4 ms·

Over 10 years old, but still the best modern Common Lisp book. It helps, that it has been written by someone who had a lot of experience with other languages (J

• lispm 10y ago
  There is one important thing not covered in the book: https://www.quicklisp.org/ https://www.quicklisp.org/ Quicklisp was first published in 2010 and is a library manager for Common Lisp.
  • kgwgk 10y ago
    You probably meant 2010.
    • lispm 10y ago
      corrected, thanks!
  • armitron 10y ago
    Quicklisp is not panacea, even though it simplifies matters to a substantial degree for people new to Common Lisp. On the other hand Quicklisp has serious issues: + Minimal if any documentation of internals. + A substantial chunk of the codebase can only be described as spaghetti code. To make matters even worse, most functions lack documentation strings. A sad state of affairs given the interactive and self-documenting nature of CL. + Is vulnerable to man-in-the-middle attacks since it verifies neither certificates nor checksums. This means that using Quicklisp can get you owned. Unacceptable these days. + Operates over a 'curated repository' model that Xach is managing. The repository has been found to be vulnerable to man-in-the-middle attacks in the past since packages were fetched over plain HTTP or git://. Even if that wasn't the case, it's yet another element in the chain of things to trust. + Few if any people besides Xach are working on quicklisp-client to mitigate these issues. Lack of documentation and spaghetti code is not helping to attract new talent. + Xach is employed by Clozure Associates. I understand that they've allotted him some time to work on Quicklisp while on the job, but it's still a side-project. Look at the number of open issues at Github. Many have been there for years. For these reasons, I don't use Quicklisp myself. I also advocate against it to friends and colleagues who share my views on software distribution mechanisms.
    • mrighele 10y ago
      While I agree with most of the issues you report, what are thea alternatives ? I think Quicklisp is the lesser evil.
      • armitron 10y ago
        Well for some of us the lesser evil is unacceptable. The rest will happily use Quicklisp. If I had to guess however, I would say that the vast majority of Quicklisp users are not aware of the tradeoffs they are making. It's troubling that none of the security implications I mentioned are listed or even hinted at, in the Quicklisp site https://www.quicklisp.org/beta/release-notes.html https://www.quicklisp.org/beta/release-notes.html or anywhere in the Quicklisp documentation. One alternative is to improve Quicklisp. I don't want to be seen as blaming Xach here, but he's solely responsible for the lack of documentation. For CL docstrings especially, their absence is unfathomable for a core project that is positioned for wide usage. Every function, method and dynamic variable should have a docstring. You don't add these after the fact, you add them when you're writing the code. If Xach improves the documentation situation, people will step in and start fixing issues.
        • mrighele 10y ago
          The HTTP issue I guess can be easily solved. In fact if I try to manually download the same package over HTTPS (I mean packages with url from beta.quicklisp.org) it works so maybe th e solution is very simple
          • armitron 10y ago
            The solution is far from simple if you want to do it in 100% Common Lisp as there's no CL HTTP client that can verify certificates. Maybe possible with drakma and cl+ssl and a custom configuration of the latter and a native OpenSSL library, and I still have doubts.
            • lispm 10y ago