Matteo Collina

Open Source Maintainer 🤖 Node.js Technical Steering Committee 😺 Fastify Lead 🎬 Board Member OpenJS Foundation 📈 12 billion downloads / year on npm 🚀 Co-Founder & CTO Platformatic

Public Key

npub1sjha97hkxtyyl9fe4t4jh2cws4fwy26q5p8rmuvy7hnwu0xrra4sgqvwhz

NIP-05 Address

mcollina_at_fosstodon.org@mostr.pub

Profile Code

nprofile1qqsgft7jltmr9jz0j5u646et4v8g25hz9dq2qn3a7xz0tehw8np376cprpmhxue69uhhyetvv9ujumn0wdmksetjv5hxxmmdh8q6hf

Publishing to

relay.noswhere.com

Author Public Key

npub1sjha97hkxtyyl9fe4t4jh2cws4fwy26q5p8rmuvy7hnwu0xrra4sgqvwhz

Show more details

Last Notes

2024-09-12 16:16:00

Team: Here is the feature, can you please document it?
Tech Writer: Sure! Can anybody explain to me what X is?
(Hire a tech writer ✍️ )

2024-09-09 16:16:04

Good news: the Node.js downloads reached an all-time high in August, when Node.js v20 finally surpassed Node.js v18!
Bad news: Node.js v16 still has major usage; go update, it has been out of LTS for a year!
Really bad news: who the heck is still using Node.js v14 and v12?
https://cdn.fosstodon.org/media_attachments/files/113/108/488/164/816/962/original/499df59661d990a0.png

2024-09-06 16:16:01

Finally it happened to me as well: developers complaining that the behavior of my OSS libraries does not match what ChatGPT explains to them. 🤦‍♂️

2024-09-02 16:16:16

Finally it happened to me as well: developers complaining that the behavior of my OSS libraries does not match what ChatGPT explains to them. 🤦‍♂️

2024-08-20 16:16:00

A quick reminder that the Node.js project is run by volunteers. Quite a few of our decisions are based on the availability of volunteers to do the required work. Very often, showing up and helping goes a long way. Therefore, stop complaining and get to work.

2024-08-19 16:16:00

Every now and then I receive a PR that removes tests and docs from modules I maintain. npm releases are (mostly) immutable, while github repos are not. If a repo disappears, you want to be able to fork the module from your local copy.
(This practice stems from seeing quite a few repos disappear).
https://youtu.be/TenueBLqVIo?si=wzphuL7XBJTdpJ31 https://youtu.be/D18jlN2JNE0?si=iDKR6g9JZh4iLUk3

2024-08-15 16:16:01

Zero trust: How the ‘Jia Tan’/xy hack complicated open-source software - take a read, it also includes quite a few quotes from me https://cyberscoop.com/open-source-security-trust-xz-utils/

2024-08-09 16:16:00

Dev: I have a memory leak
Me: Does your process crash for an OutOfMemory error?
Dev: no
Me: Then you don’t have a memory leak
(There might be still a memory management issue, but that’s not a leak).

2024-08-08 16:16:05

dev: are you actually developing Node.js? WHAT’s your github profile?
me: yes (and you should thank me for it).
https://github.com/mcollina

2024-08-07 16:16:01

Devs are unwilling to put in the effort of applying for a job, because they are scared of the (likely) rejection. Companies are complaining they can’t hire the skills they need.
Me: silently referring people and helping friends.

2024-08-06 16:16:01

I’m recently growing less and less forgiving to people pretending free professional support in OSS repositories. I’m receiving tens of help requests per day, and 90% of them are just people that can’t read the docs.
So far, the best way to get me investigate an issue is to be a Platformatic customer. I’m also thinking if there can be alternative ways for you to pay for the professional support you need.

2024-08-05 16:16:01

For years, the Red Hat @nodejs team has been publishing articles on how to do Node.js correctly. They have also compiled a "reference architecture." I've also contributed by writing the foreword!
https://developers.redhat.com/e-books/developers-guide-nodejs-reference-architecture

2024-08-02 16:16:04

In July, Node.js downloads hit a record of 140 million! It's also the first month that Node.js v20 surpasses v18, and usage of v22 is starting to climb!
https://cdn.fosstodon.org/media_attachments/files/112/893/320/363/964/724/original/f9ac889d8149cd24.png
https://cdn.fosstodon.org/media_attachments/files/112/893/320/349/456/375/original/94c7231573a2bc0e.png

