Readit News logoReadit News
Posted by u/eseidel 2 years ago
Show HN: Shorebird 1.0, Flutter Code Pushgithub.com/shorebirdtech/...
Hey HN. Eric Seidel here (former lead of Flutter & Dart at Google, prev. YC S06).

I founded Flutter and led the team for almost a decade. One of the constant questions we got was would we support code push like the web/react native: https://github.com/flutter/flutter/issues/14330 I left Google about a year ago and set out to build a company around Flutter and decided to start with code push.

It took us a year to build. We had to build a new toolchain for Dart and a custom interpreter (for store compliance). But it works! Our beta has already been used by thousands of apps. Most (eventually all) of the code is open source on GitHub.

I’ll be around all day to answer Flutter and Shorebird questions. We run our company in the public on Discord and are happy to take questions there too. Would love to hear your thoughts.

_mlbt · 2 years ago
Has there been any consideration of possibly spinning the Flutter project out of Google and into a non-profit foundation?

I think right now the biggest thing holding Flutter back isn’t technological, but rather the stigma that is attached to Google’s history of abandoning products. I understand that it is in widespread use in important products from Google and other major companies, but nearly every time Flutter comes up both here and on Reddit a significant number of comments are concerns about Google’s long-term commitment.

saghm · 2 years ago
I agree that this is a common concern with Google products, but I can't help but wonder if spinning Flutter out of Google would just end up being a vindication of those concerns rather than mitigation. If tomorrow Google came out and said that Flutter was being moved from Google ownership into a non-profit, I'm struggling to imagine that the community response would be "oh good, this shows that Google has a long-term commitment to Flutter" rather than people more cynically viewing it as yet another instance of Google shutting down a product, just with an attempt to avoid the PR repercussions. If Google really does care about it in the long term, I'm not really sure there's any way to win the debate about their stewardship, so they might as well just keep their heads down and focus on continuing work on it, and maybe someday if they do that long enough they might be able to win some trust back.
pas · 2 years ago
it's a hard problem, because when Google cares it might not be good for users of the various projects/tools/languages. these projects has specific goals (that serve Google's high-level goals in various ways) and circumstances (which many times lead to significantly different engineering trade-offs).

Google starts projects with a lot of initial investment (new language/compiler/toolset/SDK/std-lib/frontend-component-library), but then their boldness almost disappears, and it takes a lot of time for them to finally catch-up, and on top of that they usually take a long time to "care" about things important for users (non-google developers).

for their care/support/long-term-commitment to matter, first they (would) need to position themselves as downstream users of Flutter, and for that they first need to transform leadership into a community-driven something.

eseidel · 2 years ago
My understanding is there has been a lot of discussion about this. It's not something I'm actively pushing for.

One of the things I'm excited for with Shorebird is creating an economic entity whose purpose is moving Flutter forward. We're pretty early in our journey, but I would love to see us grow to be "the flutter company" over time.

I think it's still a little early to try and spin Flutter out as a non-profit, but I suspect as more companies contribute to Flutter something like that will happen.

lxgr · 2 years ago
> I think right now the biggest thing holding Flutter back isn’t technological, but rather the stigma that is attached to Google’s history of abandoning products.

No, as a user of some Flutter apps I also find them incredibly janky and wouldn't want to see the technology adopted (in this state!) even if it wasn't made by Google.

As nice as it might be to app developers, why should I pay for that with noticeable worse performance? How do you even make a brand new iPhone Pro drop frames when scrolling!?

