loic-sharma

You might want to try Dart. It is simple, has great tooling, and compiles to native code.

Disclaimer: I work on Flutter at Google.

FWIW, the NuGet package format and the v3 server protocol are fairly simple and well documented.

If you import all packages on nuget.org? You’re likely looking at terabytes of data.

The import tooling can be used to migrate off another NuGet server implementation.

This project helps but isn’t enough alone:

1. Dart can’t cross-compile from Linux to iOS yet. You could use Dart’s interpreter instead, but that’d significantly regress performance.

2. Flutter iOS projects use the Xcode project format, you’d need to migrate that to xtool’s project format

3. Flutter hasn’t finished migrating its plugin ecosystem from CocoaPods to SwiftPM - any plugin that hasn’t migrated to SwiftPM yet likely won’t work with xtool.

There’s also Shaft, which is Flutter ported to Swift:

https://github.com/ShaftUI/Shaft

Like Flutter, this paints everything itself. It doesn’t need to bind to a UI framework directly. Instead, it needs the platform to provide primitives like a surface to draw into and input events.

While the editor component is based off Monaco, the IDE is not a vscode fork and was written from scratch.

Interesting! What are the trade-offs here?

Impeller - Flutter’s rendering library that replaces Skia on iOS and Android - is working on a C API: https://github.com/flutter/engine/blob/main/impeller/toolkit...

Canonical gave an update on Flutter desktop last weekend at their Ubuntu Summit: https://events.canonical.com/event/51/contributions/533/

two_dimensional_scrollables is a first-party package by the Flutter team that implements table views and tree views: https://pub.dev/packages/two_dimensional_scrollables

Your browser goes through extraordinary lengths to support this sort of thing.

Flutter Linux targets GTK3 and is currently investigating a GTK4 migration. Flutter also supports Windows and macOS.

Agreed! Azure’s best product isn’t CosmosDB, AKS, or their AI cognitive services - it’s Kusto! Sadly no one knows about it.

If you’re interested, you can try it here: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/...

This is incorrect. It was their query engine that was hard to optimize, not the language. InfluxDB has been working on a new query engine based off Apache DataFusion to fix this.

If you squint, this query language is very similar to Polars, which is state-of-the-art for performance. I expect Pql could be as performant with sufficient investment.

The real problem is that creating a new query language is a ton of work. You need to create tooling, language servers, integrate with notebooks, etc… If you use SQL you get all of this for free.

Skia relies heavily on runtime shader compilation, which is slow and causes frame jank but improves peak performance. Skia also supports much older devices than Flutter does.

There’s no free lunch, Impeller has a different set of trade offs that are a better fit for Flutter.

Spammers just try to find something that ranks high in SEO and costs them nothing, if repository stops being that most will leave.

This is not true. Spammers will continue trying even if you are very good about removing spam packages. Source: worked on a package manager for 5 years.

Most other package repositories don't have that problem to such degree

They do, you’re just not seeing it because they’re actively removing packages. That said, NPM is the largest package ecosystem and likely receives the most spam.

Users will do the flagging for that so at least you won't have too many valid packages to verify

The trick is to have detection that’s accurate enough that you feel confident removing packages without human intervention.

Package managers have likely already built lots of tooling to detect potential spam and then bulk remove them. That’s how they manage thousands of spam removals per week in a reasonable amount of time. Nonetheless, human verification is necessary due to the “left pad problem”. This takes time due to the sheer quantity of spam.

Disallowing automated publishing would prevent CI/CD scenarios.

The spammers are creating large amounts of one-off accounts on external login providers like Microsoft Account. I’m sure those have some sort of CAPTCHA.

Google search is an extremely common way to discover packages. Disabling indexing entirely isn’t a valid solution.

Downloads are very easy to fake. Usually package managers don’t allow indexing until the package and its author reach a certain age. This allows the team to discover and remove the package before it is indexed.

Exactly this. Don’t blame the team as they’re doing the best they can with their limited resources. However, calling out spam on HN will help convince Microsoft’s leadership to invest in this problem :)

Sure, but removing or unlisting a valid package could break projects. The folks maintaining the package ecosystem need to be careful.

Let’s say there’s 10 spam uploads per hour and it takes you 1 second to verify a package is spam and remove it. That’s 30 minutes a week just dealing with spam. While I was on the .NET package manager, we had the on-call engineer handle this thankless chore.

Could you detect these packages at upload time? Yes, but spammers will change their patterns once the package ecosystem gets too effective at detecting current patterns. Perhaps machine learning could help, but often times package manager teams are small and don’t have expertise in this area. Regardless, package removals require human review.

The .NET ecosystem has this [1], so far adoption has been low. Similar to HTTPS until LetsEncrypt, we need something that’s more convenient if we want developer adoption.

[1] https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-n...

Please check the contribution guide: https://github.com/flutter/flutter/blob/master/CONTRIBUTING....

We strive to be an open community. Anyone can become a Flutter team member if they contribute frequently :)

Google's Flutter team was affected by layoffs and we lost some wonderful folks. However, the number of Googlers working directly on Flutter has grown substantially in the last year.

Please keep in mind that Flutter is a community project. Google is one of Flutter's many sponsors, many of our contributors are from other companies.

Agreed! We will add support for window customization as part of the multi-window effort.

Yup, but we're focused on mobile first as these are the most resource constrained platforms. We're also experimenting with 3D support in Flutter using Impeller. Check out these demos from Flutter Forward: https://youtu.be/zKQYGKAe5W8?t=6955

You can learn more about Impeller here: https://www.youtube.com/watch?v=gKrYWC_SDxQ

Hello, I'm from the Flutter desktop team. We're actively working on Windows ARM64 support, this should be coming soon! Stay tuned :)

Hello, I'm from the Flutter desktop team. We're actively working on adding platform views to desktop, which will allow you to embed web views into your Flutter application. Stay tuned :)

Hello, I'm from the Flutter desktop team. Thank you for the excellent feedback, this is truly invaluable.

Here are some updates from our side:

1. Custom context menus - We just added this feature in Flutter 3.7, which was released two weeks ago. Please give this a try and let us know what you think!

2. Multi-window - This is a high priority for the Flutter team, we have several engineers working on this project currently. Here's a video that gives an early preview on multi-window support: https://www.youtube.com/watch?v=vtB-teu57vw

Feel free to let us know if you have additional feedback; this helps us prioritize on what's most valuable for our community!

The Laravel framework makes money by its hosting business, Forge.

Related, how to print "Hello world" without libc: https://www.youtube.com/watch?v=b9OJYMFpHRU&ab_channel=Rubbe...

Supply chain attacks are not uncommon. Package signing can protect against those:

1. Package source hacking. Say an attacker gets access to a package source's storage and inserts malware into popular packages. Now your project contains malware. Your package manager can detect tampering if the packages are signed.

2. Dependency confusion attacks. Say my project downloads packages from the public source as well as my company's private source. An attacker realizes my company has a private package named `private-foo` and uploads a malicious package with the same name to the public source. Now my projects contains malware as it occasionally downloads the malicious package instead of my company's private package. Your package manager can detect packages from an unexpected author if they are signed.

I can provide more examples if you'd like. None of these are hypothetical, all of them have happened already.