back-ends of massive APIs, embedded in IoT and robotics, and so much more. At NodeSource, we’ve created N|Solid to ensure that Node.js in production is secure, reliable, and efficient . NodeSource N|Solid just hit 2.0, and is relied upon by companies like MasterCard, Conde Nast, NewsCorp, and more. Over the past year, we’ve seen events dealing with security and reliability of our ecosystem that have that have caused us all concern. It’s time to address them.

About Joe McCann
Joe McCann is a cofounder and the CEO of NodeSource Inc., the Enterprise Node.js company providing expert-level services such as support and training while also offering the only premier Enterprise Node.js runtime environment, N|Solid. With more than 15 years of web, mobile and software development experience, Joe has worked with myriad Fortune 500 companies helping them build real, usable products.From performing as a techno DJ to working on Wall Street, Joe's perspective he brings to technology is rather unique. Joe is a frequent speaker on the global conference circuit, speaking at JSconf EU, NodeConf, NodeConf EU, dotJS SXSW and many, many more, actively promoting emerging technologies, like Node, and relevant business use cases to bring pragmatism to futurism.

A

My name is Joe, McCann, music is still playing. That's kind of interesting. I did not have a soundtrack by the way. My name is John Mackay and I work at notes source- and this is my second year in a row having the honor to present at Note interactive and it's a privilege to represent such an amazing team at node source, to talk about what we're both most passionate about and that's no js'.

A

We focus heavily on security, reliability and extensibility for our contributions to node, and today, I want to dive in a little bit about some of the things that we've done and some of the things that we're going to do going forward. Focus here note is actually the fastest growing open source project in the world has around six million users and is growing about a hundred percent year-over-year, and a lot of this growth is attributed to the wholesale adoption of node by companies in every industry at node source.

A

We are extremely proud of our contributions and leadership in the open source side of nodejs and we're equally delighted to serve the needs of enterprise users of node as well, and that's why, a little over a year ago, we launched a product called n solid, which is effectively an enterprise-grade version of node targeting a lot of the enterprise use cases when it comes to node and just last month we released our 2.0 version of and solid to focus again on security, reliability and extensibility of running nodejs apps in production.

A

It's now relied upon by companies and government agencies like NASA MasterCard, Conde, Nast, News, Corp and many other companies. We've been really fortunate to solve a lot of challenges for them when it comes to running nodejs in production, but don't take my word for it. Nasa has told us that mission-critical code is the rule at NASA, but using something like and solid.

A

Along with our support, a node source has proved to be invaluable to them, enabling them to scale rappelled their tech side, so they can focus on their real mission, which is space exploration, MasterCard told us, you haven't a tremendously efficient and secure runtime, but also it enables them to resolve issues in production faster. This memory leak plaguing them for months months solved in just a short amount of time within solid conde, nast, a hundred-year-old brand.

A

Arguably, a Titan of the publishing and media industry loves how an solid provides them with security, vulnerability notification for their applications and deep process insights into the nodejs processes themselves. That is only available in an solid and I think this one just kind of speaks for itself. We've listened to a lot of the challenges for running node in production, and we also know that a lot of our customers and the community members out there are using progressive technologies and that's why n solid now runs with docker kubernetes cloud foundry.

A

We also support running in your data center in your hybrid cloud, natively on GCP, AWS and Azure, and today, I'm actually really excited to announce that we've officially partnered with Amazon and and solid, is now available in the Amazon Marketplace Barry Russell GM, an AWS States. Our customers want easy to use software like n solid, that is available for immediate purchase and deployment in our marketplace.

A

Our partnership with node source demonstrates our joint focus on offering the most secure, stable and frictionless tools to power your business and that secure aspect has been the focus for node source as a company and is personified in n solid. We have the most institutional knowledge of node of any company we've pretty much seen it all at this point. This is why we baked into n solid our enhanced security capabilities, making your node apps even more secure.

A

We actually landed zero fill buffers in node core. This was a feature of n solid last year, but, as many of you are aware, there was a security vulnerability with a well known module the WebSocket module. We decided this should land in node core, not just in our products, so we did exactly that, but n solid also has listened to some of the challenges of running node in production for highly regulated industries.

A

We provide the ability for people to lock down that runtime, similar to what they're doing with Java and.net through configurable security policies and it finally, real-time security, vulnerability, monitoring and notifications in production. Whether it has been running for a day a month a year will notify you, if all of a sudden there's a known security vulnerability in your node modules and as part of our core commitment to security.

A

I'm really happy to announce today that we've officially partnered with snick snick, is a best-of-breed security company and they have an incredibly thoughtful and brilliant security research team by leveraging their deep knowledge of security issues, issues and potential threats. We at node source are passing along this insight to our customers within our products and speaking of products we're taking our dedication security one step further. One of the biggest strengths of the NPM ecosystem is its size and its community and its set of collaborators, but there's also some weakness in that. What models do I use?

A

How do I manage my dependencies in a highly regulated environment? How do I know they're secure at node source, we're launching today, our private beta for certified modules? Our set of certified modules are the modules that you use today, things like requests and lodash, but we've run these modules through our own certification process. Do they have known security vulnerabilities? Do they have a permissive open-source license?

A

Are there tests passing and a number of other criteria so that we can put our stamp of approval on it to say to folks out in the enterprise we've got your back. We will support you. No more left, Pat incidents, no more outages, no more downtime. This is what we're aiming to accomplish with certified modules. Now the node community has done, and continues to do, an amazing job enabling those six million node users to benefit from the collaborative environment of the NPM ecosystem.

A

What we are aiming to do is bring that level of confidence and trust into the enterprise, so that people can feel confident building secure, node.js applications. We still have some spots left I recommend you go check out. Certified dot, node source comm today sign up and thank you.