3 ms·

Rust : Cargo :: Haskell : Hackage . It's extremely easy to add dependencies and that problem is independent of purity. As an example of an "impure language" w

Rust : Cargo :: Haskell : Hackage . It's extremely easy to add dependencies and that problem is independent of purity. As an example of an "impure language" with security in the form you envision, Deno allows you to specify access controls on a per-script or per-dependency basis. You can specify imports that prevent dependencies from opening sockets or writing files or reading files. Many years ago npm inc treated download and package counts as KPI. They pushed back against sensible measures like code signing, instead centralizing the ecosystem and encouraging cross-dependencies within their registry. A more security-oriented package manager would have focused on code signing and vendoring strategies.

bhickey 4y ago
Haskell is largely pure. There's nothing in place to stop a dependency from putting unsafePerformIO on blast. If a dependency can only do pure functional computation then the worst things it can do are like (1+1=4) or diverge. From your description it sounds like Deno is using object capabilities -- that's a great step forward. > Many years ago npm inc treated download and package counts as KPI. That's bonkers. I had no idea.
- Hizonner 4y ago
  > There's nothing in place to stop a dependency from putting unsafePerformIO on blast. import safe MyDependency ... but do you have to make sure that nothing in the tree is claiming to be Trustworthy. Which is actually pretty easy.
- ryukafalz 4y ago
  I believe GP misspoke; to my knowledge Deno does not allow you to set permissions on dependencies. It's not using object capabilities as far as I'm aware. I wish it were! https://github.com/denoland/deno/issues/171 https://github.com/denoland/deno/issues/171