Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hippy: React Native Alternative by Tencent

github.com

Post reply on HN
Print view View original

41–50 of 80 posts

Re: Hippy: React Native Alternative by Tencent

#41

Post by iudqnolq »

tirpen wrote: post #18
shrimpx wrote: post #16

Earlier quoted context omitted.

Any state could spy on users but china is known to blatantly do so.

To be fair, so is the US (NSA) , but people rarely suggest that packages from the US should be monitored extra closely for some reason. Of course every package used in any code that contains sensitive data should be audited along with its dependant, but I see no reason to be more afraid of this particular package than anything people happily install from npm.

Two main reasons: better track record in the specific domain of forced modifications for intelligence collection, and US-based projects already have the same level of risk. I would assume that for sensitive Chinese projects US software is considered risky.

Re: Hippy: React Native Alternative by Tencent

#42

Post by asdkhadsj »

StreamBright wrote: post #37
DailyHN wrote: post #32

Earlier quoted context omitted.

People are saying that this looks like React Native fork. Since the project hasn't acknowledged the forking, they already have given good reason to be suspicious.

Did you such a thing for React?

Do you think that React Native was also a fork of something else?

Re: Hippy: React Native Alternative by Tencent

#43

Post by thrower123 »

iudqnolq wrote: post #40
thrower123 wrote: post #26

Earlier quoted context omitted.

It's a good idea, but increasingly impractical. Npm-based development is just such a fractal of dependencies; it'd take me a year to review everything that goes into a typical SPA, and by the time I was done 90% of the packages would have been updated significantly. I just hope the various cryptominers that get shoehorned in to umpteenth child dependencies fight against each other...

I'm confused. I would think more modular work is easier to review, plus modules allow deduplication. Is a module with 500,000 LoC in dependencies really that much harder to audit than a project that includes the same code internally?

A project that has 500kloc probably doesn't have anywhere the churn on most of that code that actively developed dependencies have. Most of that mass of first-party code is static and doesn't change much, if ever.

Re: Hippy: React Native Alternative by Tencent

#44

Post by asdkhadsj »

iudqnolq wrote: post #40
thrower123 wrote: post #26

Earlier quoted context omitted.

It's a good idea, but increasingly impractical. Npm-based development is just such a fractal of dependencies; it'd take me a year to review everything that goes into a typical SPA, and by the time I was done 90% of the packages would have been updated significantly. I just hope the various cryptominers that get shoehorned in to umpteenth child dependencies fight against each other...

I'm confused. I would think more modular work is easier to review, plus modules allow deduplication. Is a module with 500,000 LoC in dependencies really that much harder to audit than a project that includes the same code internally?

I think the issue is each module tends to include far more code than just what the project needed.

If everything was like the NPM meme where you install a package to check if something is true, then your LOC for that module with be quite limited.

However a single dependency is often big itself, and the 50 dependencies it has are also quite big. The LOC in the dep-dep is not the same as if it was written by hand in the dep.

So if you wrote your dep by hand you may use, say, 500,000 LOC - but with the tree of dependencies not being a 1:1 to what you use, you have to audit more like 2Mil LOC. Perhaps an audit could be aided by some sort of tree-shaking scenario, where all non-used code is removed, leaving you with the real 500,000 LOC that needs review.. Would be interesting.

I've been having this same problem with Rust lately. Frankly, I think it's true for any package platform you use.

Re: Hippy: React Native Alternative by Tencent

#45

Post by chvid »

verttii wrote: post #36
chvid wrote: post #29

I think it is really great to see the Chinese internet giants releasing some of their software as open source. In a time of geopolitical "tech wars" open source culture could easily become collateral damage.

Or a weapon.

How is that?

Re: Hippy: React Native Alternative by Tencent

#46

Post by athaca »

StreamBright wrote: post #37
DailyHN wrote: post #32

Earlier quoted context omitted.

People are saying that this looks like React Native fork. Since the project hasn't acknowledged the forking, they already have given good reason to be suspicious.

Did you such a thing for React?

The Chinese government is evil. Of course we suspect something is going on with this sketchy looking fork.

Re: Hippy: React Native Alternative by Tencent

#47

Post by yorwba »

unityByFreedom wrote: post #24
K0nserv wrote: post #10

I opened a random file(HippyBridge.h[0]) and it looks very similar to React Native's RCTBridge.h[1] which leads me to believe Hippy is either a fork of React Native or heavily "inspired" by it. A lot of the comments and symbols match React Native's 1-to-1. EDIT: I've read through more of the source and compared it to React Native. Like Jarred mentioned[2] it probably started out as a fork of React Native. 0: https://…

If it is a react native fork, I wonder if they plan to acknowledge that. Seems like that is the first thing you'd mention. I can't see a reason not to mention this unless you're trying to fool someone.

They do acknowledge using code from Vue: https://github.com/Tencent/Hippy/blob/e284c6b399e50bfb256469...

Re: Hippy: React Native Alternative by Tencent

#48

Post by droidist2 »

asdkhadsj wrote: post #44
iudqnolq wrote: post #40

Earlier quoted context omitted.

I'm confused. I would think more modular work is easier to review, plus modules allow deduplication. Is a module with 500,000 LoC in dependencies really that much harder to audit than a project that includes the same code internally?

I think the issue is each module tends to include far more code than just what the project needed. If everything was like the NPM meme where you install a package to check if something is true, then your LOC for that module with be quite limited. However a single dependency is often big itself, and the 50 dependencies it has are also quite big. The LOC in the dep-dep is not the same as if it was written by hand in th…

>I've been having this same problem with Rust lately. Frankly, I think it's true for any package platform you use.

Right, people act like node_modules is extremely special. They open the folder and say "Look at all of the files, what a mess!" as if other languages don't have this. Just in most other languages it's more hidden from you.

Re: Hippy: React Native Alternative by Tencent

#50

Post by mechnesium »

Disconcerting and suspicious to see so many Chinese codebases being advertized here. I feel that there is some nation state activity behind it. There is a ban on Chinese work products in sensitive industries (aerospace/defense, military, and government), and other industries should follow suit if they care about security.
Post reply on HN