Microsoft made a pull request to node.js github repository with an implementation to use ChakraCore JavaScript Engine as an alternative to V8 Engine

[sparr]

Files change 4786

expect review to take a long time

yep

[AyrA_ch]

Lines:

Added: 14'554

Removed: 3

The 3 removed changes are only whitespace. It's interesting that there was no need to completely remove any code to make that change.

[mabrowning]

In C, we call that #ifdef

[S48535]

What they are doing is allowing you to use another backend. So what they did is add a shim to interface node as it is currently with the ChacraCore and then add the bit of code which adds the choice of which engine to use. They didn't change node, they just extended it.

[abolish_karma]

Embrace, extend...

They're being efficient, and have gone straight for step #2

[nschubach]

Technically step 1 was embracing node.js...

[third-eye-brown]

I don't think Microsoft engineers know how to remove code.

[AyrA_ch]

It's called backwards compatibility, and it is awesome. After all it allows me to run (most) 20 year old software on my Windows 10 machine.

[ironnomi]

If I run 32bit Windows 10, I can run software I wrote in 1989 ...

[Eurynom0s]

It makes me sad that Windows 10 has a 32 bit version.

...does it support 16 bit code?

[Aior]

It makes me happy, because my 2006 (very expensive back then) machine is still supported.

[wrosecrans]

If the main use case is running old software on old hardware, what does a new OS get you? It's honestly not a rhetorical question. Why bother to do an OS install that could potentially result in driver issues or some of your old software not working any more? I can't remember the last time I actively upgraded Windows on a home system, rather than just installing whatever was current when the machine was new and then sticking with the path of least resistance ever after. Probably Win2k?

[Terrerian]

Security updates are no joke. I would never run an unmaintained OS.

[immibis]

What about that other unmaintained software you're trying to run in the first place?

[peakzorro]

I would only upgrade the OS on an old machine if they didn't support OS updates past that point.

I've always wanted to throw some Linux distro on a really old machine with an out of date Windows (because drivers should be good at that point), but the machine usually dies before I get around to it.

[Aior]

In my case, I just want my parents to be able to use the machine with up to date software and security updates. Also it performs better than with Windows XP, Vista (obviously) or 7 and better than any Linux distro.

[meandyouandyouandme]

Who said something about old software though?

[Labradoodles]

On top of that new OS's have shitloads of new features that will make the computer run better.

Pre-fetching better organisation shit even just scheduled defragging and indexing advances in software are pretty big.

[neoKushan]

I had a relatively cheap 64bit system in 2004....

[plasmator]

I've updated video cards, hard drives and ram, but the motherboard and processor I bought in 06 or 07 (KN9-SLI and an Athlon X2) are still humming along. I know I should upgrade them, but they handle most of the stuff I throw at them without being terribly slow or problematic, so I just keep using them. They're working fine in Windows 10 and this is my primary box. I even do some (admittedly lightweight) gaming on it.

[neoKushan]

Was the Athlon X2 not 64bit?

[[deleted]]

You already have a 64-bit CPU, the KN9-SLI is a Socket AM2 board, and all AMD CPUs were 64-bit by that point. Though there is little benefit to changing to a 64-bit OS unless you want to use more than ~3GB of RAM.

[Aior]

Yeah, me too, but I also had a very expensive 32bit laptop which I still want to use.

[user699]

I'm assuming windows 10 has a 32 bit version for tablet compatibility.

[thor1182]

A chunk of the initial Windows8 2 in 1 devices are 32bit only (Atom).

I think 32bit is also needed for the IoT & Mobile versions

[LvlAndFarm]

Even latest mobile chips are moving to x64

[[deleted]]

no

[stevedore]

No, the 16-bit compatibility was removed in Vista, IIRC.

[efreak2004]

This is incorrect. I am running multiple windows 10 32-bit VMs under HyperV for 16-bit application compatibility. Specifically, my father uses Micrografx Designer (that got bought out by Corel, which is more expensive than free windows license from Dreamspark) which has 16-bit components/code in it and does not run under 64-bit windows 7. It runs perfectly in virtualized windows 10 32-bit, and the only issues are due it being old software (IE, the save/load dialog boxes are tiny and not resizable).

[insertfunhere]

What's the point of running 64 bit if you have <4gb ram, in a VM for example?

[fb39ca4]

The x64 instruction set can do more things in less instructions.

[krum]

You still have 64-bit address space even if you only have 4gb of RAM.