2024-07-25 16:16:04

I'm super impressed by how much Fastify is used and loved by the tech community. According to a StackOverflow survey, 2.4% of professional developers use it, and 56% of them admire it. Wow!
https://buff.ly/3YimXDu
https://cdn.fosstodon.org/media_attachments/files/112/848/021/818/690/341/original/e6502eaa73dd0c1f.png
https://cdn.fosstodon.org/media_attachments/files/112/848/021/841/509/526/original/d527a72fd0a907d3.png

2024-07-18 16:16:00

Devs: Stop supporting old Node.js versions! Don't use polyfills!
Devs: What framework would you use to build your Node.js apps in 2024?
Devs: Let's use express for this, it runs on *all* Node.js versions from 0.8.

2024-07-04 16:16:00

Node.js cannot vendor TypeScript because the latter does not offer the same LTS guarantees. You want to be in charge of updating your TypeScript version.
Type stripping is ok, because there is a much higher chance of withstanding the test of time.

2024-07-03 16:16:00

Most developers ignore the fact that they have the skills to debug/fix/modify their dependencies. They are not maintained by unknown demigods but by fellow developers.

2024-07-02 16:16:00

I've seen a lot of developers really struggling with Git. A long time ago, I've learned it using Git Immersion. If you haven't done it before, take a look! https://buff.ly/3IuqSBj

2024-07-01 16:16:00

The npm+node.js combo solved software reuse at scale by allowing the same module to exist as two different versions in the same process. This feature allowed the "Cambrian explosion" we saw last decade. An unexpected consequence is that you should really *not* rely on instanceof checks and you should rely on duck typing instead.

2024-07-01 08:09:27

Here is a quick reminder that dropping support of a Node.js version in a minor will inevitably break some of your users. Do so in a major.

2024-06-25 16:16:01

Here is a quick reminder that dropping support of a Node.js version in a minor will inevitably break some of your users. Do so in a major.

2024-06-24 16:16:01

If you follow my content, you are likely using Node.js. However, most of you are not protecting your event loop from thrashing.
Here is a quick reminder on how:
https://youtu.be/VI29mUA8n9w

2024-06-21 16:16:16

I usually don't recommend products, but Carpio by DeltaHub has been a lifesaver for my wrists. I have been using them for years, and they are just amazing (I have one for each hand). It also works greatly for my Neovim setup. Thanks to this, I can slide my hands without ever lifting them off from the keyboard.
https://buff.ly/3xvXg7l
https://cdn.fosstodon.org/media_attachments/files/112/655/504/118/329/756/original/8fdeee3ea7d09836.png

2024-06-19 16:16:00

I'm tempted to prepare a video explaining boolean logic with JavaScript. I see devs failing to do a basic OR to fix a bug, and I just need some material to send them when I review PRs.

2024-06-18 16:17:00

It seems the industry standard is to ignore peerDependencis warnings. Therefore, why do we use them in the first place?

2024-06-17 16:16:03

Imagine a npm module with 53M monthly downloads doing a rug pull and moving to AGPL+Commercial license. Given I have to use this in a permissive OSS project, I guess I’ll have to maintain one more fork.
(I 100% understand their problem. However, I believe doing the rug pull is not a good answer).
Anyhow, here is my-ua-parser: https://github.com/mcollina/my-ua-parser.
https://cdn.fosstodon.org/media_attachments/files/112/632/854/015/553/535/original/59ccd5e512f58563.png

2024-06-14 16:16:00

Here is a new way to abuse OSS maintainers. Open security issue and force them to explain you why your ideas are a mess.
STOP. 🛑

2024-06-13 16:16:01

Everybody forgets to set up redirects when changing website.

2024-06-12 16:16:00

Should I cave in and start paying for Zapier or should I develop my own automation? Should I do it on stream?

2024-06-11 16:16:00

I’m wondering why GitHub Actions are not safe by design. So much effort is wasted in hardening and handling of security vulnerabilities related to GHA.

2024-06-10 16:16:00

Skipping unit tests is a sure way to guarantee there will be regressions. Don't do it.

2024-06-07 16:16:01

When working in OSS, you need to have a complete CONTRIBUTING.md file that explain step-by-step how to setup a dev environment. Sometimes copying a file, installing a library, or even running a docker container might be too hard. Document everything.

2024-06-06 16:16:00

Authorization is hard

2024-06-05 16:16:01

I don't understand why people prefer to store log lines as text vs structured data. The latter is easier to post-process, search, filter, etc. Why would you not do it?

