5 ms·
Show HN: Shorebird 1.0, Flutter Code Push
Hey HN. Eric Seidel here (former lead of Flutter & Dart at Google, prev. YC S06).
I founded Flutter and led the team for almost a decade. One of the constant questions we got was would we support code push like the web/react native: https://github.com/flutter/flutter/issues/14330 https://github.com/flutter/flutter/issues/14330 I left Google about a year ago and set out to build a company around Flutter and decided to start with code push.
It took us a year to build. We had to build a new toolchain for Dart and a custom interpreter (for store compliance). But it works! Our beta has already been used by thousands of apps. Most (eventually all) of the code is open source on GitHub.
I’ll be around all day to answer Flutter and Shorebird questions. We run our company in the public on Discord and are happy to take questions there too. Would love to hear your thoughts.
- mfkp 3y agoLooks cool. Was just about to start a new project with react native, but I might just have to check out flutter again to give this a shot.
- nerder92 3y agoNot a question but a prop, this is truly a great product built by a great team! One day I hope to be able to truly do CD on mobile to avoid the annoying gatekeeping of the app stores, for sure Shorebird is the way!
- bartekpacia 3y agoThis is amazing. Thank you very much for all you've done and are still doing. Flutter changed my life as a developer. I learned so much thanks to its culture of openess & embracing community contributions. I feel like it's something unseen in most other open-source projects of this scale - I'm speaking this as a person that contributes regularly & has been invited to #flutter-hackers a few months ago:) I was at Fluttercon Berlin last year and I remember your talk where you said we need to build for the next 10 million developers who will use Flutter. Many tools that should exist for Flutter still don't exist. The fact that you did code push on Android & iOS is a great achievement (code push on desktop should be much easier to implement than iOS and it's only a matter of time for you) - but what's the next big thing you plan to accomplish at Shorebird?
- eseidel 3y agoDesktop is one of our most requested features: https://github.com/shorebirdtech/shorebird/issues/397 https://github.com/shorebirdtech/shorebird/issues/397 I suspect we still have many months of work to do for iOS and Android code push. Mostly a lot of features to build for larger customers. After that, I'm not sure. We have a long list of ideas. Do you have particular needs around Flutter you'd like us to address?
- bartekpacia 3y agoI feel like the build system situation in Flutter is really unfortunate. For Android there's Gradle, for iOS/macOS there's Xcode (xcodebuild), CMake for Linux, some Visual Studio-something for Windows and so on. This causes problems at scale – reliable, incremental, cross-platform builds are very hard/impossible. Same goes for splitting the build work across multiple workers (aka remote build execution). I did some research on this and looks like Bazel is the tool designed to solve this kind of problems. Of course the cost of Bazel adoption is huge but at a certain scale it makes a lot of sense. As the number of huge Flutter codebases grows I think this problem will become more pervasive. I read on flutter/flutter repo that Google has Bazel rules for Flutter, but they're internal and they're not interested in open-sourcing them.
- eseidel 3y agoI agree 100%. Flutter needs a real build system. Bazel could be that? Feels better than inventing a new one. Google has Flutter and Dart rules, yes, but they were started so long ago (for Google AdWords, which uses Dart on the Web), and historically were very tied to internal Google oddities. If we went with Bazel, we'd just write new ones publicly.
- 392 3y agoCould write them for Buck2 and avoid the old bazelisms. But already need a jvm I guess so bazel is no harm.
- _mlbt 3y agoHas there been any consideration of possibly spinning the Flutter project out of Google and into a non-profit foundation? I think right now the biggest thing holding Flutter back isn’t technological, but rather the stigma that is attached to Google’s history of abandoning products. I understand that it is in widespread use in important products from Google and other major companies, but nearly every time Flutter comes up both here and on Reddit a significant number of comments are concerns about Google’s long-term commitment.
- lxgr 3y ago> I think right now the biggest thing holding Flutter back isn’t technological, but rather the stigma that is attached to Google’s history of abandoning products. No, as a user of some Flutter apps I also find them incredibly janky and wouldn't want to see the technology adopted (in this state!) even if it wasn't made by Google. As nice as it might be to app developers, why should I pay for that with noticeable worse performance? How do you even make a brand new iPhone Pro drop frames when scrolling!? Other than that, as far as I can tell it reimplements the entire UI rendering stack for web apps (there seems to be an optional HTML backend, but rendering to a canvas seems to be the default). As somebody never having used it... why? Doesn't this break all accessibility and native UI compatibility that browsers are providing out of the box?
