[Haskell-cafe] Improvements to package hosting and security

[Nikita Karetnikov]

> I'm reminded of SPJs usual request for a wiki page *with details*
> discussing pros/cons of all the proposals for new GHC features. Might it
> be time to start such a page? (Of course this is not meant to imply any
> particular *rush* per se, but this is obviously becoming a growing
> concern in the community.)

I think it must be the first step.  Otherwise, it's hard to evaluate the
proposals.  It would be great if both designs could be compared side by
side.  I'd suggest to create a file in the commercial haskell repo (so
that authors of both designs (and others) could freely edit it) with a
list of things that people care about, which should be as specific as
possible.  For example:

                | FPComplete           | Well-Typed           |
---------------------------------------------------------------
Design document | https://...          | https://...          |

Does this design protect from these attacks?

               | FPComplete           | Well-Typed           |
--------------------------------------------------------------
Attack1        | yes                  | no                   |
Attack1Comment | because of so and so | because of so and so |
Attack2        | no                   | yes                  |
Attack2Comment | because of so and so | because of so and so |
Attack3        | no                   | no                   |
Attack3Comment | because of so and so | because of so and so |
...

Features:

  |                               | FPComplete | Well-Typed |
--|----------------------------------------------------------
1 |Allows for third-party mirrors | yes        | yes        |
2 |Comment regarding 1            | ...        | ...        |

Estimated effort:

  |                                      | FPComplete | Well-Typed |
--|-----------------------------------------------------------------
1 | Tools required                       | git, ...   | ...        |
2 | Tools that need to be changed        | ...        | ...        |
3 | Time required for 2 (hours)          | ...        | ...        |
4 | Size of changes required for 2 (LOC) | ...        | ...        |

Possibly with comments, too.