Node.js Blog

The Node core dev actually went back and forth on this, and came to the conclusion to not commit dependencies to the repo, and introduced "shrinkwrap" [1]. It felt wrong committing dependencies to the repo, which I agree with. I hate my diffs being drowned in external changes, I'd rather see that someone simply upgraded a dependency. Plus it does skew the project, both for what the primary language is, as well as how much a committer is contributing. I would love to see this eventually in Bower! They have an issue for it [2]. [1] "Why not just check node_modules into git?" http://blog.nodejs.org/2012/02/27/managing-node-js-dependencies-with-s… [2] https://github.com/bower/bower/issues/505

It is certainly unfortunate that Strongloop have published this blog post in a voice that implies 0.12.0 is already released. For _official_ messaging around Node.js, you should definitely be looking at http://nodejs.org/ and http://blog.nodejs.org/ instead!

Fyi, I think the current recommendation is to install both node and npm as a regular user. I generally follow the pattern described here for node: http://blog.nodejs.org/2011/04/04/development-environment/. If you do that, and then install npm as you describe (but as a regular user), then npm will automatically be installed under the node installation.

Well, sure, if you like. And I grant I should've left out that excess of cleverness in the Newspeak style; it confuses the point, and while Orwell has written many things worth referencing, Nineteen Eighty-four is almost never among them. Unfortunately, I found the meter too appealing to discard, and the description is accurate enough, however distasteful you find the formulation I chose. Criticism is well and good. For example, one might usefully point out that his dialectical materialism is obviously rusty, and that he therefore mistakenly considers his obviously petit-bourgeoisie self to be a member of the working class -- a truly risible proposition. There is, though, a material difference between mere criticism, and someone being caned in the public press for having spoken of the indigent in an insufficiently respectful fashion, to the extent that he feels the need to utter a belly-crawling public apology -- which, as always, only further inflames the piranha [1] infesting [2] what passes [3] for modern Internet discourse -- and that he's also disavowed [4] by the company which he, for the moment, leads. Said disavowal is necessary, of course, for the same reason it was foolish of Gopman to utter his plaint in such a publicly attributable fashion, rather than, for example, over beers with a few trusted friends in a quiet, out-of-the-way bar, or better yet at home. But of course it would be entirely [5] unreasonable [6] to suggest that anyone intends to intimidate…

The foundation is being created with help from the Linux Foundation. http://blog.nodejs.org/2015/05/15/node-leaders-are-building-an-open-fo…

Link to TJ blog post on nodejs.org http://blog.nodejs.org/2015/05/08/next-chapter/

For perspective, here is what Isaac Schlueter said when TJ took over. http://blog.nodejs.org/2014/01/15/the-next-phase-of-node-js/

And the official announcement on the NodeJS blog: http://blog.nodejs.org/2015/02/06/node-v0-12-0-stable/

isaacs passed on the reins to tjfontaine to focus on NPM instead: http://blog.nodejs.org/2014/01/15/the-next-phase-of-node-js/ One thing I don't understand is why isaacs didn't pass on the reins to a committee in the first place if that's what he wanted? Politics in the background? (I don't keep up with the Node community.)

It's just an expression, he stepped down: http://blog.nodejs.org/2014/01/15/the-next-phase-of-node-js/

> Send multiple pipelined HTTP requests via a single connection. That DoS attack vector was fixed. http://blog.nodejs.org/2013/10/22/cve-2013-4450-http-server-pipeline-f… Also, some proxy servers will prevent such attacks. > Find anywhere the developer has used an "Eval" and exploit it. Don't use eval. Just about every node.js dev knows that. If you have a developer using eval, they better have a damn good reason to do so. I can't think of any, unless you have some sort of web repl. But then, I doubt enterprise apps will have a requirement for a repl that allows arbitrary code to be executed on the server. As the OP stated, there is a higher concentration of "good developers" with node. If someone programs in such a way, they probably should be fired.

Ben Noordhuis: http://blog.nodejs.org/2013/12/03/bnoordhuis-departure/

> package dependencies are always installed in the node_packages directory of the package root Usually but not always. You can also have peer dependencies: http://blog.nodejs.org/2013/02/07/peer-dependencies/

npm isnt hosted at joyent, npm isnt wrtten in node, its CouchDB, theres more details @ http://blog.nodejs.org/2013/11/26/npm-post-mortem/ Even if it were, not sure what the issue would be, npm is a public service that costs money to run, they are asking for money from people who use that service.

Well, in that case lets add confusion about affected versions to the list of things being suboptimal about this whole thing: http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/ - the same warning about the same error and they did backport the fix to 0.8: https://github.com/joyent/node/commit/653d4db71f569ddc87a0bc21f5ecc5ce…

It's not just v0.10.21. There's also an update for v0.8.x too (0.8.26): http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/

They released v0.10.15 shortly afterwards http://blog.nodejs.org/2013/07/25/node-v0-10-15-stable/

You can always change the destination directory. I usually store my project dependencies locally, so this command works fine: npm install sails This command would store the libs in ./node_modules directory [1]. [1] http://blog.nodejs.org/2011/03/23/npm-1-0-global-vs-local-installation…

I'm pleased that this article buries the Dtrace functionality towards the bottom. Before this post, the Node.js post on profiling (http://blog.nodejs.org/2012/04/25/profiling-node-js/) was the most referenced piece on the topic - unfortunately Dtrace doesn't look like its ever going to run on Linux so I've been left in the dark.