Other than that, as far as I can tell it reimplements the entire UI rendering stack for web apps (there seems to be an optional HTML backend, but rendering to a canvas seems to be the default). As somebody never having used it... why? Doesn't this break all accessibility and native UI compatibility that browsers are providing out of the box?

mdhb · 2 years ago
I think your Flutter knowledge is really very out of date. They rewrote a rendering engine from the ground up and released it about a year ago and a lot of the problems you describe are no longer the case.
satvikpendem · 2 years ago
Why, because I can make an app that works on all platforms, seamlessly, and the apps on each platform do in fact have accessibility support. As the other commenter said, they have improved performance to a considerable degree. It's an alternative to React Native, not necessarily native development, and it's a great platform for such use cases.
bartekpacia · 2 years ago
This is amazing. Thank you very much for all you've done and are still doing. Flutter changed my life as a developer. I learned so much thanks to its culture of openess & embracing community contributions. I feel like it's something unseen in most other open-source projects of this scale - I'm speaking this as a person that contributes regularly & has been invited to #flutter-hackers a few months ago:)

I was at Fluttercon Berlin last year and I remember your talk where you said we need to build for the next 10 million developers who will use Flutter. Many tools that should exist for Flutter still don't exist. The fact that you did code push on Android & iOS is a great achievement (code push on desktop should be much easier to implement than iOS and it's only a matter of time for you) - but what's the next big thing you plan to accomplish at Shorebird?

eseidel · 2 years ago
Desktop is one of our most requested features: https://github.com/shorebirdtech/shorebird/issues/397

I suspect we still have many months of work to do for iOS and Android code push. Mostly a lot of features to build for larger customers.

After that, I'm not sure. We have a long list of ideas. Do you have particular needs around Flutter you'd like us to address?

bartekpacia · 2 years ago
I feel like the build system situation in Flutter is really unfortunate. For Android there's Gradle, for iOS/macOS there's Xcode (xcodebuild), CMake for Linux, some Visual Studio-something for Windows and so on. This causes problems at scale – reliable, incremental, cross-platform builds are very hard/impossible. Same goes for splitting the build work across multiple workers (aka remote build execution). I did some research on this and looks like Bazel is the tool designed to solve this kind of problems. Of course the cost of Bazel adoption is huge but at a certain scale it makes a lot of sense. As the number of huge Flutter codebases grows I think this problem will become more pervasive.

I read on flutter/flutter repo that Google has Bazel rules for Flutter, but they're internal and they're not interested in open-sourcing them.

lwansbrough · 2 years ago
We have a pretty large (surface area) Flutter app. One of our concerns with Shorebird in evaluating it early on was lack of JIT for iOS. As you mentioned, your custom interpreter solves this problem. But I guess my question is, how well?

Do you have performance data for comparison between the interpreted runtime and the official runtime?

Edit: found this thread + comment which answered most of my questions. https://github.com/shorebirdtech/shorebird/issues/1871#issue...

lxgr · 2 years ago
How are these "code pushing" technologies holding up when it comes to security?

Apps loading and executing additional code at runtime (as opposed to e.g. gating behavior using feature flags fetched from the backend) just doesn't sound like a great idea, even if it might technically pass the various app stores' review guidelines.

eseidel · 2 years ago
YouTube, TikTok, FaceBook (and any large game) have code push. And of course every app that uses a WebView or any other OTA service.

I do think code push is hard to get right. I think that's one of the values hopefully Shorebird can provide, by offering an easy-to-use and easy-to-get-right solution that's accessible to teams who use Flutter, but don't have an extra 10 engineers to write their own code push solution.

I feel very aligned with the stores in that what I want are great apps for users. Having users stuck on buggy/broken apps is a pain not just for companies but also for the platforms and most importantly the users (including from a security perspective).

lxgr · 2 years ago
I do agree with a lot of these points!

But should we then maybe just stop the pretense of "app stores control every executable byte of code in the apps they distribute" in favor of "app stores do content moderation at the business level; what apps technically do is up to their developers"?

Maybe we could even have both models (immutable, signed bundles vs. very dynamic entry points ad-hoc fetching parts of their logic), with app stores indicating which one an app purports to follow.

maartenh · 2 years ago
TIL that self-updating mobile apps are a thing. It is quite surprising to me that the app store gatekeepers don't force all app changes through their vetting process! Has this always been the case, or is this a new development?
eseidel · 2 years ago
Every time you launch YouTube, or TikTok or Facebook, or any large game, (or any App with a WebView), yeah. https://docs.shorebird.dev/faq#does-shorebird-comply-with-pl...https://docs.shorebird.dev/faq#does-shorebird-comply-with-ap...

