4 ms·

Why is there no usable haskell SSL library? It would seem this is an area where the claims about haskell eliminating whole classes of bugs and so on would reall

by harry8 11y ago

Why is there no usable haskell SSL library? It would seem this is an area where the claims about haskell eliminating whole classes of bugs and so on would really be worthwhile and an amazing advert for haskell advocates. The claims about being able to formally prove the code implements the spec would be pretty damn compelling in that space too. Once upon a time I asked on HN if there are any useful and usable haskell programs you can just install and run for a purpose that isn't writing haskell code. Shellcheck & pandoc seemed to be the suggested examples. Is that still the case or are there now a few more?

rtpg 11y ago
There's xmonad, the tiling window manager. Apart from that I can't think of anything that is actively worked on and has any major traction.
hobo_mark 11y ago
Pandoc (document format converter) comes to mind.
- tome 11y ago
  It seems to have come to harry8's mind too.
  - hobo_mark 11y ago
    Sorry, clearly the caffeine hadn't kicked in yet.
tome 11y ago
Firstly, the entire classes of bugs that Haskell eliminates are not classes that are especially relevant to cryptography. Secondly, if you know where someone has claimed that Haskell lets you "formally prove the code implements the spec" then please point it out to me so I can challenge them for being misleading at best.
- harry8 11y ago
  Surprising that heartbleed got past you? Or does haskell not eliminate buffer overflows. I've heard many clam it does. SeL4. It comes up regularly that C, or java or python or some other well used language doesn't work well with isabelle, coq because of pointers, destructive assignment or whatever but haskell is pure and this is one of the many advantage of pure. I don't have this opinion myself nor have I formed the opinion that it's false.
ics 11y ago
git-annex cryptol (https://en.wikipedia.org/wiki/Cryptol https://en.wikipedia.org/wiki/Cryptol) seL4 (https://en.wikipedia.org/wiki/L4_microkernel_family#High_assurance:_seL4 https://en.wikipedia.org/wiki/L4_microkernel_family#High_ass...)
mightybyte 11y ago
> Why is there no usable haskell SSL library? Probably because of the broad agreement among crypto people that reinventing core crypto wheels is almost always a bad idea. On top of that, the intersection between the set of people who are qualified to write that crypto code and the set of people who know Haskell well enough to do a good job of it is probably the empty set.
codygman 11y ago
Have you seen this Haskell tls[0]? "This library provides native Haskell TLS and SSL protocol implementation for server and client." 0: http://hackage.haskell.org/package/tls http://hackage.haskell.org/package/tls EDIT: This Github issue provides some great discussion about the security of this library and links to some good discussion as well: https://github.com/vincenthz/hs-tls/issues/89 https://github.com/vincenthz/hs-tls/issues/89
- cies 11y ago
  Wanted to point out the same. Haskell (unlike many other languages) has an SSL/TLS implementation. A few days ago I found out that OCaml has one as well :)
  - harry8 11y ago
    Is it usable? OpenSSL is clearly pretty bad so it doesn't meet that benchmark? Or am I missing something?

by harry8 11y ago

rtpg 11y ago

There's xmonad, the tiling window manager. Apart from that I can't think of anything that is actively worked on and has any major traction.

hobo_mark 11y ago

Pandoc (document format converter) comes to mind.

tome 11y ago
It seems to have come to harry8's mind too.
- hobo_mark 11y ago
  Sorry, clearly the caffeine hadn't kicked in yet.

tome 11y ago

Firstly, the entire classes of bugs that Haskell eliminates are not classes that are especially relevant to cryptography. Secondly, if you know where someone has claimed that Haskell lets you "formally prove the code implements the spec" then please point it out to me so I can challenge them for being misleading at best.

harry8 11y ago
Surprising that heartbleed got past you? Or does haskell not eliminate buffer overflows. I've heard many clam it does. SeL4. It comes up regularly that C, or java or python or some other well used language doesn't work well with isabelle, coq because of pointers, destructive assignment or whatever but haskell is pure and this is one of the many advantage of pure. I don't have this opinion myself nor have I formed the opinion that it's false.

ics 11y ago

git-annex cryptol (https://en.wikipedia.org/wiki/Cryptol https://en.wikipedia.org/wiki/Cryptol) seL4 (https://en.wikipedia.org/wiki/L4_microkernel_family#High_assurance:_seL4 https://en.wikipedia.org/wiki/L4_microkernel_family#High_ass...)

mightybyte 11y ago

> Why is there no usable haskell SSL library? Probably because of the broad agreement among crypto people that reinventing core crypto wheels is almost always a bad idea. On top of that, the intersection between the set of people who are qualified to write that crypto code and the set of people who know Haskell well enough to do a good job of it is probably the empty set.

codygman 11y ago

Have you seen this Haskell tls[0]? "This library provides native Haskell TLS and SSL protocol implementation for server and client." 0: http://hackage.haskell.org/package/tls http://hackage.haskell.org/package/tls EDIT: This Github issue provides some great discussion about the security of this library and links to some good discussion as well: https://github.com/vincenthz/hs-tls/issues/89 https://github.com/vincenthz/hs-tls/issues/89

cies 11y ago
Wanted to point out the same. Haskell (unlike many other languages) has an SSL/TLS implementation. A few days ago I found out that OCaml has one as well :)
- harry8 11y ago
  Is it usable? OpenSSL is clearly pretty bad so it doesn't meet that benchmark? Or am I missing something?