News for hackers. Stuff that matters.

A comment on I Am Not a Supplier. Parent comment

Re:I Am Not a Supplier by bhickey on Saturday December 31, 2022 @06:49PM (#34201982)
Haskell is largely pure. There's nothing in place to stop a dependency from putting unsafePerformIO on blast. If a dependency can only do pure functional computation then the worst things it can do are like (1+1=4) or diverge.

From your description it sounds like Deno is using object capabilities -- that's a great step forward.

> Many years ago npm inc treated download and package counts as KPI.

That's bonkers. I had no idea.

[ Parent | on HN ]
Re:I Am Not a Supplier by ryukafalz on Saturday December 31, 2022 @07:19PM (#34202184)
I believe GP misspoke; to my knowledge Deno does not allow you to set permissions on dependencies. It's not using object capabilities as far as I'm aware. I wish it were!

https://github.com/denoland/deno/issues/171

[ Parent | on HN ]
Re:I Am Not a Supplier by Hizonner on Saturday December 31, 2022 @07:03PM (#34202083)
> There's nothing in place to stop a dependency from putting unsafePerformIO on blast.

     import safe MyDependency
... but do you have to make sure that nothing in the tree is claiming to be Trustworthy. Which is actually pretty easy.
[ Parent | on HN ]