Live data from Hacker News

Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

yesodweb.com

51–60 of 113 posts

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#51
post #9

Earlier quoted context omitted.

Yes, the default session storage is in encrypted cookies because it is convenient and good enough for many use cases. The session code is extensible though and someone has already written a Redis backend.

I'm asking because encrypting cookies seems like a pointless exercise, and seemed that way when it was first announced, as well. If you don't encrypt your entire connection, encrypting your cookie seems pointless, no?

Encrypting and authenticating cookies allows the web app server (or server farm) to store some session state in the browser rather than hit the database for every little thing. This can have a huge positive effect on scalability.

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#52
post #28

Earlier quoted context omitted.

> Yesod puts the most effort into marketing How is this the case? Compare http://yesodweb.com and http://snapframework.com/ and tell me you really believe that the yesod guys are marketers? > persistent isn't mature enough to use with an RDBMS backend. How so? Also, Persistent is still at 0.9, so the version number would agree. Any persistence layer you use with Snap or Happstack is just as easy to use in Yesod too.…

>you really believe that the yesod guys are marketers? I didn't say yesod had the best website, I said they put the most effort into marketing. Michael and Greg do a lot of talking about yesod, and are the only haskell framework attempting to draw in people from outside of haskell. You seem to have interpreted this as an insult, it was not. Usage increases with awareness. >How so? Unless you are using your RDBMS like…

I am Jeremy.. and I am not sure I would tell you the same thing. The Happstack webserver is pretty darn good. Of course, I think we can do even better. In fact, I think we can do better than warp.

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#53
post #42

Earlier quoted context omitted.

>you really believe that the yesod guys are marketers? I didn't say yesod had the best website, I said they put the most effort into marketing. Michael and Greg do a lot of talking about yesod, and are the only haskell framework attempting to draw in people from outside of haskell. You seem to have interpreted this as an insult, it was not. Usage increases with awareness. >How so? Unless you are using your RDBMS like…

>> you really believe that the yesod guys are marketers? > I didn't say yesod had the best website, I said they put the most effort into marketing. Michael and Greg do a lot of talking about yesod, and are the only haskell framework attempting to draw in people from outside of haskell. You seem to have interpreted this as an insult, it was not. Usage increases with awareness. There was a heavy implication that they m…

>There was a heavy implication that they market at the expense of engineer.

I am impressed at your ability to read that which I did not write. There was no such implication, it is a criticism of happstack and snap. More talking = more users = more feedback = better framework. It is especially unfortunate that snap originally seemed to be making serious efforts at marketing, and then just sort of stopped.

>Fair enough. We try to stick to the "dumb storage system" model because it gives us a lot of flexibility and makes scaling easier

We avoid the dumb storage model because it eliminates flexibility, and forces us to re-implement database functionality in our app code. We're talking about starting from scratch, I just don't want to start by throwing away all the power of our database for nothing. Our biggest apps are only in the 10s of millions of rows range, so scaling isn't a problem. If it were, I'd be looking into actual dumb storage systems though (mongo, cassandra, etc) instead of using an RDBMS as a slower version of one.

>But remember, Persistent != Yesod. You'll notice yesod-core doesn't depend on persistent at all.

Yes, but as I said that is the big feature that yesod appears to provide vs happstack and snap. But upon closer inspection we had to go down to hdbc regardless of the framework.

>[[citation needed]] I think the principle difference is that Yesod plays to Haskell's strengths in being "radically typesafe"

Citation for what? That if you don't use persistent then yesod and happstack and snap are similar in functionality? I am not sure how to prove that, how about the other way? What other functionality does yesod offer that I am forgetting?

Yesod avoids haskell in attempting to be "radically typesafe". You get the exact same amount of type safety by using blaze-html and web-routes in happstack or snap as you do using yesod. As I mentioned before, yesod's template haskell, quasi-quotation fetish is rather controversial in haskell land. You can get the benefits yesod offers while retaining composability and the familiarity of using haskell instead learning a DSL. The amount of errors we see in compiled haskell code is minimal, it should not be shocking that this extends to yesod.

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#54

Earlier quoted context omitted.

You might also be a little biased being a yesod developer and all. For what it is worth, I found both the happstack and snap communities far more helpful. Yesod makes a ton of assumptions, and questioning those assumptions was met with "just start liking what I like".

I am certainly biased, but these are all objective measurements. I am not claiming that the Yesod community is better, just that it is more active. I am sorry you didn't have a good experience. If you can point to specifics of inflexibility that can help us re-think our design.

