3 ms·
Haskell is largely pure. There's nothing in place to stop a dependency from putting unsafePerformIO on blast. If a dependency can only do pure functional comput
by bhickey 4y ago
Haskell is largely pure. There's nothing in place to stop a dependency from putting unsafePerformIO on blast. If a dependency can only do pure functional computation then the worst things it can do are like (1+1=4) or diverge.
From your description it sounds like Deno is using object capabilities -- that's a great step forward.
> Many years ago npm inc treated download and package counts as KPI.
That's bonkers. I had no idea.
- Hizonner 4y ago> There's nothing in place to stop a dependency from putting unsafePerformIO on blast. import safe MyDependency ... but do you have to make sure that nothing in the tree is claiming to be Trustworthy. Which is actually pretty easy.
- ryukafalz 4y agoI believe GP misspoke; to my knowledge Deno does not allow you to set permissions on dependencies. It's not using object capabilities as far as I'm aware. I wish it were! https://github.com/denoland/deno/issues/171 https://github.com/denoland/deno/issues/171