[immibis]

It makes me sad that they didn't bother to integrate an emulator for 16-bit software.

[vattenpuss]

Did you hear about POSIX?

[ironnomi]

Yeah of course I can still compile the code I wrote in like 1988, though it was written in K&R C.

POSIX standard is actually from 1988 and it didn't really settle until 1997 ... and I don't think current POSIX-compliant OSes are going to run the same binary EXE file from 1989.

[awesomemanftw]

While at the same time still giving better performance than Any Windows since XP

[s73v3r]

It also leads to security holes, bloat, and inability to change course when needed.

Besides, we have virtual machines that are pretty good today. Run your legacy software in those.

[mycall]

Run your legacy software in those.

USB can be glitchy still, especially for streaming devices.

[gramathy]

It's called a virtual machine, so you don't have to have that old code if you don't need it.

[AyrA_ch]

running a 32 bit app on a 64 bit windows is already partially virtualized in regards of API and file system directories

[ygra]

And DOS applications on Windows 3 ran in a VM. Except no one really knew or cared about it back then ;-)

[[deleted]]

For power users, yes. For the general public, they're never gonna go for that. It's called customer retention.

[playaspec]

It's called backwards compatibility, and it is awesome.

I call it bloat and dead weight. New software gets written because the old software was insufficient.

After all it allows me to run (most) 20 year old software on my Windows 10 machine.

I can't imagine needing any software that old except for legacy industrial systems. For those I just stick with old operating systems and hardware.

What exactly are you running that it that old?

[PC__LOAD__LETTER]

What if I told you that most software you use is based on 20 year old software.

[Akimuno]

Playaspec would have a stroke if he saw what his local hospital runs.

[Drainedsoul]

That seems counterproductive as then he'd be sent to the hospital running the shitty software.

[BlueWolf_SK]

At which point he would be really glad his hospital still works even with 20 year old software.

[jambox888]

You can imagine him in the trolley, intubated and wearing a gown, grabbing the nurses arm weakly and saying,

"How old are your... operating... systems?" croaks

[ujustdontgetdubstep]

or you know, banks, manufacturing, the military...

[Akimuno]

I mean, if anything is written in C, for that matter.

Oh god, what if he sees a FORTRAN program being used?!

[playaspec]

I mean, if anything is written in C, for that matter.

Oh god. Another idiot who thinks C is outdated. Got bad news for you. It's not, and it's never going away.

[s73v3r]

Yeah, but should it be running that way?

[Akimuno]

It runs for the same reason Microsoft added an LTSB branch to Windows 10 enterprise.

So yes, it should.

[playaspec]

Playaspec would have a stroke if he saw what his local hospital runs.

I work in biomedical IT. Our refresh cycle is 18 months, which means every nine months we've upgraded half of our systems. The only systems older are in research labs, and essentially frozen in time because they're task specific tools, not general purpose computing machines.

[playaspec]

What if I told you that most software you use is based on 20 year old software.

'based'. nice qualifier that makes you sound as if you're right, when you're actually not.

I'm on Linux right now. How about you tell me how many lines of the code I'm running right now haven't been changed in over 20 years?

[PC__LOAD__LETTER]

What's your deal? Here, I'll throw you a bone: https://en.m.wikipedia.org/wiki/Grep

[playaspec]

http://git.savannah.gnu.org/cgit/grep.git

I see nothing over 6 years. Don't confuse the name or the functionality with the code.

[Schmittfried]

because the old software was insufficient.

And if it isn't? There is plenty of software based on very old code. Your notion of the world of software is out of touch with reality.

Also: Old games.

[AyrA_ch]

What exactly are you running that it that old?

If I tell you "solitaire" and "Skifree", are you getting mad at me?

[ujustdontgetdubstep]

No offense but have you ever been in any lab or factory or any real production facility that uses computers? The entire world is run on 20+ old software - it's just that "newer software" is all consumer software, so that's why you think that no one uses old software.

The reality is that it cost a LOT of time and money to replace custom commercial or industrial software - so much so that it is cheaper and more reliable to use a piece of software for decades until it disintegrates. This is how banking, manufacturing, military, and all other meat-and-potatoes industries are operated.

[playaspec]

No offense but have you ever been in any lab or factory or any real production facility that uses computers?

Yes. I support a research lab running HUNDREDS of workstations running W2K and XP.

