As I was reading the release notes for Debian Jessie, I came upon these paragraphs:
The Node.js platform is built on top of libv8-3.14, which experiences a high volume of security issues, but there are currently no volunteers within the project or the security team sufficiently interested and willing to spend the large amount of time required to stem those incoming issues.
Unfortunately, this means that libv8-3.14, nodejs, and the associated node-* package ecosystem should not currently be used with untrusted content, such as unsanitized data from the Internet.
In addition, these packages will not receive any security updates during the lifetime of the Jessie release.
I read that as "don't run a web-facing Node.js application on this operating system" but is it really that bad? It seems surprising to me that something as popular as Node.js would basically be warned against because of a lack of libv8 maintainers.
Are Debian recommending that you avoid running any web-facing Node.js service on Debian Jessie, or does it only apply to some more risky kinds of service?