Hacker News Reader

Comment by mdaniel | Hacker News Reader

While surfing around the various repos, I was reminded about the bad taste I got from the last time someone sung the praises of Flutter/Dart; this thing is firmly in the "Android SDK-ish" school of thought: download a shitload of prebuilt binaries from storage.googleapis.com, dontyouworryaboutit

  $ curl -I https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_3.24.4-stable.zip
  < content-length: 1575089988
  (nod)

View on HN

Would you recommend a different distribution mechanism? The Apple binaries are all signed (in accordance with Apple policies), and the team has historically invested significantly in supply chain security. e.g. (a now 2 year old article)

https://opensource.googleblog.com/2022/09/flutter-slsa-progr...

I'm in the camp of "if I can't build it, then it's not open source" so https://github.com/Homebrew/homebrew-core/blob/d314f3ebba9e7... is a good start, but there is no .../f/flutter.rb although there is https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=flutt... but I haven't been soaking in the AUR ecosystem long enough to be able to port it to Homebrew

All those words to say that if there was a .github/workflow/release.yml showing the steps required to cook a release artifact that would be the best(?) documentation since it is kind of like a Dockerfile in that it's computer executable but mostly human readable

I don't mean to poo-poo all the "supply chain security" effort, but you have to recognize that right now it's "trust me, bro" since https://github.com/Homebrew/homebrew-cask/blob/27c351ccb59fb... does check the sha256, and good for them, but gives me no way to trace back to any file in https://github.com/flutter/flutter/tree/3.24.4

Of all the different dev stacks I've used Flutter has given me the fewest issues across updates. I've never run `flutter upgrade` and then had serious trouble getting an existing project to run.

Compared to js, react & react native, python, ruby etc I've just never hit the same bitrot so they're doing something right.

Absolutely true. It’s so much easier to upgrade dependencies and if it works / most likely works. We had a small UI regression in a very large app and that hadn’t been touched in 1 year.

Almost everything these days is installed like that.

Reply on news.ycombinator.com