There are also various other commercial services offering code push. Even Microsoft has one: https://learn.microsoft.com/en-us/appcenter/distribution/ina...

The stores obviously can punish apps who break their terms (not just around updates), but code push is ubiquitous because so many apps need the ability to fix bugs w/o waiting for every single user to click "update" in a store.

dr_kiszonka · 2 years ago
I am very curious about this too. Wouldn't this allow you to remotely inject malware into an app? For my own, non-malicious, project, I'd love for this to work, but I don't want the app store gods to wreak vengeance on me.

UPDATE: I found this.

Examples of SDK-caused violations

Your app includes an SDK that downloads executable code, such as dex files or native code, from a source other than Google Play.

fngjdflmdflg · 2 years ago
There are some limitations on what code push is allowed to do. Shorebird's docs[0] go over some of the details for the Play and App stores.

[0] https://docs.shorebird.dev/faq#does-shorebird-comply-with-pl...

realusername · 2 years ago
> It is quite surprising to me that the app store gatekeepers don't force all app changes through their vetting process!

It's be because they can't anyways, what about web pages, feature flags & server side rendered views? The review process is mostly there to not circumvent their payment process.

00deadbeef · 2 years ago
How is this App Store compliant? I’ve heard of people having apps rejected for including Expo’s OTA update feature.
eseidel · 2 years ago
We've seen 1000s of releases in the last year, and not had a single complaint about rejections. In general, Shorebird provides the tech, intended to help you comply with your obligations to these stores. There can be good actors and bad actors with any tech, but we're here to help the good actors, and using Shorebird to violate app stores is explicitly against our TOS.

The stores both have explicit language about updates being generally prohibited unless they use an interpreter or a VM, so long as they don't "significantly change" the functionality of the app. e.g. Apple's agreement: https://developer.apple.com/support/terms/apple-developer-pr... or Google's guidelines: https://support.google.com/googleplay/android-developer/answ...

Which we reference from our FAQs: https://docs.shorebird.dev/faq#does-shorebird-comply-with-pl...https://docs.shorebird.dev/faq#does-shorebird-comply-with-ap...

Apps written with a WebView obviously can self-update. Others (as you mention) have offered updater-related products for many years, including Microsoft: https://learn.microsoft.com/en-us/appcenter/distribution/ina... Large games ship their lua scripts down when you log in, etc. YouTube, Facebook, TikTok are all known to self-update. Self-updating seems to be pretty well established practice.

mixmastamyk · 2 years ago
I had to read the github ticket to find out what "code push" actually meant, as it is quite the generic term. Makes me think of git.

Turns out it means, "out-of-store updates," a description which I immediately understood. I'd lead with that.

eseidel · 2 years ago
Yeah, we picked "code push" to start with as that seemed to be the common term for similar: https://github.com/microsoft/react-native-code-push

It's possible we'll end up with a more Flutter-focused name like "hot patching" or something at some point.

mixmastamyk · 2 years ago
Hmm, hot patching (and code push) sound local and not particularly noteworthy.
edelans · 2 years ago
Hi Eric, congrats for the launch!

I'm curious, do you recommend any E2E test framework for Flutter? The idea behind hot pushing is releasing more often, for which you become more confident if you have some testing involved.

I'll make a shameless plug for my product (you don't get an opportunity to reach out to the Flutter founder every day!). I waited till the page was out of the front page to avoid looking like I was riding your show hn.

We claim we have the best support for writing and running end-to-end tests for mobile apps, and Waldo stands out in terms of compatibility with hybrid frameworks like RN or Flutter (where Appium support is poor). How can you tap on a button if your test framework doesn't "see" it?

We are releasing a new offer to run local test scripts on cloud devices, which has many benefits: https://dash.readme.com/project/usewaldo/v2.0/docs/getting-s... . By any chance, if you want to know more, I'd be glad to offer additional credits and even honored to do a personal demo (this holds for all HNers!)! My email is in my profile.