Comments on: Haskell Is Exceptionally Unsafe

By: Robert Harper

Robert Harper — Fri, 17 Aug 2012 11:22:28 +0000

Opinions vary on whether it is feasible to do so.

By: hydo

hydo — Fri, 17 Aug 2012 00:43:17 +0000

Regarding unsafePerformIO, I just pretend it doesn’t exist and thus never use it. If I find myself thinking about using it, I rethink the problem.

By: reuleaux

reuleaux — Thu, 16 Aug 2012 20:58:13 +0000

OK, thanks for this clarification, and of course for sharing the book.

By: Derek Dreyer

Derek Dreyer — Wed, 15 Aug 2012 22:49:09 +0000

I haven’t studied this topic at all, but Blume, Acar and Chae worked out something along the lines of what Neel is suggesting in quite some detail in their APLAS’08 paper: http://people.cs.uchicago.edu/~blume/papers/aplas08-exceptions.pdf

By: Daniel Spiewak (@djspiewak)

Daniel Spiewak (@djspiewak) — Wed, 15 Aug 2012 21:00:53 +0000

undefined is a valid value in the same way that `foo where foo = foo` is a valid value. Which is to say, only if you don’t evaluate it. Getting a value with bottom type and then ascribing a non-bottom type to it is going to be unsound by definition. You started with a contradiction, which you used to prove something. That’s not interesting, because “something” in this case could be anything whatsoever.

By: Robert Harper

Robert Harper — Wed, 15 Aug 2012 19:50:05 +0000

undefined is a perfectly good value in Haskell; it’s the point of the call-by-name semantics.

By: Robert Harper

Robert Harper — Wed, 15 Aug 2012 19:49:28 +0000

We were talking cross-purposes. I’m referring to a built-in symbol type, you’re referring to ezyang’s hacked up version in Haskell.

By: Ganesh Sittampalam

Ganesh Sittampalam — Wed, 15 Aug 2012 17:36:58 +0000

But ezyang’s code is also based on type casting, which is why it can be broken if the Sym constructor is exposed.

He mentions an alternative using an type equality witness, so perhaps it’s not essential, but the details of how that’d work aren’t obvious to me.

By: Daniel Spiewak (@djspiewak)

Daniel Spiewak (@djspiewak) — Wed, 15 Aug 2012 16:13:11 +0000

From a strictly theoretical standpoint, you would need to show the compiler exploding *without* using undefined in order to demonstrate unsoundness. It’s really not fair to take a feature that is already *known* to be unsound, compose it with some other features and then use the results to claim that one of those other features is also unsound. I’m not saying your point is invalid, but you haven’t really proven it.

By: Robert Harper

Robert Harper — Wed, 15 Aug 2012 14:41:55 +0000

That’s news to me. The published version will differ slightly from the online version, but the reduction in length is solely due to the formatting, not to restrictions on the content.