2024-06-04 16:16:00

TL;DR use our @nodejs builds.
Something to always remember asking when triaging Node.js core issues:
Are you using our binaries? If not, have you tried using them?
(Linux distros could make mistakes when packaging up)

2024-06-03 16:16:00

On @npub1u2t…9p3x servers, prototype pollution attacks originate from developers not validating their input data. A runtime or library cannot fully harden against such a scenario because it is a developer mistake.
TL;DR do not trust any input, and always validate any user data before usage

2024-05-31 16:16:03

Dev on an Open Source project: My @npub1u2t…9p3x app crashes
...
Dev: I've fixed it by handling the errors.
https://cdn.fosstodon.org/media_attachments/files/112/536/594/767/513/633/original/6814ce98c6f85936.png

2024-05-30 16:16:01

Dev: I need to optimize transfer size. I'm going to compress my JSON responses to the MAXIMUM!
...a month later...
Dev: why did my cloud bill grow so much? why are my users reporting that the app has slowed down?
🤦‍♂️ 💸
TL;DR Don't optimize transfer size. Optimize loading time based on your users' bandwidth. Verify all the way

2024-05-29 16:16:01

What I notice is that a lot of junior/mid-level devs have very little familiarity with the terminal, and Docker, and networking in general.

2024-05-28 16:16:00

If I've too many things on my plate, I tend to feel a "paralysis" where it's very hard to prioritize. My solution is to slow down by writing the most important tasks in my notebook. Ink on paper. Usually, this calm me down and I can focus on the most important task.

2024-05-27 16:16:00

One of the oldest ways of improving the performance of a software system is cutting features. This is great, and it has pushed the industry forward multiple timesz
Remember to call out the limitations of your approach when promoting your benchmarks.

2024-05-24 16:16:00

Repeat with me (again):
I will report potential security issues privately.

2024-05-23 16:16:00

Lately I’ve been studying using local models for LLMs. Wow, I get why you all are so excited about this.

2024-05-22 16:16:01

A company uses one of my libraries, and they often open issues about bugs and other help. I promptly offered them a support contract, which would greatly help them and myself. They refuse.
After a while they open a bug about a production issue. What would you do?

2024-05-21 16:16:04

From personal experience, the config module on NPM is one of the major sources of long-term issues I have seen. You really should not store the various environment configurations in your app.
I talk more about it in https://buff.ly/4b5dYsV .
https://cdn.fosstodon.org/media_attachments/files/112/479/971/665/308/755/original/eaace49b430b1387.jpeg

2024-05-20 16:16:00

I’ve seen this happening a few times: somebody is laid off and they are looking for a new gig. I DM them.. but no answer. Why is that?

2024-05-17 16:16:00

What most developers don’t realize of Open Source is that every user is capable of becoming a maintainer. When paired with Open Governance, it means that who shows up makes the decisions. Everybody can do the work and have a say. Why haven’t you?

2024-05-16 16:16:00

Security Researcher: this is a CRITICAL vulnerability
Me: Have you read Node.js threat model?
Security Researcher: this is a CRITICAL vulnerability!!!
Me: This does not fit Node.js threat model, closing this

2024-05-15 16:16:01

I envy all the most successful trainers in the tech industry. They can zoom in on a topic, explain it clearly and provide devs useful skills. To do so, they deliberately skip most software engineering principles. I will never be able to do it.

2024-05-14 16:16:00

Days without fighting a library that monkey patch globals: 0.

2024-05-13 16:16:00

One of the reasons “software is never done” is that you need to continue update your code to new HW and OS versions.
Case in point: GitHub Actions updated their Mac runners to use the new arm CPUs. It broke a lot of my OSS projects CI, because Node.js v14 and v16 are not there.

2024-05-10 16:16:00

Hey Folks, here is a quick reminder to fill in the @nodejs annual survey!
https://linuxfoundation.surveymonkey.com/r/nodenext10survey24

2024-05-09 16:16:01

repeat with me:
your JS library project should not override/monkey patch a global.