- mdhb 3y agoI think your Flutter knowledge is really very out of date. They rewrote a rendering engine from the ground up and released it about a year ago and a lot of the problems you describe are no longer the case.
- msoad 3y agoAny iPhone App that I can try to see how the performance is these days? I remember Google Wallet app was horrible performance wise about two years ago
- 3y ago
- lxgr 3y agoHow are these "code pushing" technologies holding up when it comes to security? Apps loading and executing additional code at runtime (as opposed to e.g. gating behavior using feature flags fetched from the backend) just doesn't sound like a great idea, even if it might technically pass the various app stores' review guidelines.
- eseidel 3y agoYouTube, TikTok, FaceBook (and any large game) have code push. And of course every app that uses a WebView or any other OTA service. I do think code push is hard to get right. I think that's one of the values hopefully Shorebird can provide, by offering an easy-to-use and easy-to-get-right solution that's accessible to teams who use Flutter, but don't have an extra 10 engineers to write their own code push solution. I feel very aligned with the stores in that what I want are great apps for users. Having users stuck on buggy/broken apps is a pain not just for companies but also for the platforms and most importantly the users (including from a security perspective).
- lxgr 3y agoI do agree with a lot of these points! But should we then maybe just stop the pretense of "app stores control every executable byte of code in the apps they distribute" in favor of "app stores do content moderation at the business level; what apps technically do is up to their developers"? Maybe we could even have both models (immutable, signed bundles vs. very dynamic entry points ad-hoc fetching parts of their logic), with app stores indicating which one an app purports to follow.
- saagarjha 2y agoWe should.
- lwansbrough 3y agoWe have a pretty large (surface area) Flutter app. One of our concerns with Shorebird in evaluating it early on was lack of JIT for iOS. As you mentioned, your custom interpreter solves this problem. But I guess my question is, how well? Do you have performance data for comparison between the interpreted runtime and the official runtime? Edit: found this thread + comment which answered most of my questions. https://github.com/shorebirdtech/shorebird/issues/1871#issuecomment-2040568074 https://github.com/shorebirdtech/shorebird/issues/1871#issue...
- maartenh 3y agoTIL that self-updating mobile apps are a thing. It is quite surprising to me that the app store gatekeepers don't force all app changes through their vetting process! Has this always been the case, or is this a new development?
- dr_kiszonka 3y agoI am very curious about this too. Wouldn't this allow you to remotely inject malware into an app? For my own, non-malicious, project, I'd love for this to work, but I don't want the app store gods to wreak vengeance on me. UPDATE: I found this. Examples of SDK-caused violations Your app includes an SDK that downloads executable code, such as dex files or native code, from a source other than Google Play.
- fngjdflmdflg 3y agoThere are some limitations on what code push is allowed to do. Shorebird's docs[0] go over some of the details for the Play and App stores. [0] https://docs.shorebird.dev/faq#does-shorebird-comply-with-play-store-guidelines https://docs.shorebird.dev/faq#does-shorebird-comply-with-pl...
- dr_kiszonka 2y agoThanks! It doesn't seem like they address the specific policy I referenced. Hopefully, they if add it soon.
- eseidel 3y agoEvery time you launch YouTube, or TikTok or Facebook, or any large game, (or any App with a WebView), yeah. https://docs.shorebird.dev/faq#does-shorebird-comply-with-play-store-guidelines https://docs.shorebird.dev/faq#does-shorebird-comply-with-pl... https://docs.shorebird.dev/faq#does-shorebird-comply-with-app-store-guidelines https://docs.shorebird.dev/faq#does-shorebird-comply-with-ap... There are also various other commercial services offering code push. Even Microsoft has one: https://learn.microsoft.com/en-us/appcenter/distribution/inappupdates https://learn.microsoft.com/en-us/appcenter/distribution/ina... The stores obviously can punish apps who break their terms (not just around updates), but code push is ubiquitous because so many apps need the ability to fix bugs w/o waiting for every single user to click "update" in a store.
- mixmastamyk 3y agoI had to read the github ticket to find out what "code push" actually meant, as it is quite the generic term. Makes me think of git. Turns out it means, "out-of-store updates," a description which I immediately understood. I'd lead with that.
- eseidel 3y agoYeah, we picked "code push" to start with as that seemed to be the common term for similar: https://github.com/microsoft/react-native-code-push https://github.com/microsoft/react-native-code-push It's possible we'll end up with a more Flutter-focused name like "hot patching" or something at some point.
- mixmastamyk 3y agoHmm, hot patching (and code push) sound local and not particularly noteworthy.