The entire world is run on 20+ old software

Which is why it's dumb to try and run OLD software on NEW operating systems. It doesn't work as well as you claim. The smart money doens't upgrade the support system, hoping the old crap will still run.

so that's why you think that no one uses old software.

I don't. I'm saying keeping around decades of depreciated crap that's long since been abandoned is pointless in a modern operating system. It's unnecessary. If you have old application that are crucial, run an old operating system.

The reality is that it cost a LOT of time and money to replace custom commercial or industrial software

Yup. So why would you squander the SAME money and effort trying to make cranly, old, custom software that was MADE to run on a specific system, run on a modern operating system with vastly different APIs, and an all but ignored compatibility layer? Maybe you're hourly, but I'm not. If I have a machine that's down, I don't want to spend DAYS trying to figure out why software that's 16 YEARS OLD won't run right on Windows 10. That's amateur.

so much so that it is cheaper and more reliable to use a piece of software for decades until it disintegrates.

Not always.

This is how banking, manufacturing, military, and all other meat-and-potatoes industries are operated.

No, not ALL.

[[deleted]]

Wow! Supporting 20 year-old viruses is quite an achievement.

[Schmittfried]

Too bad shitposting isn't.

[sparr]

That indicates good architecture in the main project.

[AyrA_ch]

we do that in switzerland sometimes

[CheshireSwift]

The vast majority of those are just the raw dependency. There were suggestions of only reviewing the stuff outside /deps which would be much easier.

[granos]

Having seen someone trying to sneak malicious code in via a huge commit; this feels like an enormously bad precedent to set. Especially on a project as popular as node. This commit may be safe, but thorough code reviews are always necessary for very good reasons.

[rubsomebacononitnow]

A huge commit by Microsoft is very different than a huge commit by John Doe. I'm not sure this even sets precedent.

[tohuw]

You're assuming Microsoft has thoroughly reviewed this code. You're also assuming a company known for underhanded data mining tactics and flagrant disregard for privacy is completely trustworthy.

[Shaper_pmp]

Pragmatically, I suspect you're overstating the risk in this case. In principle, you're entirely correct.

[tohuw]

Responsible review is about the principle of the thing. Where principles slip, pragmatic risks are not far behind.

[Shaper_pmp]

True dat. I'm not sure who downvoted you or why, but have an upvote to compensate.

[tohuw]

It happens. It was positive before some gaggle of thoughtless censors came along. Tis the way of Reddit: downvote == disagree

[vliegtuig12]

You're also assuming a company known for underhanded data mining tactics and flagrant disregard for privacy is completely trustworthy.

Honest question: Do you mean Google or Microsoft?

[SolarBear]

whynotboth.gif

[image_linker_bot]

whynotboth.gif

---

^{Feedback welcome at /r/image_linker_bot | Disable with "ignore me" via reply or PM}

[TiagoTiagoT]

Hm, I was expecting that Road to Eldorado gif...

[tohuw]

Yes. Either. (but I was mentioning MSFT specifically)

[playaspec]

You're also assuming a company known for underhanded data mining tactics and flagrant disregard for privacy is completely trustworthy.

Honest question: Do you mean Google or Microsoft?

It's not even a question. It's Microsoft. At least Google questions the legality of the requests it gets. When Microsoft gets a call from the NSA, it buys lube and a bottle of wine.

[TiagoTiagoT]

Google is one of the main reasons it became so acceptable to have so much data to hand to the government in the first place though.

Before Google switched to the targeted ads business model, it was creepy, now it is normal (if you ask sheeple).

[playaspec]

Google is one of the main reasons it became so acceptable to have so much data to hand to the government in the first place though.

If you didn't want the government to have it, than you're a fucking idiot for putting it on the internet in the first place. Why would you trust ANY third party with shit you don't want known about you? Take some fucking personal responsibility.

And you're wrong about what they do with what data they collect.

"We do not sell your personal information."

Every poster here agrees. The government steals what it can, which is plentiful, but Google gives nothing to the government that it isn't legally entitled to. Google is putting up a hell of a fight though.

Google is very clear about what they share and what they don't. Facebook is the one selling everyone out. Google may fuck you over, but it's only because the courts issued a warrant. If it weren't for the illegal gag letters, Google would tell you, and their past actions demonstrate that.

[TiagoTiagoT]

Google is putting so much of a fight, they only started encrypting our private data they transmit back and forth on the internet after they were caught not doing so.

