blog: iroh 1.0.3 and noq 1.1.0 release#504
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
divagant-martian
left a comment
divagant-martian
left a comment
There was a problem hiding this comment.
Love the content, hate the first paragraph. I do understand why it's hard to write so no shade on that. I suck at talking to people so sorry to leave such a red review when I myself wouldn't be able to do it this good
|
|
||
| Welcome to a new release of `iroh`, a modular networking stack in Rust, for building direct connections between devices. | ||
|
|
||
| After [last release's security fix](/blog/iroh-1-0-2), we're happy to be back to the good kind of boring. We've shipped iroh 1.0.3 together with [noq 1.1.0](https://github.com/n0-computer/noq/releases/tag/noq-v1.1.0) to give you a cleaner, smoother connection experience, without breaking any APIs. |
There was a problem hiding this comment.
Sorry to give critique without a concrete counterproposal - I'll come back to this tomorrow hopefully with one - but I'm not a fan of this paragraph. Perhaps I'm just not the right audience for it and it's quite fine for our users, but let me explain where my issue with it lies.
The overall tone: It feels apologetic and defensive. From this paragraph I wouldn't really know what the release is about, the "back to the good kind of boring" to me sounds like we are back in business after a shitshow that exposed users passwords or something quite serious, but it wasn't like that, we just dealt with it and it's fine. This will happen again, probably more than a couple of times. The part about "without breaking APIs" also isn't exactly encouraging: this is a minor/patch release and we are announcing we are doing the bare minimum in the semver contract with our users.
I would expect this paragraph to focus on why this release is one worth adopting, but writing this down I see it's hard to make it sound exciting and having a narrative. I think we could say the projects are settling into a stable maintenance cadence after 1.0 (and the previous security fix if you wish to acknowledge it explicitly), with incremental improvements to reliability (a bunch of bugs fixed between the previous minor now release and this one), developer experience (docs, logs, ci feedback, contributing), and overall ecosystem quality (like Adding pkarr resolver to n0 presets in iroh, for example)
I'll try to come back later with perhaps a more grounded suggestion
There was a problem hiding this comment.
hmm, I disagree with your interpretation that it sounds apologetic or defensive. To me it sounds informative, but not too serious. However, I acknowledge that it only contains a "flow" if you have been reading the previous blog posts (the narrative being, "hey this is boring" -> "this is slightly less boring" -> "back to boring").
Re: the project is settling into a stable cadence -> this was already announced in the 1.0.1.
I also do think it says why one should adopt this update -> "cleaner smoother connection experience"
That being said...I'm not attached to any of this enough to keep it as it is 😂
New version incoming!!!
|
|
||
| ## Know when a connection is trustworthy | ||
|
|
||
| noq adds a new `Connection::authenticated` method that succeeds as soon as an 0-RTT connection is proven to not be a replay attack (and always succeeds immediately in a 1-RTT connection). We still have `Connection::handshake_confirmed`, which waits longer for the client to confirm the client-side authentication. Read more [here](https://docs.rs/noq/latest/noq/struct.Connection.html#method.authenticated) |
There was a problem hiding this comment.
I'm on the fence about explicitly coming from the great work done in quinn. On one hand, the commit was cherry-picked and Benjamin is noted as main author, on the other.. the commit is not here, and I'm not sure it's worth doing that every time. Is it enough to link the commit with his name, is something like
noq brings from the work of our friends at quinn instead of noq adds less "appropriating"?
There was a problem hiding this comment.
Given this blog post is about iroh 1.0.3, I'd consider perhaps not mentioning this at all as long as this API hasn't made it into iroh itself. There are very few people using noq directly.
There was a problem hiding this comment.
Thank you this is the context that I need, since I didn't explicitly go through each commit and see which we did vs which were from upstream.
I'm going to remove this in favor of a general "we've also inherited some improvements from quinn, yay open source, etc"
matheus23
left a comment
matheus23
left a comment
There was a problem hiding this comment.
I kind of agree with @divagant-martian's assessment of comparing this patch release with the last. I think we can just say we're back with another patch release.
But it's also not a big deal and overall the blog LGTM.
IMO in the future I'm not sure if we even want to announce patch releases on our blog anymore. I don't think that's really common. A discord announcement might be enough tbqh.
|
|
||
| ## Connections hold up better under real-world conditions | ||
|
|
||
| This release closes up a handful of corner cases in noq: path validation is timed more correctly when a new path opens, stray packets from paths that have already been abandoned are no longer allowed to cause confusion, and a connection-accounting bug that could undercount active connections is fixed. Packet coalescing during the handshake is also more correct now, which matters most on networks that don't behave nicely. |
There was a problem hiding this comment.
Actually, it might make sense to mention the error messages that you'd used to see and say they're fixed.
So that'd be:
panicked at noq-1.0.1/src/endpoint.rs:648:17: attempt to subtract with overflowpanicked at noq-proto-1.0.1/src/connection/packet_builder.rs:159:9: assertion failed: max_size >= min_size
For the other bugfix, I unfortunately don't know what a bad trace would look like...
Co-authored-by: Diva Martínez <26765164+divagant-martian@users.noreply.github.com>
Co-authored-by: Philipp Krüger <philipp.krueger1@gmail.com>
I had the same thought, I have some pros vs cons in my head that I will bring up in discord. |
3 participants
No description provided.