Hippy: React Native Alternative by Tencent | Hacker News Reader

Hippy: React Native Alternative by Tencent

github.com

98 pointsJarred68 comments

I opened a random file(HippyBridge.h[0]) and it looks very similar to React Native's RCTBridge.h[1] which leads me to believe Hippy is either a fork of React Native or heavily "inspired" by it. A lot of the comments and symbols match React Native's 1-to-1.

EDIT: I've read through more of the source and compared it to React Native. Like Jarred mentioned[2] it probably started out as a fork of React Native.

0: https://github.com/Tencent/Hippy/blob/master/ios/sdk/base/Hi...

1: https://github.com/facebook/react-native/blob/master/React/B...

2: https://news.ycombinator.com/item?id=21877857

If it is a react native fork, I wonder if they plan to acknowledge that. Seems like that is the first thing you'd mention.

I can't see a reason not to mention this unless you're trying to fool someone.

They do acknowledge using code from Vue: https://github.com/Tencent/Hippy/blob/e284c6b399e50bfb256469...

Not from react, which is what parent comment was talking about. That they acknowledge code use from another source is irrelevant.

It's not irrelevant, since that makes it more puzzling why they'd acknowledge one project but not another.

Perhaps bc Evan You is Chinese.

In the bottom of their license file they have a MIT license[0]. But they only mention someone named Evan You

> Hippy-Vue and Hippy-Vue-Router is using the part of codes write by Evan You with MIT license.<MIT license>

My best guess is that Evan is this person [1][2]. So that still doesn't seem to fit the proper MIT license agreements if you're right, and it looks like you are.

[0] https://github.com/Tencent/Hippy/blob/master/LICENSE

[1] https://github.com/yyx990803

[2] https://evanyou.me/

Evan is the author or Vue.js which they also seem to have borrowed code from. A lot of the core code seems to be React Native with `s/RCT/Hippy/g` applied.

Yes? We are in agreement? I am saying that they recognize Evan. Which is odd that they recognize one thing and not another.

Yes we are, just adding context for anyone reading who is unfamiliar with Evan's work.

Okay, sorry. I had misinterpreted your comment because an associated (I guess coincidental) downvote.

Looks like they haven't put up much documentation yet - hard to say what this is really.

How do you work with different platforms? How does the performance compare to React Native? Can we see examples? What APIs exist to access native functionalities? How complete is the Flex implementation?

I dug around a little and installed their demo app in the iOS simulator: https://www.dropbox.com/s/hl3nk8jrcjleurj/hippy.mov?dl=0. Visually, the only interesting part of the demo app is the RefreshWrapper example

Code-wise, the most interesting things I've seen:

- They expose wrappers for native recycling list views[0]. React Native does this in JavaScript through VirtualizedList, however some have experienced performance issues with it[1]

- They wrote their own flexbox layout library[2] (likely based on Yoga)

- It works with both Vue[3] and React

- Hippy supports web as a build target out of the box[4] (react-native-web is a 3rd party library)

- Touch events work on the `<View />` component directly, instead of needing to wrap `<View />`'s in the `<Touchable />` components[5]

- It uses a closed-source fork of libv8 on Android called X5[6].

The API & coding style is quite similar to React Native, but the implementation seems different. I'm guessing this started as an internal fork of React Native and turned into a large refactor, but that's just a guess

[0]: https://github.com/Tencent/Hippy/blob/master/ios/sdk/compone...

[1]: https://github.com/facebook/react-native/issues/13413

[2]: https://github.com/Tencent/Hippy/tree/master/layout

[3]: https://github.com/Tencent/Hippy/tree/master/packages/hippy-...

[4]: https://github.com/Tencent/Hippy/tree/master/packages/hippy-...

[5]: https://github.com/Tencent/Hippy/tree/master/packages/hippy-...

[6]: https://github.com/Tencent/Hippy/issues/9#issuecomment-56822...

> - It uses a closed-source fork of libv8 on Android called X5[6].

this makes my spidey senses tingle. What might be hidden there?

I agree. If Facebook had a closed source lib in RN it would be DOA.

I would be very curious to know why and if there are plans to replace with open source.

I don't think it would be easy to push the switch to management: "We'd like to rewrite our React Native up to use Hippy..."

Hippy is now applied in 18 Tencent apps concerning tens of billions of ordinary users.

Having used a lot of these apps I wonder if this is indeed what they use to deliver near native experience with web technologies..

Where did they find the extra 2.5 billion people?