First, it's a very nice new streams interface. Second, the core functionality can't change that much at this point if people want their old code to work. Read the discussion of streams2 and see how much thought went into avoiding breakage. http://blog.nodejs.org/2012/12/20/streams2/

Look here for a detailed analysis of benchmarks. http://blog.nodejs.org/2013/03/11/node-v0-10-0-stable/ From that post, their focus is on v0.12 and then v1.0. Nice to see we're getting to that stage.

“For those looking for commercial support, StrongLoop (Ben Noordhuis & Bert Belder's company) has released a distribution containing node v0.10 that they will support on Windows, Mac, Red Hat/Fedora, Debian/Ubuntu and multiple cloud platforms. You can download their Node distribution here.” —http://blog.nodejs.org/2013/03/11/node-v0-10-0-stable/

That was quick! Wasn't this just announced in June? http://blog.nodejs.org/2011/06/23/porting-node-to-windows-with-microso…

For context, see http://blog.nodejs.org/2011/07/11/evolving-the-node-js-brand/

Global and local installations are documented here. http://blog.nodejs.org/2011/03/23/npm-1-0-global-vs-local-installation…

The NPM authors explicitly draw the line between development and production. Their official stance is that NPM should be a development tool; in production modules should be installed through the native OS package manager. http://blog.nodejs.org/2011/04/04/development-environment/ (bottom) http://blog.nodejs.org/2011/04/06/npm-1-0-link/ ("Caveat: Not For Real Servers")

"... the easiest way to update an existing node.js (ubuntu) installation? ..." The latest vid from ryan ~ http://blog.nodejs.org/2011/03/17/welcome-to-the-node-blog/ explained the need to download & install from source. This presumes you have V8 installed. Holler if you get into trouble I've installed a few times on Ubuntu 8.04 Hardy Heron.

I don't have very specific details as I'm a bystander too but it seems Node has been stuck in 0.10.x land since early 2013 (http://blog.nodejs.org/2013/03/11/node-v0-10-0-stable/) while Node 0.12 and 1.0 releases were being talked about well over a year ago by former BDFL Isaac Schlueter (now at npm). Joyent, the current project stewards, have not been able to deliver a stable release in that time and don't share public plans / aren't communicating very much. One of the many symptoms of that slow development process is that Node.js is basically running an unsupported version of V8 (https://twitter.com/jmayer/status/532971494695907328). From what I've read, node-forward is/was only meant as a fork in the GitHub sense: they'd try to get their stuff merged back into node mainline. The GitHub fork has since been made private (https://github.com/node-forward/discussions/issues/7) and they're working to set up a proper governance model so that the community can truly be in charge. Joyent has reacted (I believe, it might have been in the works prior to node-forward) by proposing a node advisory board (https://github.com/joyent/nodejs-advisory-board) but it seems to be too little too late for at least some of the people behind node-forward (I've read what seem like irreconcilable disagreements about how it should be run). I have no idea what (if anything) io.js is in relation to node-forward or if the same people are behind it. Can't find any announcements / endorsements on…

Guys, guys, come on. We should respect their wishes to never talk about that again and forget the whole thing ever happened.[1] I mean, it's not like they ought to apologize for the atrocious way they facilitated the virtual lynching of one of their core contributors. Better to just sweep it all under the rug. [1] http://blog.nodejs.org/2013/12/03/bnoordhuis-departure/ EDIT: For the folks that say it's just "petty drama", I invite you to read another man's account of a very similar experience: http://www.polygon.com/2013/11/6/5075106/adam-orth-xbox-one-gdc-next Internet bullying isn't just some thing that happens to teenagers. It's a stream of tweets, phone calls, texts, hate mail, death threats, and more. I can only speculate about how much of that Ben received, but a fair share of it was very public, and Joyent was a participant in that. As the face of node.js it was Joyent's responsibility to defuse the situation and protect the people involved. Instead they threw gasoline into the fire, further inciting the mob justice that was already well underway.

Other projects around libuv: 1. Mozilla's Rust http://www.rust-lang.org/ 2. Tim Caswell's LuaNode https://github.com/ignacio/LuaNode 3. Ben Noordhuis and Bert Belder’s Phode async PHP project https://github.com/bnoordhuis/phode 4. Kerry Snyder’s libuv-csharp https://github.com/kersny/libuv-csharp 5. Andrea Lattuada's web server https://gist.github.com/1195428 6. Steve Yen's Lua wrapper https://github.com/steveyen/uv Source http://blog.nodejs.org/2011/09/23/libuv-status-report/