How did you measure the number of yesod, snap and happstack users? "Objective measurement" means something. Keep in mind, "there's more traffic on mailing list X" doesn't mean there's more users of software X, it means there's more users asking questions about it. Given that yesod is much larger, it doesn't seem terribly unreasonable for there to be more questions about using it.

I think you've been displaying the inflexibility I refer to right here. "Everyone loves hamlet because I said so, if you don't love it you don't exist because I said everyone loves it". I understand you like the tools and methods you use, but your reaction to other people preferring other things appears hostile and/or dismissive. Accepting that people can like a different template engine without being objectively wrong might lead to yesod users having a plurality of template engines to choose from.

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#55

Earlier quoted context omitted.

I am not re-enforcing your statement at all. I think it is absurd to suggest that people will just suddenly start liking hamlet if they put up with it long enough. I used PHP for over a decade, I still think it is an awful template engine. Hamlet has the same problems as PHP, and added a new one. And the main part of your post I was objecting to was "everyone loves it and nobody has ever wanted to use anything else".…

Its not absurd, that has been our experience the majority of the time. Your comment about Yesod having nothing unique shows you never really used Yesod or are very intentionally trolling. For example, Snap does not have type-safe urls and Happstack has a very different approach to its related routing. I could come up with a lot of other examples.

>Its not absurd, that has been our experience the majority of the time.

It is absurd, and saying "I only look at people who like hamlet, and all I see is people who like hamlet" doesn't make it any less absurd.

>Your comment about Yesod having nothing unique shows you never really used Yesod or are very intentionally trolling

Again, stop with the accusations and consider the very real possibility that not everyone shares your preferences.

>For example, Snap does not have type-safe urls and Happstack has a very different approach to its related routing

Except that I can use web-routes with either, and end up with the same thing. How exactly does "yesod does a trivial thing like routing slightly differently from the default way snap/happstack do it" become some compelling unique feature? How easy is it to not use yesod's routes?

I would actually appreciate if you could list some other examples. We use postgresql, so nothing persistent related was of interest to us. If we don't like the templates, that leaves form handling and some trivial stuff like sessions, routing, etc. Sessions are effectively the same across all three, routing is more flexible in snap/happstack than yesod, and yesod's form handling appears to be "like digestive-functors but dependant on persistent". If you think yesod is a good choice for someone who won't be using persistent or hamlet, then I am genuinely interested in hearing the reasoning.

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#56
post #52

Earlier quoted context omitted.

>you really believe that the yesod guys are marketers? I didn't say yesod had the best website, I said they put the most effort into marketing. Michael and Greg do a lot of talking about yesod, and are the only haskell framework attempting to draw in people from outside of haskell. You seem to have interpreted this as an insult, it was not. Usage increases with awareness. >How so? Unless you are using your RDBMS like…

I am Jeremy.. and I am not sure I would tell you the same thing. The Happstack webserver is pretty darn good. Of course, I think we can do even better. In fact, I think we can do better than warp.

Hmm, I'm sorry to have (mis)spoken for you. I assumed you would tell him that since you appear to have been pretty open about it on the mailing list and in IRC. So you think happstack-server is better than snap-server? Or just that I am over-stating the difference?

I know there was talk of switching happstack over to warp, and then more recently of writing another server instead. What is it you are planning to do better than warp, performance, correctness, features or something I'm not thinking of? Is there anything in particular that made you decide not to use warp?

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#57

Earlier quoted context omitted.

I'm asking because encrypting cookies seems like a pointless exercise, and seemed that way when it was first announced, as well. If you don't encrypt your entire connection, encrypting your cookie seems pointless, no?

The clientsession package (which is what we use) both encrypts and applies a hash to the payload. Hashing prevents users from tampering with the data, and encrypting prevents inspection of the data. This means that you can even store sensitive data in a cookie without worrying if it's being compromised. (Not to say I recommend that practice, but it is possible.) There is of course some performance overhead to encrypt…

The content of the cookie isn't compromised, but you can trivially sidejack a cookie on an unencrypted connection and access the information through the website itself, in essence stripping any security. Arguably encrypting the cookie is a waste of processor time, but more importantly I think you may be giving people a false sense of security. The proper way to do secure interactions is via SSL, and I'm not sure encrypted cookies vs simply HMACed cookies gives you any true security advantage (as session storage or anything else).

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#58

Earlier quoted context omitted.

I'm asking because encrypting cookies seems like a pointless exercise, and seemed that way when it was first announced, as well. If you don't encrypt your entire connection, encrypting your cookie seems pointless, no?

