Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GHC now runs in the browser

discourse.haskell.org

Post reply on HN
Print view View original

41–50 of 131 posts

Re: GHC now runs in the browser

#41

Post by jdndndnns »

rowanG077 wrote: post #38
lrvick wrote: post #37

Unfortunately there is still no way to actually bootstrap haskell (or anything based on it) which makes it impossible to put anything written in Haskell near any high trust linux distribution or environment. I guess sandboxing the untrusted binary in a browser is -something- to let people play with haskell in a lower risk way for the moment at least but it is hard to take a language seriously or trust it with no way…

How is ghc compiled at all without bootstrapping? Or is there a magic binary in tree that is unreproducible? I have compiled ghc a few times and had no problems.

And where did you get the haskel compiler to do so?

You seem to be missing the point of bootstrapping

Re: GHC now runs in the browser

#42

Post by lrvick »

rowanG077 wrote: post #38
lrvick wrote: post #37

Unfortunately there is still no way to actually bootstrap haskell (or anything based on it) which makes it impossible to put anything written in Haskell near any high trust linux distribution or environment. I guess sandboxing the untrusted binary in a browser is -something- to let people play with haskell in a lower risk way for the moment at least but it is hard to take a language seriously or trust it with no way…

How is ghc compiled at all without bootstrapping? Or is there a magic binary in tree that is unreproducible? I have compiled ghc a few times and had no problems.

Quite literally all distros today build it by downloading an existing magic binary to compile the latest sources. Even if they claim the package is reproducible, all bets are off on trust if it downloads a prebuilt binary in the build process. It is a prime Trusting Trust attack target.

The only other somewhat widely used language I am aware of in this bad of a position is Ada. Every other language I am aware of has a clear bootstrap path.

Re: GHC now runs in the browser

#43

Post by rowanG077 »

jdndndnns wrote: post #41
rowanG077 wrote: post #38

Earlier quoted context omitted.

How is ghc compiled at all without bootstrapping? Or is there a magic binary in tree that is unreproducible? I have compiled ghc a few times and had no problems.

And where did you get the haskel compiler to do so? You seem to be missing the point of bootstrapping

Maybe that is literally why I asked the question, clearly I don't know as I have not spend the time investigating this problem that the commenter has. Asking some kind of gotcha question is not helpful.

Re: GHC now runs in the browser

#44

Post by icrbow »

lrvick wrote: post #42
rowanG077 wrote: post #38

Earlier quoted context omitted.

How is ghc compiled at all without bootstrapping? Or is there a magic binary in tree that is unreproducible? I have compiled ghc a few times and had no problems.

Quite literally all distros today build it by downloading an existing magic binary to compile the latest sources. Even if they claim the package is reproducible, all bets are off on trust if it downloads a prebuilt binary in the build process. It is a prime Trusting Trust attack target. The only other somewhat widely used language I am aware of in this bad of a position is Ada. Every other language I am aware of has…

Ada can't bootstrap? Ironic...

Re: GHC now runs in the browser

#45

Post by rowanG077 »

lrvick wrote: post #42
rowanG077 wrote: post #38

Earlier quoted context omitted.

How is ghc compiled at all without bootstrapping? Or is there a magic binary in tree that is unreproducible? I have compiled ghc a few times and had no problems.

Quite literally all distros today build it by downloading an existing magic binary to compile the latest sources. Even if they claim the package is reproducible, all bets are off on trust if it downloads a prebuilt binary in the build process. It is a prime Trusting Trust attack target. The only other somewhat widely used language I am aware of in this bad of a position is Ada. Every other language I am aware of has…

I see, yes I most likely used a distro build ghc.

Re: GHC now runs in the browser

#46

Post by pjmlp »

mananaysiempre wrote: post #32
pjmlp wrote: post #27

Is it just me or is it actually impossible to type anything?

Just you. Once the editor actually loads (turning the “Haskell source” pane on the left from the page background’s deep violet into a dark gray and displaying a “hello world” program), I can type perfectly fine. And I’m using a browser based on WebKitGTK, which is not exactly known for its stellar compatibility.

Thanks, I have given up waiting it appears to take minutes on a phone.

Re: GHC now runs in the browser

#48

Post by lrvick »

icrbow wrote: post #44
lrvick wrote: post #42

Earlier quoted context omitted.

Quite literally all distros today build it by downloading an existing magic binary to compile the latest sources. Even if they claim the package is reproducible, all bets are off on trust if it downloads a prebuilt binary in the build process. It is a prime Trusting Trust attack target. The only other somewhat widely used language I am aware of in this bad of a position is Ada. Every other language I am aware of has…

Ada can't bootstrap? Ironic...

Yes, and that is a serious security problem because the only way to get trusted PCR values for TPM2 gated secure boot and full disk decryption applications, is with open source full source bootstrapped firmware.

Coreboot is the only option, but it has a hard requirement on Ada because that is what they wrote their intel graphics stack in.

It is a real mess.

Re: GHC now runs in the browser

#49

Post by lrvick »

Ericson2314 wrote: post #40
lrvick wrote: post #37

Unfortunately there is still no way to actually bootstrap haskell (or anything based on it) which makes it impossible to put anything written in Haskell near any high trust linux distribution or environment. I guess sandboxing the untrusted binary in a browser is -something- to let people play with haskell in a lower risk way for the moment at least but it is hard to take a language seriously or trust it with no way…

https://discourse.haskell.org/t/what-s-needed-to-bootstrap-g... people have worked replaying the history to bootstrap.

Looks like a work in progress still, but exciting someone at least put some time into this in the past year.

Maybe some day I can have pandoc in security focused linux distributions...

Re: GHC now runs in the browser

#50

Post by utopiah »

Neat... but with QEMU-WASM I'm wondering what actually does not run in the browser (obviously that doesn't required specific input).

Not a criticism, love everything that can provide hassle-free onboarding to learn a new language, just curious.

Post reply on HN