isomorphism / hackage2 Goto Github PK
View Code? Open in Web Editor NEWCopy of the new Hackage server code
Home Page: http://code.haskell.org/hackage-server/
License: Other
Copy of the new Hackage server code
Home Page: http://code.haskell.org/hackage-server/
License: Other
Looking into http://hackage.haskell.org/package/pipes-4.0.0/docs/Pipes-Prelude.html
concat :: ([LINK1]Monad m, [LINK2]Foldable f) => [LINK3]Pipe (f a) a m r
Has following links:
LINK1=file:///packages/archive/base/4.6.0.1/doc/html/Control-Monad.html#t:Monad
LINK2=file:///packages/archive/base/4.6.0.1/doc/html/Data-Foldable.html#t:Foldable
LINK3=http://hackage.haskell.org/package/pipes-4.0.0/docs/Pipes-Core.html#t:Pipe
Why is that? Is it haddock problem or hackage-s?
Hi,
now that hackage2 is in use and officially on github, you might want to replace this repo by a fork of the official one, to avoid confusion.
Thanks,
Joachim
Right now, anyone can register an account (without passing any kind of CAPTCHA or anything, so bots will overrun the place quickly on a live site) and upload new packages to their heart's content. This is a major risk for several reasons (package installation can do evil stuff with custom build types, easy to use up tons of disk space, etc.)
Of course, nothing can truly solve the security issue, but I suggest the following:
This should be a simple change to the code. The workflow for a package uploader would be:
This is basically the same as the Hackage1 registration process, but a bit easier for the maintainer.
<dcoutts> bgamari, cmccann, elliott: so the auth system in the new design copes ok with package
uploaders, what it does not cover well is casual users who might want to post reviews, vote etc,
but not upload packages
<dcoutts> since you probably want self-registration for those users
<dcoutts> but for uploaders it's sensible to have a human in the loop
<bgamari> Certainly
<dcoutts> like we do in the current system
<dcoutts> so there's an admin user group who can edit other groups
<dcoutts> ie grant permissions
[...]
<dcoutts> elliott, cmccann: right, plus in the new system since there's a per-package uploader
group then unknown users cannot subvert well known names (ie packages)
<dcoutts> so in the new system malicious people can still upload *new* malicious packages
<dcoutts> but cannot subvert e.g. base
An ideal solution would be something like:
That would be nicer, but probably require a lot more coding than the simpler solution.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.