Encrypting and authenticating cookies allows the web app server (or server farm) to store some session state in the browser rather than hit the database for every little thing. This can have a huge positive effect on scalability.

I'm aware of the benefits of using cookies for session state, just not sure encryption itself offers serious benefits without encrypting the entire browser session via SSL. And it may offer disadvantages from an understanding standpoint, where people think the encrypted cookie provides more security than it actually does.

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#59

A question I'd love to see a good answer to. We've got Yesod, we've got Happstack, and also Snap. What are the major differences between them? Is one of them a clear winner, the way Django/Rails are in Python/Ruby respectively?

It isn't yet much of a comparison, but http://www.haskell.org/haskellwiki/Web/Comparison_of_Happsta... has a some info; probably the only thing unique to that page is a list of some sites using each.

I'm using Yesod now simply because it seemed to have the most active community and I don't mind a lot of choices being made for me, since I'm also learning Haskell at the same time. Maybe I'll feel differently later.

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#60
post #52

Earlier quoted context omitted.

I am Jeremy.. and I am not sure I would tell you the same thing. The Happstack webserver is pretty darn good. Of course, I think we can do even better. In fact, I think we can do better than warp.

Hmm, I'm sorry to have (mis)spoken for you. I assumed you would tell him that since you appear to have been pretty open about it on the mailing list and in IRC. So you think happstack-server is better than snap-server? Or just that I am over-stating the difference? I know there was talk of switching happstack over to warp, and then more recently of writing another server instead. What is it you are planning to do bet…

I think that as far as the end user is concerned, there is not much difference between the warp, Snap, and Happstack backends.

Speed-wise, warp is maybe 3 times faster than Snap and Happstack in the pong test. Though, how that plays out in real world is hard to say. But, I doubt anyone is running a Haskell web server right now that needs anywhere close to 30,000+ requests/second. Of course, speed never hurts. Even if you are not doing a lot of requests per second, the totally latency per request counts for something. So, I see no reason for Happstack to be slower than it could be.

Because Happstack is based on lazy IO instead of conduits/enumerators/pipes, there is a perception that it must be leak files and RAM like crazy. But, that is not actually true. The server handles streaming files from disk fine, and even streaming files in POST/PUT to disk in a constant space. We had to be careful inside the server code to make that happen -- but the end user never has to deal with that for the most part.

One exception is when the user wants to use IO to generate a streaming response. For example, if you were wrote an algorithmic music generator that required IO and streaming an never ending MP3. To do that in happstack-server, you could need to use unsafeInterleaveIO. And, be a bit careful.

But, just because lazy IO can work, doesn't mean that something like Pipes would not be better. Happstack predates enumerators/pipes/conduits, so lazy IO was the best choice at the time :) The idea of moving Happstack away from lazy IO has been an the plate for a long time (before Snap and Yesod were even created). Originally we were going to move to the hyena backend. But then Johan went on a major yak shaving expedition and rewrote the GHC I/O manager, etc, instead of finishing hyena.

We did consider switching to warp. But there are a few reasons we decided not to:

1. The source code for warp did not fill me with confidence (yes.. entirely subjective). So, in the new (currently unnamed) happstack-server backend (which will be standalone similar to warp), I want to create a strong body of evidence that it actually works correctly.

2. I like pipes. At least, I like the way they are designed by starting with the core principles and semantics and trying to build something up that is based around solid math foundation like Category. Now, Michael Snoyman may be correct that pipes are not suitable for implementing an http proxy. Once the next pipes (that has resource finalization and exception handling) is out, I intend to discover if that is true or not (acme-http-proxy). (Once again, very subjective).

3. I want Happstack to be a stable platform. Historically, yesod has gone through a lot of radical changes. Something is there one day, and gone the next. My previous experiences trying to collaborate directly and indirectly with the yesod team have left me nervous about building on their work. The yesod project is focused on what is best for their own purposes -- which is fine. But, it means that if you are trying to build on it, you have to be ready to accept whatever may drop out of the sky tomorrow morning. (Also subjective).

4. the yesod dependency hell problem gives me concern as well. While the problems they are experiencing are fundamental to Cabal itself, they seem to be hit a lot harder than Happstack. So, until that is all sorted out, I don't want to make Happstack installs more likely to fail.

Given that warp is less than 1000 lines, it seems like the risks and loss of control involved with trying to leverage it do not really outweigh the cost of implementing a solution that is exactly what we want.

So, I am aiming for better design, performance, and correctness.

In terms of features.. I'm saving that surprise for later :)

Post reply on HN