Re: [commit: ghc] master: add note about compilation safety to safe haskell docs (b78b6b3)

On Fri, Nov 09, 2012 at 05:46:05PM -0800, David Terei wrote:
> On 9 November 2012 17:36, Ian Lynagh <[email protected]> wrote:
> > On Fri, Nov 09, 2012 at 04:34:20PM -0800, David Terei wrote:
> >>
> >> +  Safe Haskell, however, <emphasis>does not offer</emphasis> compilation
> >> +  safety.
> >
> > Is this a bug? A few lines lower down the docs say that "Compiling and
> > executing untrusted code" is one of the two use cases for Safe Haskell.
> 
> What matters is, does this problem make Safe Haskell unusable. I'd
> argue no,

FWIW, I'd say yes, as it doesn't allow the use cases I can think of (OK,
it does work for lambdabot/tryhaskell, but only because they only allow
toy expressions to be evaluated).

> We as a community seem to be somewhat OK with this
> though given Hackage allows anyone to upload a new package which
> contains code that can be executed by people at compile time.

But that's another good potential use-case for safe Haskell.

e.g. a future version of cabal-install might by default build packages
with -safe flag(s), perhaps with the exception of packages that are
marked as need-to-be-trusted and gpg signed by someone the user trusts.


Thanks
Ian