2024-05-08 16:16:01

Once upon a time, I was doing some solo contracting. A company asked me to deliver a Node.js training. But they sneaked in a 2 years non-compete in the contract.
I sent them a red line with a change:
- 5k for the training (as negotiated)
- 195k for the non-compete clause
🫠

2024-05-07 16:16:07

I've just shipped Fastify v5.0.0-alpha.1, targeting July as an official release date.
https://buff.ly/3yh0ons

2024-05-06 16:16:09

Last Thursday, I did a long stream about Node.js v22 and all the novelties - testing all new things, and reporting a few bugs too!
https://youtu.be/eZfLkVDJPTg
https://cdn.fosstodon.org/media_attachments/files/112/395/037/228/865/264/original/01363b8c407a619a.jpeg

2024-05-03 16:16:01

One of my biggest headaches is debugging why the heck yarn and pnpm resolve modules differently from npm, and installs/build start failing. Sigh.

2024-05-02 16:16:00

I'm hearing very different stories from different parts of the world:
- conferences having trouble to sell tickets & sponsorships
- conferences offering amazing value-for-money being sold out
What's the catch?

2024-05-01 16:16:03

From my benchmarks, fetch() will soon perform as well as http.request() in @nodejs v22. This is an unbelievable journey we started back in 2018!
https://cdn.fosstodon.org/media_attachments/files/112/366/725/442/540/538/original/b56ef91f6c39dc1a.png

2024-04-30 16:16:01

I've followed Kent C. Dodds challenge and ported its React Server Components example to Fastify. It was surprisingly easy. Check it out at:
https://github.com/epicweb-dev/react-server-components/pull/4
I've actually learned a ton about the internals of RSC doing this!

2024-04-29 20:38:39

- reply

@npub10nl…0klm req/s outgoing from a single Node.js process.

2024-04-29 18:22:06

- reply

@npub10nl…0klm today is 1/2 than http.request and about 1/4 of undici.request().

2024-04-29 16:42:28

- reply

@npub10nl…0klm 2x as the new version of undici ships in v22.

2024-04-29 16:16:00

Preliminary benchmarks report that fetch() will be 2x faster in Node.js v22. A few more PRs are needed to get there, but it's *very* promising*.

2024-04-26 16:16:00

How did MongoDB and Elastic were able to switch to source available licenses so easily? Because they controlled most of the maintainers.
Redis has always been a product “for developers by developers”, and it was community driven for most of its history. Valkey is that community.

2024-04-25 16:16:00

One of the primary reasons of spaghetti code & unmaintanable codebases are… SINGLETONS.
They block future evolution of your codebase and make testing harder.
STOP USING THEM NOW

2024-04-24 16:16:01

There is nothing absolutely “slow” or “fast”, as those are relative concepts. The only useful measure when doing optimization work is to identify bottlenecks and remove them.

2024-04-23 16:16:00

I’m starting to feel that bounties for security vulnerabilities for OSS were a mistake. They attract the “wrong” kind of actors that have no interest in improving OSS, but they are in it only for the money.

2024-04-22 17:42:10

- reply

@npub1zmy…2rv2 they don’t work well if you want to support multiple versions of the package.

2024-04-22 16:16:01

I'm currently playing with the idea of building a docs rendering server. Key pillars:
1. support multiple versions out of the box
2. server-side rendered with heavy http caching
3. No react / Vue etc. HTMX for the minimal interactivity needed
4. Markdown with frontmatter
Is there something similar out there already?

2024-04-19 16:16:00

Open Source does not mean free support for your product or clients.

2024-04-18 16:16:00

To whom it may concern:
AWS Lambda its is own product. It's not maintained by Node.js, nor can we fix bugs there. If you have one, please contact AWS Support.

2024-04-17 16:16:01

The effect of optimizing anything that is not a hot path is often not measurable. Optimize accordingly.

2024-04-16 19:59:10

- reply

@npub175x…2fat they sit a layer under it. install undici and configure a global dispatcher.

2024-04-16 19:21:27

- reply

@npub175x…2fat Generically yes. Most of it is built in inside undici. We have recently ehanced the interceptor system to be extremely flexible. Open an issue, I think folks would jump on it.

2024-04-15 16:16:00

Unfortunate truth about employee churn: the moment they hand in their notice, there is nothing left to do. Doing something about it requires listening to the cues months earlier.
As their manager or employer, you should really give them “good luck”.
(It stings unfortunately)

2024-04-12 16:16:04

During my stream yesterday, I make fetch() in Node.js faster by 10-20%! Want to know how? Check out the recording! https://buff.ly/3vDTsQI
https://cdn.fosstodon.org/media_attachments/files/112/259/141/570/855/101/original/532ce0965765ba56.jpeg

2024-04-12 08:48:13

I've just shipped a new release of @nodejs undici that makes fetch() 10-20% faster (v6.13.0). Hurray!
This release was fully automated, and it now has full provenance support, so you can be guaranteed that the source code on GitHub matches the one released on npm.
https://buff.ly/3VVkBJy
https://cdn.fosstodon.org/media_attachments/files/112/257/380/595/374/455/original/94e6b4cd13a55b31.png

2024-04-10 16:16:01

There is nothing worse than security reports that claims there are vulnerabilities without reproducibility. Sigh.

