Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

yesodweb.com

Post reply on HN
Print view View original

71–80 of 113 posts

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#71

Post by cies »

santadays wrote: post #68
shadowfiend wrote: post #64

Earlier quoted context omitted.

Yes, that's precisely what I'm saying. So, let me put it differently: what security advantage does an encrypted session cookie confer? I see two possibilities: - Someone who hijacks a request with the cookie in it cannot see the data in the cookie. But they can access the site as the user, so there is no real world benefit to this fact. - Someone on the same computer cannot see the data in the cookie. But again, they…

I might be wrong here but I think it prevents against a user tampering their own cookie. Say I store User_Id:5 in a cookie and pass it over an ssl connection. The user can still change from User_Id:5 to User_Id:6 and get user 6's account info. Typically you would have to store a non guessable token instead to avoid this. I think by encrypting the cookie you provide the non-guessable part of the equation without havin…

the hashing prevents tinkering/tampering

the encryption prevents reading (and thereby also -- to some extend -- but not specifically tinkering/tampering)

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#72

Post by cies »

gregwebs wrote: post #69
papsosouid wrote: post #55

Earlier quoted context omitted.

>Its not absurd, that has been our experience the majority of the time. It is absurd, and saying "I only look at people who like hamlet, and all I see is people who like hamlet" doesn't make it any less absurd. >Your comment about Yesod having nothing unique shows you never really used Yesod or are very intentionally trolling Again, stop with the accusations and consider the very real possibility that not everyone sh…

You say you can use type-safe urls, but you aren't actually doing it. And the reason why is it isn't supported end-to-end by your framework. You can't stick one in a Heist template, and your routing code would become more tedious because routing is not completely trivial. But Again, this is just one example. In your case I doubt any benefits you would receive from switching to Yesod would overcome your switching cost…

geek-slapping the troll :) +1

[EDIT]: should not have posted this.

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#73

Post by papsosouid »

gregwebs wrote: post #69
papsosouid wrote: post #55

Earlier quoted context omitted.

>Its not absurd, that has been our experience the majority of the time. It is absurd, and saying "I only look at people who like hamlet, and all I see is people who like hamlet" doesn't make it any less absurd. >Your comment about Yesod having nothing unique shows you never really used Yesod or are very intentionally trolling Again, stop with the accusations and consider the very real possibility that not everyone sh…

You say you can use type-safe urls, but you aren't actually doing it. And the reason why is it isn't supported end-to-end by your framework. You can't stick one in a Heist template, and your routing code would become more tedious because routing is not completely trivial. But Again, this is just one example. In your case I doubt any benefits you would receive from switching to Yesod would overcome your switching cost…

>You say you can use type-safe urls, but you aren't actually doing it

I'm not because I don't want them. If I did I would be using blaze-html and web-routes.

>But Again, this is just one example.

I politely and genuinely asked that you provide those other examples, as the one you did provide is obviously bogus.

>But you chose to give us zero feedback until we make a 1.0 release announcement

Actually, I did ask in IRC about a year ago. And two days after I asked you offered up the same response you have been giving here: "hamlet is perfect and you are wrong for not liking it". I also got similarly slow and unhelpful responses with other issues, like how yesod used to only work on ipv6.

>and then come out of the wood-work and pic at every nit you can find in the comments of the release announcement and state some other framework is better

If you were a little less defensive and a little more reasonable, you might see that I never said anything of the sort.

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#74

Post by cies »

dons wrote: post #20
miguelos wrote: post #4

They really have to change their website, but in particular that cheesy/glossy logo. It just looks awful.

See also: * http://happstack.com/ * http://snapframework.com/ Design time!

volunteering time! :)

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#75

Post by cies »

papsosouid wrote: post #54
gregwebs wrote: post #27

Earlier quoted context omitted.

I am certainly biased, but these are all objective measurements. I am not claiming that the Yesod community is better, just that it is more active. I am sorry you didn't have a good experience. If you can point to specifics of inflexibility that can help us re-think our design.

How did you measure the number of yesod, snap and happstack users? "Objective measurement" means something. Keep in mind, "there's more traffic on mailing list X" doesn't mean there's more users of software X, it means there's more users asking questions about it. Given that yesod is much larger, it doesn't seem terribly unreasonable for there to be more questions about using it. I think you've been displaying the in…

at this point measuring users or user bases is impossible.

i argue it is also useless.

compared to Servlets+JSP/Rails/Django all of Haskell's web frameworks are smaller-then-tiny.

but: functional programming is on the rise, haskell has become fast and robust, haskell's static typing is seen as an advantage... people want to use haskell for web programming; so haskell web frameworks are seeing growth.

to me Yesod seems to have the edge currently: it is most actively developed and discussed.

i used snap, and liked it, but having tried both i feel yesod makes more sense (maybe because i'm coming from rails).

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#77

Post by cies »

papsosouid wrote: post #30
maxcan wrote: post #26

Earlier quoted context omitted.

What were the problems you saw in Hamlet?

Personally, I can't stand the "lets mix code and markup" style of template systems in general, which includes most templates. I also hated the indentation system, it just doesn't work well in markup heavy templating. I'm fine with indentation in programming (obviously given that we're talking about haskell), but it drove me nuts in templates as I had to indent far too much, it isn't simple blocks of code being indent…

> Personally, I can't stand [...] I also hated [...] it drove me nuts [...] I found it was just as ugly [...]

https://www.google.nl/search?&q=haters-gonna-hate&tb...

