91–100 of 131 posts
Can anyone point to a "practical Haskell" tutorial/book/whatever for people that already know functional programming? I'm in this sour spot where most tutorials are boring to me so I just can't follow through. I know what a monad is. What a typeclass is. Even what HKTs are. I can make sense of "a monad is just a monoid in the category of endofunctors" if I give it a few minutes to unravel the ball of twine... But I w…
Can anyone point to a "practical Haskell" tutorial/book/whatever for people that already know functional programming? I'm in this sour spot where most tutorials are boring to me so I just can't follow through. I know what a monad is. What a typeclass is. Even what HKTs are. I can make sense of "a monad is just a monoid in the category of endofunctors" if I give it a few minutes to unravel the ball of twine... But I w…
Where does your functional programming experience come from? That could help in finding a suitable resource.
Earlier quoted context omitted.
We cannot even include it in stagex because there is still literally no way to compile it from source and thus no way to do a real reproducible build, and there is no one left that cares about the language enough to do this. Honestly it has to be regarded as a dead language until this is resolved.
Interesting logic: Declare something "dead" because it does not fulfill [extremely niche usecase that currently only few people care about] (boostrapped builds) and thus couldn't "even" be included in [project of the post author that takes a while to even find] (I eventually figured it must be referring to https://stagex.tools ). There are probably 100x more people interested in Haskell than in build-bootstrapping (t…
Being able to compile a compiler without binary blobs is a hard prerequisite to using that language for any application where security matters.
A language can have an active community and still be unsuitable for any real world use cases. Fortran is bootstrappable so I consider it more viable than haskell for real world use, even though it has far fewer fans (understandably).
Maybe it is more fair to call haskell an academic language or hobby language since it prioritized language design over basic supply chain security thus far.
If it becomes bootstrappable, then of course all the above critique is immediately retracted.
Earlier quoted context omitted.
For someone like me that is less versed in these things, could you explain why bootstrapping a language is a required check for taking a language seriously? My criteria is far less stringent (is it stable? is it popular enough? is the toolchain mature? etc..), so I wonder what I am missing here.
The Haskell compiler creates a slightly different output every time you compile a program[1]. This makes it difficult to ensure that the binary that is free-to-download downloaded is actually malware free. If it were easy to check, then you could rest easy, assuming that someone out there is doing the check for you (and it would be big news if malware was found). If you're a hardened security person, then the convers…
Haskell and Ada are the only languages not possible for us to support, or any software built with them.
Everything else is just fine though.
I do hope both languages address this though, as it is blocking a lot of important open source software like pandoc or coreboot from being used in security critical environments.
Earlier quoted context omitted.
For someone like me that is less versed in these things, could you explain why bootstrapping a language is a required check for taking a language seriously? My criteria is far less stringent (is it stable? is it popular enough? is the toolchain mature? etc..), so I wonder what I am missing here.
The Haskell compiler creates a slightly different output every time you compile a program[1]. This makes it difficult to ensure that the binary that is free-to-download downloaded is actually malware free. If it were easy to check, then you could rest easy, assuming that someone out there is doing the check for you (and it would be big news if malware was found). If you're a hardened security person, then the convers…
If it ever doesn't, do open a bug report[2]
[1] https://downloads.haskell.org/ghc/latest/docs/users_guide/us... [2] https://gitlab.haskell.org/ghc/ghc/-/issues
Earlier quoted context omitted.
The Haskell compiler creates a slightly different output every time you compile a program[1]. This makes it difficult to ensure that the binary that is free-to-download downloaded is actually malware free. If it were easy to check, then you could rest easy, assuming that someone out there is doing the check for you (and it would be big news if malware was found). If you're a hardened security person, then the convers…
From 9.12, -fobject-determinism[1] will guarantee deterministic objects. If it ever doesn't, do open a bug report[2] [1] https://downloads.haskell.org/ghc/latest/docs/users_guide/us... [2] https://gitlab.haskell.org/ghc/ghc/-/issues
Earlier quoted context omitted.
Quite literally all distros today build it by downloading an existing magic binary to compile the latest sources. Even if they claim the package is reproducible, all bets are off on trust if it downloads a prebuilt binary in the build process. It is a prime Trusting Trust attack target. The only other somewhat widely used language I am aware of in this bad of a position is Ada. Every other language I am aware of has…
Outside some fairly niche projects working on the problem, this is not a priority and most systems have straight binary dependencies.
Stagex has a 100% full source bootstrapping, and reproducibility requirement that at least two maintainers must prove and sign for every package.
Stagex is also very heavily used and relied on in high value financial and scientific applications where trusting a binary some internet rando compiled is not even remotely acceptable.
Haskell and Ada are locked out of any high security applications until they are bootstrappable.
Earlier quoted context omitted.
Yes, and that is a serious security problem because the only way to get trusted PCR values for TPM2 gated secure boot and full disk decryption applications, is with open source full source bootstrapped firmware. Coreboot is the only option, but it has a hard requirement on Ada because that is what they wrote their intel graphics stack in. It is a real mess.
Interesting, any link I could read to understand a bit more the situation?
Ada has had even less progress and I am not aware of any writeups.
TL;DR: Ada and Haskell need to have compilers implemented a language that has a full source bootstrap path such as C, Go, or Rust that implement just enough features to compile the official compilers.
Earlier quoted context omitted.
Ada can't bootstrap? Ironic...
Sounds like an opportunity to rebuild an ADA interpreter
If you know anyone that takes this on and succeeds I have a 2k cash bounty for them, and we can likely find others.
Can anyone point to a "practical Haskell" tutorial/book/whatever for people that already know functional programming? I'm in this sour spot where most tutorials are boring to me so I just can't follow through. I know what a monad is. What a typeclass is. Even what HKTs are. I can make sense of "a monad is just a monoid in the category of endofunctors" if I give it a few minutes to unravel the ball of twine... But I w…
But aside from resources, if you actually have something you want to build in Haskell, just go for it and struggle through --- that's the best way to learn that I've found