Node.js Blog

Well, sure, if you like. And I grant I should've left out that excess of cleverness in the Newspeak style; it confuses the point, and while Orwell has written many things worth referencing, Nineteen Eighty-four is almost never among them. Unfortunately, I found the meter too appealing to discard, and the description is accurate enough, however distasteful you find the formulation I chose.

Criticism is well and good. For example, one might usefully point out that his dialectical materialism is obviously rusty, and that he therefore mistakenly considers his obviously petit-bourgeoisie self to be a member of the working class -- a truly risible proposition.

There is, though, a material difference between mere criticism, and someone being caned in the public press for having spoken of the indigent in an insufficiently respectful fashion, to the extent that he feels the need to utter a belly-crawling public apology -- which, as always, only further inflames the piranha [1] infesting [2] what passes [3] for modern Internet discourse -- and that he's also disavowed [4] by the company which he, for the moment, leads.

Said disavowal is necessary, of course, for the same reason it was foolish of Gopman to utter his plaint in such a publicly attributable fashion, rather than, for example, over beers with a few trusted friends in a quiet, out-of-the-way bar, or better yet at home. But of course it would be entirely [5] unreasonable [6] to suggest that anyone intends to intimidate…

I don't have very specific details as I'm a bystander too but it seems Node has been stuck in 0.10.x land since early 2013 (http://blog.nodejs.org/2013/03/11/node-v0-10-0-stable/) while Node 0.12 and 1.0 releases were being talked about well over a year ago by former BDFL Isaac Schlueter (now at npm). Joyent, the current project stewards, have not been able to deliver a stable release in that time and don't share public plans / aren't communicating very much.

One of the many symptoms of that slow development process is that Node.js is basically running an unsupported version of V8 (https://twitter.com/jmayer/status/532971494695907328).

From what I've read, node-forward is/was only meant as a fork in the GitHub sense: they'd try to get their stuff merged back into node mainline. The GitHub fork has since been made private (https://github.com/node-forward/discussions/issues/7) and they're working to set up a proper governance model so that the community can truly be in charge. Joyent has reacted (I believe, it might have been in the works prior to node-forward) by proposing a node advisory board (https://github.com/joyent/nodejs-advisory-board) but it seems to be too little too late for at least some of the people behind node-forward (I've read what seem like irreconcilable disagreements about how it should be run).

I have no idea what (if anything) io.js is in relation to node-forward or if the same people are behind it. Can't find any announcements / endorsements on…

Guys, guys, come on. We should respect their wishes to never talk about that again and forget the whole thing ever happened.[1]

I mean, it's not like they ought to apologize for the atrocious way they facilitated the virtual lynching of one of their core contributors. Better to just sweep it all under the rug.

[1] http://blog.nodejs.org/2013/12/03/bnoordhuis-departure/

EDIT: For the folks that say it's just "petty drama", I invite you to read another man's account of a very similar experience: http://www.polygon.com/2013/11/6/5075106/adam-orth-xbox-one-gdc-next

Internet bullying isn't just some thing that happens to teenagers. It's a stream of tweets, phone calls, texts, hate mail, death threats, and more. I can only speculate about how much of that Ben received, but a fair share of it was very public, and Joyent was a participant in that.

As the face of node.js it was Joyent's responsibility to defuse the situation and protect the people involved. Instead they threw gasoline into the fire, further inciting the mob justice that was already well underway.

> Send multiple pipelined HTTP requests via a single connection.

That DoS attack vector was fixed.

http://blog.nodejs.org/2013/10/22/cve-2013-4450-http-server-pipeline-flood-dos/

Also, some proxy servers will prevent such attacks.

> Find anywhere the developer has used an "Eval" and exploit it.

Don't use eval. Just about every node.js dev knows that. If you have a developer using eval, they better have a damn good reason to do so. I can't think of any, unless you have some sort of web repl. But then, I doubt enterprise apps will have a requirement for a repl that allows arbitrary code to be executed on the server.

As the OP stated, there is a higher concentration of "good developers" with node. If someone programs in such a way, they probably should be fired.

The Node core dev actually went back and forth on this, and came to the conclusion to not commit dependencies to the repo, and introduced "shrinkwrap" [1].

It felt wrong committing dependencies to the repo, which I agree with. I hate my diffs being drowned in external changes, I'd rather see that someone simply upgraded a dependency. Plus it does skew the project, both for what the primary language is, as well as how much a committer is contributing.

I would love to see this eventually in Bower! They have an issue for it [2].

[1] "Why not just check node_modules into git?" http://blog.nodejs.org/2012/02/27/managing-node-js-dependencies-with-shrinkwrap/
[2] https://github.com/bower/bower/issues/505

Other projects around libuv:

1. Mozilla's Rust http://www.rust-lang.org/

2. Tim Caswell's LuaNode https://github.com/ignacio/LuaNode

3. Ben Noordhuis and Bert Belder’s Phode async PHP project https://github.com/bnoordhuis/phode

4. Kerry Snyder’s libuv-csharp https://github.com/kersny/libuv-csharp

5. Andrea Lattuada's web server https://gist.github.com/1195428

6. Steve Yen's Lua wrapper https://github.com/steveyen/uv

Source http://blog.nodejs.org/2011/09/23/libuv-status-report/