As explained before in this thread "shakespear-text" is the plain-ERB of Yesod.

To unmix code and markup i'd advise simply use you discipline; it's far to handy to use it sparingly but avoid it otherwise. (But that's my opinion)

I think your contribution of a tag-based template language (like Snap's Heist, or JSP) integration with Yesod will be well received by the Yesod community.

http://hackage.haskell.org/package/shakespeare-text-1.0.0.1

http://www.yesodweb.com/book/shakespearean-templates

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#78

Post by papsosouid »

cies wrote: post #77
papsosouid wrote: post #30

Earlier quoted context omitted.

Personally, I can't stand the "lets mix code and markup" style of template systems in general, which includes most templates. I also hated the indentation system, it just doesn't work well in markup heavy templating. I'm fine with indentation in programming (obviously given that we're talking about haskell), but it drove me nuts in templates as I had to indent far too much, it isn't simple blocks of code being indent…

> Personally, I can't stand [...] I also hated [...] it drove me nuts [...] I found it was just as ugly [...] https://www.google.nl/search?&q=haters-gonna-hate&tb... As explained before in this thread "shakespear-text" is the plain-ERB of Yesod. To unmix code and markup i'd advise simply use you discipline; it's far to handy to use it sparingly but avoid it otherwise. (But that's my opinion) I think your contribution…

http://ycombinator.com/newswelcome.html

This isn't reddit, please spare us the memes and +1s. I think the odds of such a contribution being well received are quite low given the hostility to that notion the developers of yesod still display. Given that I can't see any benefit to using yesod, it seems like a waste of time for me to contribute an unwanted template engine to it.

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#79

Post by shadowfiend »

cies wrote: post #70
shadowfiend wrote: post #64

Earlier quoted context omitted.

Yes, that's precisely what I'm saying. So, let me put it differently: what security advantage does an encrypted session cookie confer? I see two possibilities: - Someone who hijacks a request with the cookie in it cannot see the data in the cookie. But they can access the site as the user, so there is no real world benefit to this fact. - Someone on the same computer cannot see the data in the cookie. But again, they…

i can think of only one case: that in which the site owners dont want the user (or sidejacker in case of a non-SSL connection) to see some data they wish to put in the cookie. i'd cannot think of a web app i worked on where this was needed. (the hashing is cool though -- tinker prevention is common to be a-good-thing)

Notably, this would only happen if you have data in the user's session that the user themselves cannot get to by using the site. I confess I can't think of any such session data, but I suppose it could exist.

And yes, some sort of HMAC is pretty much mandatory if you're going to do client-side session storage securely, no question.

Re: Yesod 1.0 - a robust, friendly, high performance web framework for Haskell

#80

Post by cies »

microtonal wrote: post #3
yummyfajitas wrote: post #2

A question I'd love to see a good answer to. We've got Yesod, we've got Happstack, and also Snap. What are the major differences between them? Is one of them a clear winner, the way Django/Rails are in Python/Ruby respectively?

FWIW, since I only really have experience with Snap: When comparing to Ruby frameworks, you could roughly say that Snap is to Yesod what Sinatra is to Rails. Snap is relatively simple and as such easy to fully understand. But since it is a relatively simple framework, you have to mix and match other packages to get the functionality that you want. Yesod on the other hand is very elaborate - it contains a lot of funct…

> FWIW, since I only really have experience with Snap: When comparing to Ruby frameworks, you could roughly say that Snap is to Yesod what Sinatra is to Rails.

I've used both and this is pretty from my experience.

If I can make comparisons I think:

* Yesod is like Rails w/ haml+sass (but type-safety throughout)

* Snap is like Servlets+JSP (especially wrt templating, besides that it is quite similar to Yesod)

* Happstack is like Zope w/o the frontend (mainly because it is the oldest (has a pre-Rails feel to it) and has its own in-haskell ACID db (Zope has ZoDB))

> Snap is relatively simple and as such easy to fully understand. But since it is a relatively simple framework, you have to mix and match other packages to get the functionality that you want.

I found it as hard a Yesod to get it up and running. Both suffer from old docs/tutorials/examples, both needed me to climb the daunting haskell learning curve.

> Yesod on the other hand is very elaborate - it contains a lot of functionality and relies fairly heavily on the use of Template Haskell and Quasi-Quoting.

How is that a problem? I say: "Template Haskell and Quasi-Quoting FTW!" DSLs or little interpreters are great in reducing code-size. Reducing code size is great, arguably nr.1, in reducing bugs.

> As with Ruby and Sinatra, it is mostly a matter of taste.

I suspect you mean "Rails and Sinatra".

It is not a matter of taste: Rails and Sinatra both build on the Rack interface and have several options for http servers (mongrel/webrick/thin/etc).

With Yesod and Snap you find they both have their own "Rack". Yesod has "WAI" and an http server "Warp" -- these blow every other option out of the water in terms of speed and seem to have a more clever design.

But it could be just my opinion. (I did remember reading somewhere that the Snap devs envy Yesod's speed and try to make their solution faster which is a good thing)

> Some people prefer lightweight frameworks and add the components they need, while others like to do things within one well-integrated framework.

This is mostly a matter of how you build your app: "from scratch" or "scaffolded". Both Yesod and Snap allow both ways. Scaffolding with Yesod brings you much further along the axis of "well-integratedness" then scaffolding with Snap which is obviously a win those preferring the scaffolding approach.

Post reply on HN