They are probably talking about unqiue users in each app. 10b/18 ≈ 555m per app which isn't unreasonable for Tencent.

According to their chinese doc, the number is actually "multiple hundred millions", so it's more likely just a translation issue.

Chinese (and japanese) use 4 digit separated factors, so it's easy to make these kind of mistakes. eg 100 ten-thousands not 1000 x 1000s. Even after living there awhile, converting big currency numbers is a pain.

Does anyone know which app this is ?

I think it is really great to see the Chinese internet giants releasing some of their software as open source.

In a time of geopolitical "tech wars" open source culture could easily become collateral damage.

Or a weapon.

How is that?

Corporations have been using open source to exert technological dominance and push standards that favour their agenda for some time. It's proving so effective to have direct control on software and standards that more and more companies are engaging into this activity.

Certain tools come with telemetry that is used to track the users. On top of this, by making open source these corporations are seen as good for the community by naive engineers.

You can find here on HN articles that talk about how Google is using Chrome to bend the web to its will, how Visual Studio Code tracks its users and how Facebook uses its Android SDK to track smartphones. JetBrains declared they made Kotlin with the intent of gaining an edge on competition for Java IDEs (no spying intent declared or reported, but I want to highlight that even for a $300 million company technological domain is proving effective).

Tencent is merely doing what other corporations have been doing for decades.

Tencent is one of the companies responsible for China’s dystopian sesame credit scheme, for one. I would not want to contribute to any of their projects.

Sesame Credit is operated by Ant Financial, a subsidiary of Alibaba. They're a competitor to whatever credit scoring Tencent does for their forays into micro-lending.

Bringing in the Tencent credit scoring for micro-lending is muddying the issue. Possibly I’m guessing an intentional move on their part to limit the damage from their association with Sesame Credit.

As I understand it Tencent has worked closely with the Chinese government to enable its social media properties like WeChat to feed data into Sesame Credit on a massive scale. This is a project that they support and enable, and I believe in the early days they were also one of the companies that helped to develop it, regardless of who currently operates it on paper.

"New React Native"

I won't use this probable spyware, however I do hope that some RN competition can make RN grow, and be, a bit faster.

Why speculate on whether it is spyware? Read the source and verify it for yourself. If there is spyware I would appreciate a link to the relevant lines.

Like Jarred wrote up there:

- It uses a closed-source fork of libv8 on Android called X5[6].

How do you read the source of a closed source library? I mean sure reverse engineering is possible but it’s a bit flippant to suggest that everyone has time to do this. Even if it did not have closed source libraries, it’s a bit much to assume everyone affected can understand the source.

We already know that tencent engages in bad stuff on behalf of the Chinese government (Sesame Credit as a concrete example) so they shouldn’t be presumed innocent right out of the box.

What’s wrong with existing cross platform frameworks? You have to wonder what their agenda is for creating this.

> Sesame Credit as a concrete example

Sesame Credit is not a Tencent project. If you're going to get facts wrong, at least don't repeat them more than once. https://news.ycombinator.com/item?id=21879422

> You have to wonder what their agenda is for creating this.

Career advancement for everyone on the list of contributors.

I believe that when it started out they were also working on it, but I’ll admit to not having a source at the moment. Would not be surprised if all evidence of their involvement has been wiped from the internet though.

In the meantime I’m pretty sure they fully cooperate with the Chinese government in supplying data to the Sesame Credit system through their social media properties like WeChat. Something that more ethical competitors like WhatsApp have refused to do.

Open Source code is the worst possible place to hide spyware.

Hurdur:

- It uses a closed-source fork of libv8 on Android called X5[6].

Anyone done a security audit on this yet?

Why?

The Chinese state perhaps including backdoors to spy on users?

I guess we should do the same about any open source project. I don't know a state who has proven to be reliable.

Any state could spy on users but china is known to blatantly do so.

To be fair, so is the US (NSA) , but people rarely suggest that packages from the US should be monitored extra closely for some reason.

Of course every package used in any code that contains sensitive data should be audited along with its dependant, but I see no reason to be more afraid of this particular package than anything people happily install from npm.

There is not as much history of state inference in companies in the USA as there is in China

Given Snowden’s book and other leaks this is rather silly to claim.