2024-04-09 16:34:05

- reply

@npub1hce…c5cz https://redis.io/

2024-04-09 16:16:00

Imagine having one of the most recognizable logos in the database ecosystem. And then changing it to something anonymous.

2024-04-05 16:16:00

Back in 2017, Tracy Hinds led a session to at the Node.js collab summit to discover the values of the Node.js community. I came back to this post, and it's amazing to see how much all of this is still true!
https://medium.com/the-node-js-collection/node-js-core-values-ab5387c4fd49

2024-04-04 16:16:00

Open Source is all about community. I stand by "people before code", not "code before people". Let's not be full of fear. We work to empower trustworthy people as maintainers.

2024-03-25 17:16:01

I was just reminded that quite a lot of folks don't get OSS, and maintainers don’t offer free support for your important business.
IF YOU WANT SUPPORT, PAY FOR IT.

2024-03-22 17:16:00

Go watch the Node.js documentary
https://www.youtube.com/watch?v=LB8KwiiUGy0

2024-03-20 17:16:00

Here is your weekly reminder that the Node.js project is driven by volunteers. Therefore every feature that lands is because someone spent time (or money) to make it happen. This is called Open Governance.
(If you would like to help shape Node.js future, You can contribute!)

2024-03-13 17:16:01

I've worked for 2 weeks on a massive refactoring of Platformatic internals in order to implement a significant new feature.... the result is a PR with 124 files changed with 9535 lines added and 2542 lines removed.
I'm so sorry for my colleagues going through it right now!

2024-03-11 17:16:01

I'm working hard to fix some technical debt I took when developing Platformatic one year ago. What am I changing? The auto-update feature! It ensures you can take Platformatic v0.16.0 and run it today with v1.26.0 without change. The hard part? Ensure I'm not breaking anybody.

2024-03-08 17:16:01

free tiers in devtools were a zero interest rate phenomenon

2024-03-07 17:16:04

Like toys, the best technologies are the ones that sparks your imagination.
https://cdn.fosstodon.org/media_attachments/files/112/055/534/324/945/948/original/65c556fd318c3b01.jpeg

2024-03-06 17:26:27

- reply

@npub1z7j…9ex9 @npub1238…s9zf K3 sounds amazing! I’ll likely check out!

2024-03-06 17:16:05

I love this keyboard. What model is it? Is there something better on the market?
https://cdn.fosstodon.org/media_attachments/files/112/049/872/015/436/090/original/a1280f9cf746ae27.jpeg

2024-03-05 17:16:00

Displaying log lines is incredibly hard. We're working on it.

2024-03-04 17:16:01

if it’s a bug worth fixing, write a test for it.

2024-03-01 17:25:19

New off the press a new edition of Adventures in Nodeland, covering node:test and HTTP clients! https://buff.ly/4bXXmEj

2024-02-29 17:16:00

Something that's very hard to measure in server-side development is how your framework or application will react to spikes in traffic. Always measure an "impossible" situation, or how much traffic would be needed to "break" your application or framework.

2024-02-28 17:16:00

I think the developers are divided into two camps:
1. devs that format on save
2. devs that format on commit
I can’t work with format on save, to the point thar if I’m pairing I ask my peer to shut it off. My memory is mostly visual and rearranging the code completely breaks my flow.

2024-02-27 17:16:05

To all of you who think that Corepack should be enabled by default right now, consider that ~by default~ you'd lose the ability to have reproducible builds for your Node.js applications. This must be fixed before this technology is enabled by default.
https://github.com/nodejs/corepack/issues/399
https://cdn.fosstodon.org/media_attachments/files/112/004/573/637/180/098/original/413d30825599f7d5.png

2024-02-23 17:16:00

Writing unit tests is the “peeling potatoes” of the software engineer career. By increasing code coverage, you will:
1. learn how to read code
2. learn how to design software so that behaviors are testable from the outside
3. separate concerns as much as possible

2024-02-22 18:55:41

- reply

@npub19jf…kpmy @npub1238…s9zf 🤣🤣🤣