Node.js Technical Steering Committee (TSC) Meeting 2020-04-08

[mhdawson]

Time

UTC Wed 08-Apr-2020 16:00 (04:00 PM):

Timezone	Date/Time
US / Pacific	Wed 08-Apr-2020 09:00 (09:00 AM)
US / Mountain	Wed 08-Apr-2020 10:00 (10:00 AM)
US / Central	Wed 08-Apr-2020 11:00 (11:00 AM)
US / Eastern	Wed 08-Apr-2020 12:00 (12:00 PM)
London	Wed 08-Apr-2020 17:00 (05:00 PM)
Amsterdam	Wed 08-Apr-2020 18:00 (06:00 PM)
Moscow	Wed 08-Apr-2020 19:00 (07:00 PM)
Chennai	Wed 08-Apr-2020 21:30 (09:30 PM)
Hangzhou	Thu 09-Apr-2020 00:00 (12:00 AM)
Tokyo	Thu 09-Apr-2020 01:00 (01:00 AM)
Sydney	Thu 09-Apr-2020 02:00 (02:00 AM)

Or in your local time:

• http://www.timeanddate.com/worldclock/fixedtime.html?msg=Node.js+Foundation+Technical%20Steering%20Committee%20(TSC)+Meeting+2020-04-08&iso=20200408T16
• or http://www.wolframalpha.com/input/?i=04PM+UTC%2C+Apr+08%2C+2020+in+local+time

Links

• Minutes Google Doc: https://docs.google.com/document/d/1MRSNLTFPN7BiczFhJ102xhg3_F3gFZejuEIoRWdEOTg/edit

Agenda

Extracted from tsc-agenda labelled issues and pull requests from the nodejs org prior to the meeting.

nodejs/node

• Nominating @himself65 as a collaborator #32441
• Nominating @puzpuzpuz as a collaborator #32555
• quic: part 3... initial quic implementation #32379
• quic: part 2... ngtcp2 and nghttp3 #32378
• quic: part 1... quic-modified openssl #32377

nodejs/TSC

• Review meeting date times ? #809
• Node.js future directions - any interest in online or in person summit? #797

Invited

• Anna Henningsen @addaleax (TSC)
• Anatoli Papirovski @apapirovski (TSC)
• Beth Griggs @BethGriggs (TSC)
• Сковорода Никита Андреевич @ChALkeR (TSC)
• Colin Ihrig @cjihrig (TSC)
• Daniel Bevenius @danbev (TSC)
• Franziska Hinkelmann @fhinkel (TSC)
• Gabriel Schulhof @gabrielschulhof (TSC)
• Gireesh Punathil @gireeshpunathil (TSC)
• James Snell @jasnell (TSC)
• Joyee Cheung @joyeecheung (TSC)
• Matheus Marchini @mmarchini (TSC)
• Matteo Collina @mcollina (TSC)
• Michael Dawson @mhdawson (TSC)
• Myles Borins @MylesBorins (TSC)
• Ruben Bridgewater @BridgeAR (TSC)
• Sam Roberts @sam-github (TSC)
• Michaël Zasso @targos (TSC)
• Tobias Nießen @tniessen (TSC)
• Rich Trott @Trott (TSC)
• Shelley Vohr @codebytere (TSC)

Observers/Guests

Notes

The agenda comes from issues labelled with tsc-agenda across all of the repositories in the nodejs org. Please label any additional issues that should be on the agenda before the meeting starts.

Joining the meeting

Zoom link: https://zoom.us/j/611357642
Regular password

Public participation

We stream our conference call straight to YouTube so anyone can listen to it live, it should start playing at https://www.youtube.com/c/nodejs+foundation/live when we turn it on. There's usually a short cat-herding time at the start of the meeting and then occasionally we have some quick private business to attend to before we can start recording & streaming. So be patient and it should show up.

Many of us will be on IRC in #node-dev on Freenode if you'd like to interact, we have a Q/A session scheduled at the end of the meeting if you'd like us to discuss anything in particular. @nodejs/collaborators in particular if there's anything you need from the TSC that's not worth putting on as a separate agenda item, this is a good place for that.

---

Invitees

Please use the following emoji reactions in this post to indicate your
availability.

• 👍 - Attending
• 👎 - Not attending
• 😕 - Not sure yet

[bnoordhuis]

quic: part 1... quic-modified openssl nodejs/node#32377

It's important for the TSC to realize that nodejs/node#32377 proposes floating A REALLY BIG PATCH on top of the vendored copy of openssl.

Said patch is taken from openssl/openssl#8797 and isn't expected to get merged for at least the next 18 months, until openssl 3.1 is released (no ETA that I'm aware of.)

That's a real nasty situation to be in. We do security upgrades of openssl frequently. What happens when an upgrade is blocked because the QUIC changes no longer apply?

With a patch that size, that's guaranteed to happen.

[richardlau]

quic: part 1... quic-modified openssl nodejs/node#32377

It's important for the TSC to realize that nodejs/node#32377 proposes floating A REALLY BIG PATCH on top of the vendored copy of openssl.

Said patch is taken from openssl/openssl#8797 and isn't expected to get merged for at least the next 18 months, until openssl 3.1 is released (no ETA that I'm aware of.)

That's a real nasty situation to be in. We do security upgrades of openssl frequently. What happens when an upgrade is blocked because the QUIC changes no longer apply?

With a patch that size, that's guaranteed to happen.

I did raise that concern in the PR: nodejs/node#32377 (comment)

Node.js 14 is due to be an LTS release (in October) which means we would be committed to floating the patch until it goes End-of-Life in April 2023.

[Trott]

Node.js 14 is due to be an LTS release (in October) which means we would be committed to floating the patch until it goes End-of-Life in April 2023.

Presumably, QUIC will be experimental, so breaking/removing QUIC in the name of security should be acceptable in theory. In practice, some skepticism is warranted....

[richardlau]

Node.js 14 is due to be an LTS release (in October) which means we would be committed to floating the patch until it goes End-of-Life in April 2023.

Presumably, QUIC will be experimental, so breaking/removing QUIC in the name of security should be acceptable in theory. In practice, some skepticism is warranted....

nodejs/node#32379 adds quic support behind a configure flag, so quic will not be available in the default builds. Perhaps that's justification enough to allow breaking it (AFAIK we've not in the past knowingly broken an experimental feature in a release).

[ljharb]

@richardlau i'm pretty sure we've done that for experimental modules; we've also removed the at-the-time experimental fs/promises module from v10.0.0 (in favor of fs.promises); i'm sure there's others.

[richardlau]

@richardlau i'm pretty sure we've done that for experimental modules; we've also removed the at-the-time experimental fs/promises module from v10.0.0 (in favor of fs.promises); i'm sure there's others.

Those were breaking changes though (i.e. the feature worked but the user had to change their code), not an outright broken feature (i.e. unusable until fixed in a later release).

[BridgeAR]

I removed nodejs/node#32392 from the agenda, since it's not blocked anymore.

[mhdawson]

PR for minutes: #847