- Humphrey 3y agoDoes this still run AOT built code at fully optimised native performance? Your FAQ's mention that the App & Play stores allow interpretted code to be downloaded, but not native code. So this reads to me that this solution might be running things closer to JIT debug mode than AOT release mode. Help me understand this please.
- abarth 3y agoOn iOS, the code that you've modified runs in an interpreter but code you haven't changed runs the existing fully optimized AOT code that's already in your app.
- 00deadbeef 3y agoHow is this App Store compliant? I’ve heard of people having apps rejected for including Expo’s OTA update feature.
- eseidel 2y agoWe've seen 1000s of releases in the last year, and not had a single complaint about rejections. In general, Shorebird provides the tech, intended to help you comply with your obligations to these stores. There can be good actors and bad actors with any tech, but we're here to help the good actors, and using Shorebird to violate app stores is explicitly against our TOS. The stores both have explicit language about updates being generally prohibited unless they use an interpreter or a VM, so long as they don't "significantly change" the functionality of the app. e.g. Apple's agreement: https://developer.apple.com/support/terms/apple-developer-program-license-agreement/#b331 https://developer.apple.com/support/terms/apple-developer-pr... or Google's guidelines: https://support.google.com/googleplay/android-developer/answer/9888379?hl=en https://support.google.com/googleplay/android-developer/answ... Which we reference from our FAQs: https://docs.shorebird.dev/faq#does-shorebird-comply-with-play-store-guidelines https://docs.shorebird.dev/faq#does-shorebird-comply-with-pl... https://docs.shorebird.dev/faq#does-shorebird-comply-with-app-store-guidelines https://docs.shorebird.dev/faq#does-shorebird-comply-with-ap... Apps written with a WebView obviously can self-update. Others (as you mention) have offered updater-related products for many years, including Microsoft: https://learn.microsoft.com/en-us/appcenter/distribution/inappupdates https://learn.microsoft.com/en-us/appcenter/distribution/ina... Large games ship their lua scripts down when you log in, etc. YouTube, Facebook, TikTok are all known to self-update. Self-updating seems to be pretty well established practice.
- pritambarhate 2y agoThis service is straight up lying when it says that Remote Code Push is implemented as per Apple's guidelines. Apple expressly prohibits Remote Code Push and if your app is found doing this, it can be banned by Apple. Here is the guideline from Apple for the same: 2.5.2: Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code which introduces or changes features or functionality of the app, including other apps. Educational apps designed to teach, develop, or allow students to test executable code may, in limited circumstances, download code provided that such code is not used for other purposes. Such apps must make the source code provided by the app completely viewable and editable by the user. Ref: https://developer.apple.com/app-store/review/guidelines/ https://developer.apple.com/app-store/review/guidelines/
- LVB 2y agoHere is their stance on that: https://docs.shorebird.dev/faq#does-shorebird-comply-with-app-store-guidelines https://docs.shorebird.dev/faq#does-shorebird-comply-with-ap... I'm very interested in this tech but have never used it. From the FAQ it seems like that while they need to deliver a compliant system (e.g. interpreted code, I guess), the author is on the hook for following the spirit of the rule.
- animeshjain 2y agoabout how much size does shorebird add to the app bundle?
- wiradikusuma 2y agoWill this work with state management libraries like Bloc, and libraries that depend on code generation like MobX? And how about adding new (Dart-only) libraries in pubspec? EDIT: Also, flavors.
- eseidel 2y agoYes. Works with any Dart code (no restrictions whatsoever), including code generation. Also works with flavors.
- edelans 2y agoHi Eric, congrats for the launch! I'm curious, do you recommend any E2E test framework for Flutter? The idea behind hot pushing is releasing more often, for which you become more confident if you have some testing involved. I'll make a shameless plug for my product (you don't get an opportunity to reach out to the Flutter founder every day!). I waited till the page was out of the front page to avoid looking like I was riding your show hn. We claim we have the best support for writing and running end-to-end tests for mobile apps, and Waldo stands out in terms of compatibility with hybrid frameworks like RN or Flutter (where Appium support is poor). How can you tap on a button if your test framework doesn't "see" it? We are releasing a new offer to run local test scripts on cloud devices, which has many benefits: https://dash.readme.com/project/usewaldo/v2.0/docs/getting-started https://dash.readme.com/project/usewaldo/v2.0/docs/getting-s... . By any chance, if you want to know more, I'd be glad to offer additional credits and even honored to do a personal demo (this holds for all HNers!)! My email is in my profile.