[Haskell] Re: ECT and SearchPath

[S. Alexander Jacobson]

On Tue, 13 Dec 2005, Sven Moritz Hallberg wrote:
> is a good scheme. For it to _really_ work, however, we should form a
> registry of "officially assigned" module names (i.e. ones without a
> disambiguation suffix) and also one for the author and/or organization
> names to be used as suffixes. I for example am known by the nickname
> Pesco, or (more recently) by the mnemonic SM at domain KHJK.ORG.

My solution to this problem in SearchPath is module maps.  SearchPath 
lets you use multiple module maps simultaneously.  So you can for 
example simultaneously use a global module map as haskell.org, an 
industry module map at yourassociate.org, an internal company map 
located on your_intranet, and a personal map located on your computer. 
Conflicts are handled by the order in which you invoke the maps.
So a map is official to the extent your community shares it. 
Different entities can also compete to provide maps of differing 
qualities e.g. is the map audited for security issues?  does the map 
point to the repository head of all modules or a static version? etc.

Clay Shirky famously observed that in namespace construction there is 
a pretty direct tradeoff between have names be memorable, global, and 
non-political.  I think shared module maps represents a good 
compromise.

>> I just
>> read your ECT article which seems to start with the same assumption and
>> takes the theory to its logical conclusion.
>
> I take that as a compliment. ;) Thank you.

It was intended that way!  :-)

> The main issue that springs to my mind is authenticity control. How do I
> know the module I'm downloading is the one I want? Note that this
> question is always there, even in the local case, but it is usually not
> seen as a problem until module sources are distributed over the Net.

I think https URLs solve this problem.  You choose module maps from 
authors you trust and access those maps via https.  These "friendly" 
module maps then point to "friendly" modules that you can also access 
via https.  Since, you choose which CAs you trust to sign server keys, 
you are safe from MITM attacks.

Note, I thought about supporting pgp but there is no obvious way to 
sign a CVS/SVN/darcs repository and what I like about ECT is that you 
can point to such repositories rather than specific checked out 
versions in the comfort that things won't break.  I LOVE that in 
combination with ECT, you get notified that you are using a deprecated 
version on the next compile without having to check all your imports 
manually.

FYI, the main thing that I would really like, but don't have and can't 
implement, is for :r in ghci to invoke SearchPath to hunt for missing 
modules rather than forcing you to quit out and restart ghci every 
time you add an import of an undownloaded module in your code.  Using 
searcpath make thing very smooth, but this feature would make it 
completely so.

-Alex-


______________________________________________________________
S. Alexander Jacobson tel:917-770-6565 http://alexjacobson.com