Haskell HTTP(S) libraries don't work well

[atravers]

@hasufell

[about Rust]

1. they don’t use a GCed language with laziness
2. they have an audited TLS implementation
3. they have CVEs and security baked into their ecosystem and policies: Security policy - Rust Programming Language

• 1(a): Haskell isn’t alone - other (and well-known) GC-based languages have similar difficulties e.g:

  Present but unreachable: reducing persistent latent secrets in HotSpot JVM (2017)

• 1(b):

  AntC2:

  I like laziness. I spent decades programming in procedural languages, where I had to continually think about order of evaluation. It sucks.

  …and all these people liked laziness:

  ---

  
  
  (source)

  ---

  Laziness just presents an extra challenge, and apparently most Haskellers like those e.g. https://serokell.io/blog/ghc-dependent-types-in-haskell .

• 2: And we now have the Haskell Foundation - maybe they can help out with that one…

• 3: …in much the same way they’re helping out with this one.

Haskell isn’t alone in being an older language in need of securing, but things could have been so much worse:

C++ was not designed from the ground up to offer memory safety.

Josh Aas

---

@sclv

the robustness of an http experience even when linking against libcurl is not nearly as nice as shelling out to curl – the executable does a very good job of dealing with all that stuff (as well as auth schemes, etc) in the way closest to what “normal users expect”.

…and which rustup also uses:

curl --proto '=https' --tlsv1.2 -sSf [rustup-script URL] | sh

But as we also know, those “normal users” normally use ('doze) OSs sold by another “well-known” company. Fortunately, those users are also catered for:

Other Installation Methods - Rust Forge

…no mention of curl, wget or shells there - just “download and run” the appropriate installer:

@Liamzy

I guess it’s something the Haskell community doesn’t have the resources to do at this point in time.