Re:Fetch API has landed into Node.js
by franciscop on Tuesday February 01, 2022 @10:51AM
(#30164098)
Really happy to see fetch() merged into core! Looking at the PR, what are those WASM blobs in Undici and how is it that Node.js accepts a random very large compiled blob instead of asking for the source file + compilation step? https://github.com/nodejs/node/commit/6ec225392675c92b102d3c...
[ Parent
| on HN ]
Those wasm blobs are Node's own llhttp https://github.com/nodejs/llhttp in wasm to speed up HTTP parsing. The project itself added as a dependency is also by Node https://github.com/nodejs/undici .
The question is totally legitimate but please assume core doesn't make "load random binary" level kind of goofs :)
Re:Fetch API has landed into Node.js
by franciscop on Tuesday February 01, 2022 @11:09AM
(#30164430)
Sorry def didn't mean in a bad way! I just wanted to ask/note that in the PR, and with the very little context I have, it seems like an arbitrary code blob so I was surprised, I'm 100% it'll be well documented in e.g. undici itself, and prob in other places.
Except that's exactly what Corepack does, just silently and opaquely on the user's system. At least, the moment it switches from opt-in to opt-out.
Its unverified binaries are just as good as random binaries, and silently replacing any pre-existing yarn/pnpm/whathaveyou without checking if it was perhaps a custom build is not exactly predictable either.
Other than Corepack, though, I think you people are doing an amazing job!