Snowden was not talking about forced state inference in companies like with e.g. Huawei or Alibaba or many other, even small Chinese companies. While it happens, it certainly does not happen that much (while it's normal occurence in China) and if the companies are forced to something, it's most of the time through a court.

https://www.bbc.com/news/world-europe-32542140

https://theintercept.com/2014/12/13/belgacom-hack-gchq-insid...

https://en.wikipedia.org/wiki/Operation_Socialist

https://www.infoworld.com/article/2608141/snowden--the-nsa-p...

Two main reasons: better track record in the specific domain of forced modifications for intelligence collection, and US-based projects already have the same level of risk. I would assume that for sensitive Chinese projects US software is considered risky.

There's a good reason for that: US does not really need to put backdoors in software to spy. They have the largest tech companies under their legislation and can already force them to disclose information on users. Most companies won't argue and hand over things silently.

They have international agreements with a number of countries for surveillance.

This means that unless an app is completely hosted, in all parts from source code to production, in a privacy-friendly country, on servers provided by a privacy-friendly company and the app is made by a company in similar conditions, the US and EU have all they need.

While there have been some serious breaches of trust, US companies have a track record of fighting governments openly in court to avoid sharing data with them.

Chinese companies absolutely do not have this track record. Chinese companies are essentially an extension of the heavy hand of the Chinese Communist Party.

We don't need to get into international politics to answer this question. Security audits are good ideas on any open source project you want to put into production. They are a good idea even if you wrote the code yourself, to make sure you didn't leave vulnerabilities in your code by accident. Securing an app, and preventing data breaches, is simply good practice as professional software engineers.

It's a good idea, but increasingly impractical. Npm-based development is just such a fractal of dependencies; it'd take me a year to review everything that goes into a typical SPA, and by the time I was done 90% of the packages would have been updated significantly.

I just hope the various cryptominers that get shoehorned in to umpteenth child dependencies fight against each other...

I'm confused. I would think more modular work is easier to review, plus modules allow deduplication. Is a module with 500,000 LoC in dependencies really that much harder to audit than a project that includes the same code internally?

A project that has 500kloc probably doesn't have anywhere the churn on most of that code that actively developed dependencies have. Most of that mass of first-party code is static and doesn't change much, if ever.

I think the issue is each module tends to include far more code than just what the project needed.

If everything was like the NPM meme where you install a package to check if something is true, then your LOC for that module with be quite limited.

However a single dependency is often big itself, and the 50 dependencies it has are also quite big. The LOC in the dep-dep is not the same as if it was written by hand in the dep.

So if you wrote your dep by hand you may use, say, 500,000 LOC - but with the tree of dependencies not being a 1:1 to what you use, you have to audit more like 2Mil LOC. Perhaps an audit could be aided by some sort of tree-shaking scenario, where all non-used code is removed, leaving you with the real 500,000 LOC that needs review.. Would be interesting.

I've been having this same problem with Rust lately. Frankly, I think it's true for any package platform you use.

>I've been having this same problem with Rust lately. Frankly, I think it's true for any package platform you use.

Right, people act like node_modules is extremely special. They open the folder and say "Look at all of the files, what a mess!" as if other languages don't have this. Just in most other languages it's more hidden from you.

People are saying that this looks like React Native fork.

Since the project hasn't acknowledged the forking, they already have given good reason to be suspicious.

Did you such a thing for React?

Do you think that React Native was also a fork of something else?

Do you think that only forks of projects can have security issues?

> Do you think that only forks of projects can have security issues?

Huh? I'm replying to someone inquiring why someone else didn't review a fork. Aka, the GP was focused on the Fork aspect of Hippy, and the Parent asked about React, as if React was a fork.

I think you misunderstood the comment chain. I was not even talking about security issues or how that affects forking. I was merely replying to another discussion about forking, and how React is viewed in that "forking light".

The top-level comment in the chain is "Anyone done a security audit on this yet?" I was interpreting the forking discussion as an aspect of the security discussion.

It is - I guess I just mean, the reply I was specifically replying to seemed to be concerned on if OP cared about the forking of React.

Vagueness and confusion all around, haha.

Disconcerting and suspicious to see so many Chinese codebases being advertized here. I feel that there is some nation state activity behind it. There is a ban on Chinese work products in sensitive industries (aerospace/defense, military, and government), and other industries should follow suit if they care about security.

Please do not copy/paste comments on HN. That strictly lowers the signal/noise ratio.

Also, your comment breaks the site guideline against insinuating astroturfing, shillage, etc., without evidence. I replied to you about that here: https://news.ycombinator.com/item?id=21879877. Please don't do it again.

Reply on news.ycombinator.com