Node v8.8.0

[nikolay]

Notable Changes

* crypto:

- expose ECDH class

* http2:

- http2 is now exposed by default without the need for a flag

- a new environment varible NODE_NO_HTTP2 has been added to allow userland http2 to be required

- support has been added for generic Duplex streams

* module:

- resolve and instantiate loader pipeline hooks have been added to the ESM lifecycle

* zlib:

- CVE-2017-14919 - In zlib v1.2.9, a change was made that causes an error to be raised when a raw deflate stream is initialized with windowBits set to 8. On some versions this crashes Node and you cannot recover from it, while on some versions it throws an exception. Node.js will now gracefully set windowBits to 9 replicating the legacy behavior to avoid a DOS vector.

[chrisseaton]

‘Userland’ http2? As opposed to being implemented as a Linux kernel module?

[j_s]

In case anyone missed it, a Node module used in production at Bing to multi-thread shared memory for CPU-intensive work hit the big time last week.

https://github.com/Microsoft/napajs/wiki/Why-Napa.js a bit edited:

1) quick iteration

2) multiple cores

3) share memory with structures

4) fine granularity parallelism, minimizing communication cost

Discussion: https://news.ycombinator.com/item?id=15498219 (Oct 2017, 201 comments)

[partycoder]

Some info about CVE-2017-14919 here: http://nodejs.org/en/blog/vulnerability/oct-2017-dos/

To test if your version is affected:

    zlib.createDeflateRaw({windowBits: 8})

[hanley]

Is version 8 still planned to enter active LTS on 10/31? Or does this release mark the beginning of LTS?

[SimeVidas]

Does it server-push my Link preload header resources? (https://w3c.github.io/preload/#server-push-http-2)

[BillinghamJ]

That would typically be implemented by a proxy or service like Cloudflare. The server itself should not do this based on header contents - instead the application should use the push protocol directly: https://nodejs.org/api/http2.html#http2_http2stream_pushstre...

It wouldn't be appropriate for the http2 core module to do this implicitly, but I wouldn't be surprised if higher level server abstractions, such as Express, did implement such a feature (though imo it'd still be better to not use the Link header).

It's also likely to work a lot better for a caching proxy to perform this action rather than the source server - since it can cache the contents of the resources being pushed.

[knocte]

How efficient is to have an HTTP2 server serving sever-push events to thousands of clients? Better than websockets I assume.

[manigandham]

Do you mean Server-Sent Events? That's a well-supported and efficient model that'll work fine, although the payload will always be heavier than websockets since all the headers have to be sent, even if compressed within the HTTP/2 stream. It's also not supported on IE or Edge.

If you actually mean server-push then that would basically be long-polling and not very efficient, also it's meant to send along assets that the server already knows will be needed for a request (like CSS with the HTML). There's not much client-side API to actually deal with server-push because it's just like another network http request/response.

[meritt]

I can't speak for exact performance comparisons but server-push isn't designed for events like SSE or websockets. It's designed for the client to make a request and the server to efficiently responded with multiple payloads to populate a client cache.

[pwdisswordfish]

I'm pretty sure that's not how server push works. Client requests A, then server pushes B and C with A. Server just cannot push something to God knows where.

[akmittal]

If you mean Server sent events then no, WebSockets are still more performant.

I'm ignoring the fact that SSE are not replacement for WebSocket because with SSE we can't send data from client to server.

[nikcub]

I'd like to see the non-LTS version of node in 8.x move to OpenSSL 1.1 and expose more: scrypt, schnorr, curve25591, bn etc.

There is no good internal password storage, and bitcoin operations require bringing in most libs

[_urga]

scrypt: https://github.com/nodejs/node/issues/8417

[raresp]

NodeJS will be way faster with the HTTP/2 support. GG!

[darkhorn]

Can I use client side certificates with http2?

[sanxiyn]

Does anyone know what happened to Ayo.js?

[freedomben]

It would be great to hear from an insider, but it seems to me like they are having a little difficulty establishing organization around roles/permissions. Also the GitHub repo hasn't seen any commits in a month.

[monsieurbanana]

I would be very surprise if people took that fork seriously.

[contras1970]

the sj witch hunters got bored and moved on to another victim?

[GenericsMotors]

Most likely polishing their code of conduct.

[hasenj]

Nothing. It was not even a newsworthy event. Someone somehow managed to get a story published somewhere about it.