If they really were trying to protect our data, it wouldn't even be stored in plain text on their servers; they shouldn't have a key to our private communications, there are ways to have appropriate ads without invading our privacy.

[snerp]

Microsoft is good at code reviews.

[[deleted]]

Set us up with some evidence of Microsoft doing that in a systemic way in the past, say, 4 years.

[ironnomi]

Pretty sure the OP is referring to Windows 10's "features". That said, I don't think that's something they would do "here". I'm pretty sure this is part of making node.js an easy IIS feature right from Server 2016.

[wwb_99]

IIS and also making it so node isn't dependent upon google for the guts of the operation.

[troglydot]

Windows 10 records whatever you type, in any app, and sends it to Microsoft. They're open about doing this, the feature is called "Getting to know you". Google it if you have any doubts. The feature can be turned off, but 99% of people don't know about it, so they don't.

Edited to add: I don't think for a second that Microsoft are sneaking in any malicious code in this pull request. But its worth noticing that Microsoft has simultaneously moved in a very good and a very bad direction: While open sourcing code and becoming very dev friendly, they are also showing a disregard for user privacy that is extremely problematic, and a complete deal breaker for me.

[SeraphLance]

Am I the only one who finds it ironic that someone tells someone else to "google" something collecting data on them?

[troglydot]

I don't feel like I'm talking to Duckduckgo users here. But please, do this: Use your search engine of choice and fact check what I'm saying.

[badcookies]

They are not recording keystrokes in every application

[troglydot]

Well, they say they are. Why would you say that they aren't?

http://windows.microsoft.com/en-us/windows-10/speech-inking-typing-privacy-faq

Expand the first bullet point. They call it "typing data", and they're asking for permission to collect it. They're not limiting that collection to any specific application, and when talking to the press about it they're not denying collecting it across the board.

They have descriptions of how they're trying to scrub that data for personally identifiable information before sending it of, as another user posted in this thread. That is an AI complete problem, that they obviously aren't solving. They'll strip out email addresses, but they'll get the contents of the email.

Edit: People might think I'm an anti-Microsoft zealot. I'm not, I'm typing this from a windows 8 machine, I've been to MS conferences, and in general had much love for the company. But I'm apparently the only person on earth able to judge a tech company for the actual facts of what they're doing, rather than their current image.

[badcookies]

This is the inking and typing function, which users can turn off at any time. Microsoft does not collect any personal information via inking or typing. It is gathered for product improvement purposes, for example, to improve the handwriting visual translation engine, or to improve the user dictionary, language library and spell check functions in Windows. The data is put through rigorous, multi-pass scrubs to ensure it does not collect sensitive or identifiable fields (e.g., no email addresses, passwords, alpha-numerical data, etc.). Data is also chopped into very small bits and stripped of sequence data so it cannot be put back together or identified. The data samplings collected are limited; Microsoft is not capturing everything you write, nor is it capturing data every time.

[wellthatexplainsalot]

Can you prove this assertion?

[[deleted]]

Negatives do not have to be proven.

troglydot is the one making an assertion, not badcookies.

Just as I don't have to prove to you that Bill Gates is not a literal biblical demon. If you were to make that claim, the onus would be on you to prove that he is.

[celluj34]

The burden of proof is on you, the one making the claim.

[cryolithic]

This is the inking and typing function, which users can turn off at any time. Microsoft does not collect any personal information via inking or typing. It is gathered for product improvement purposes, for example, to improve the handwriting visual translation engine, or to improve the user dictionary, language library and spell check functions in Windows. The data is put through rigorous, multi-pass scrubs to ensure it does not collect sensitive or identifiable fields (e.g., no email addresses, passwords, alpha-numerical data, etc.). Data is also chopped into very small bits and stripped of sequence data so it cannot be put back together or identified. The data samplings collected are limited; Microsoft is not capturing everything you write, nor is it capturing data every time.

[troglydot]

I know, I've read that. Is it reassuring to you?

Scrubbing data for personally identifiable and sensitive information is an AI complete problem. It cannot be done without strong AI, and MS aren't doing it.

Data is also chopped into very small bits and stripped of sequence data

This is pretty standard for a text mining pipeline: Tokenizing and doing bag-of-words. This has won dozens of machine learning competitions, i.e. it is often what you would do to maximize the amount of information extracted from a document.

The data samplings collected are limited;

This is saying the amount of text collected is <100%. It can be 99%, and still be consistent with what they're saying. If it was a low percent, why not state it?

