I won't use this probable spyware, however I do hope that some RN competition can make RN grow, and be, a bit faster.
Open Source code is the worst possible place to hide spyware.
Hippy: React Native Alternative by Tencent
31–40 of 80 posts
Re: Hippy: React Native Alternative by Tencent
#32Re: Hippy: React Native Alternative by Tencent
#33Earlier quoted context omitted.
I dug around a little and installed their demo app in the iOS simulator: https://www.dropbox.com/s/hl3nk8jrcjleurj/hippy.mov?dl=0 . Visually, the only interesting part of the demo app is the RefreshWrapper example Code-wise, the most interesting things I've seen: - They expose wrappers for native recycling list views[0]. React Native does this in JavaScript through VirtualizedList, however some have experienced perfo…
> - It uses a closed-source fork of libv8 on Android called X5[6]. this makes my spidey senses tingle. What might be hidden there?
Maybe they hid casual racism.
Re: Hippy: React Native Alternative by Tencent
#34I won't use this probable spyware, however I do hope that some RN competition can make RN grow, and be, a bit faster.
Why speculate on whether it is spyware? Read the source and verify it for yourself. If there is spyware I would appreciate a link to the relevant lines.
Like Jarred wrote up there:
- It uses a closed-source fork of libv8 on Android called X5[6].
Re: Hippy: React Native Alternative by Tencent
#35Re: Hippy: React Native Alternative by Tencent
#36I think it is really great to see the Chinese internet giants releasing some of their software as open source. In a time of geopolitical "tech wars" open source culture could easily become collateral damage.
Or a weapon.
Re: Hippy: React Native Alternative by Tencent
#37Re: Hippy: React Native Alternative by Tencent
#38Earlier quoted context omitted.
To be fair, so is the US (NSA) , but people rarely suggest that packages from the US should be monitored extra closely for some reason. Of course every package used in any code that contains sensitive data should be audited along with its dependant, but I see no reason to be more afraid of this particular package than anything people happily install from npm.
There is not as much history of state inference in companies in the USA as there is in China
Given Snowden’s book and other leaks this is rather silly to claim.
Re: Hippy: React Native Alternative by Tencent
#39Earlier quoted context omitted.
There is not as much history of state inference in companies in the USA as there is in China
Given Snowden’s book and other leaks this is rather silly to claim.
Snowden was not talking about forced state inference in companies like with e.g. Huawei or Alibaba or many other, even small Chinese companies. While it happens, it certainly does not happen that much (while it's normal occurence in China) and if the companies are forced to something, it's most of the time through a court.
Re: Hippy: React Native Alternative by Tencent
#40Earlier quoted context omitted.
We don't need to get into international politics to answer this question. Security audits are good ideas on any open source project you want to put into production. They are a good idea even if you wrote the code yourself, to make sure you didn't leave vulnerabilities in your code by accident. Securing an app, and preventing data breaches, is simply good practice as professional software engineers.
It's a good idea, but increasingly impractical. Npm-based development is just such a fractal of dependencies; it'd take me a year to review everything that goes into a typical SPA, and by the time I was done 90% of the packages would have been updated significantly. I just hope the various cryptominers that get shoehorned in to umpteenth child dependencies fight against each other...
I'm confused. I would think more modular work is easier to review, plus modules allow deduplication. Is a module with 500,000 LoC in dependencies really that much harder to audit than a project that includes the same code internally?