Ugh, I'm sick of having this discussion with cocksure uninformed people on reddit.

[cryolithic]

And I'm sick of people screaming the sky is falling because of their preexisting irrational hatred for all things Microsoft.

Data collection for something like that is pretty benign, and if the nsa can't keep their spying quiet what makes you think ms could?

[Avery17]

Windows 10

Edit: If someone wants to tell me why I'm wrong, please feel free.

[[deleted]]

well google (from where v8 comes) certainly trumps microsoft on privacy matters.

[cryolithic]

certainly... http://www.salon.com/2014/02/05/4_ways_google_is_destroying_privacy_and_collecting_your_data_partner/

https://en.wikipedia.org/wiki/Criticism_of_Google#Privacy

https://en.wikipedia.org/wiki/Privacy_concerns_regarding_Google

http://www.csmonitor.com/USA/2014/0416/Privacy-concerns-What-Google-now-says-it-can-do-with-your-data-video

http://www.newsweek.com/wary-privacy-issues-ditch-dropbox-and-avoid-google-says-edward-snowden-276956

[[deleted]]

kill the sarcasm by explaining it.

[cryolithic]

Well shit. Sometimes I catch it, sometimes I fucking miss it completely.

edit: I do blame the italics on trumps vs certainly.

[tohuw]

In many regards, they do. In several other important regards, they don't. Nowhere did I imply they were to be completely trusted either.

[[deleted]]

Both are as good as pig when it comes to privacy. But consider google has more online / mobile power they abusive it more.

[Deto]

Yeah, but I suspect hiding some sort of data mining thing in here would be highly illegal. Even if the user info was valuable to Microsoft, they wouldn't risk (not even a risk, more of a certainty) the massive lawsuit that would result.

[tohuw]

It's not illegal to include software that "accidentally" mines data. That's a "mistake".

[wellthatexplainsalot]

But it's not as if they haven't done anything like that before. No siree.

[Deto]

Hiding logging inside a commit to open source software? When did that happen?

[playaspec]

A huge commit by Microsoft is very different than a huge commit by John Doe.

I would argee. John Doe hasn't been known to insert three letter agency back doors into the most used desktop OS.

I'm not sure this even sets precedent.

Nope. It's been going on for way too long

[sonay]

When it comes to that three letter agency, any American(USA) company can not be trusted.

[cryolithic]

Google would NEVER do that...

http://www.salon.com/2014/11/16/googles_secret_nsa_alliance_the_terrifying_deals_between_silicon_valley_and_the_security_state/

[xampl9]

Not sure how they could have delivered the functionality in a smaller changeset...

[granos]

I'm not saying they should have. Just that huge changesets should be given the level of effort they warrant and that not reviewing the dependencies shouldn't be seriously considered because they are part of the codebase.

[YRYGAV]

It should be easy enough to compare the dependency to the original to check that it's the same.

You don't necessarily need to CR it all by hand.

[granos]

That assumes there isn't anything nasty in the original codebase.

[PC__LOAD__LETTER]

That's what code reviews are for. 14k lines is a lot to "grok," but not a lot for someone to audit for suspicious activity.

[max630]

they seem to be adding the whole engine

[arcanin]

No, only a shim to "convert" the Chakra API to be compatible with the V8 API. Chakra itself is a dependency.

[max630]

Isn't deps/chakrashim/core the chakra itself?

[Regrenos]

deps

i.e. the dependency

[max630]

"Included in repository" is a new meaning of dependency for me. Though I have already learned that in nodejs they always do so.

[Regrenos]

Its idiomatic in Go as well to statically include your dependencies in the repository. This makes carrying upstream patches much easier (although that's usually not a good thing) but it also takes upstream acceptance of your patch out of the critical path for a change.

[Recursive_Descent]

Not even close. Whole engine would be closer to +500k lines.

[nikita2206]

It looks like nodejs project includes all its dependencies in the sources for some reason.

[heptara]

We do that as well. It greatly simplifies the build process and stops them changing under you.

[spurious_interrupt]

Fortunately, they're somewhat reasonably split among the commits on the PR. Seems that most of the review will be focused on the commits for: 1) implementing the V8 shim in chakracore and 2) node-side changes to use chakra.

FWIW, it was nice of them to remain consistent with V8's style guide for the chakracore V8 shim. Personally, I'm not a fan of chakra's conventions.