- Haskell-Cafe - Haskell.org

re-reading a Samson Abramsky paper ..
by Vasili I. Galchin 02 Aug '14

02 Aug '14

http://staff.science.uva.nl/~ssimon/indjournal/pdf/abramsky.pdf .. no words .. I will let Samson speak for himself .. :-) Hopefully my audience cam keep up with Abramsky's terseness .. he is very "cheeky" ...

1 0

Re: [Haskell-cafe] Tor project
by Adam Wick 02 Aug '14

02 Aug '14

Hi - Yes, we (Galois) are. The end goal is to have a Tor implementation running on a HaLVM. Right now the project is internal, but the plan is to push a basic relay node implementation out to our GitHub site sometime in the next few weeks. As for TLS, it is possible that timing attacks based on a functional language implementation could be more likely than those for a traditional C implementation. On the other hand, functional language implementations protect you from a wide variety of attacks that occur in C implementations. I don’t believe the balance has been studied, but it’d be interesting. I do know the OCaml/Mirage folks have been having good luck with their TLS implementation. I believe they’ve at least started doing some red team analysis of it, as well, with good results. See their various blog posts, starting with http://openmirage.org/blog/introducing-ocaml-tls. I’m not sure if Vincent’s library has been subject to similar evaluation, and I know the partial library in our Tor implementation has not been. - Adam Quoth: > I’ll make a question out of it: > > Is anyone working on a Haskell project compatible with Tor? Library, Server, Browser, etc. > Is anyone interested in such a project? > Would the Haskell Runtime and TLS modules have any time dependent behavior that would make encryption harder/easier to break than C implementations? Basically, is the TLS attach surface smaller or larger than openssl and is there any data to support claims of such?

14 34

EsseOS: Haskell-based tailored services for the cloud
by Vo Minh Thu 01 Aug '14

01 Aug '14

Hi, I came across this seemingly interesting paper: EsseOS: Haskell-based tailored services for the cloud http://dl.acm.org/citation.cfm?id=2541587 which is unfortunately behind a paywall. I was wondering if someone knew about a freely accessible version of that paper, or about some project page, or just heard of it. Thank you, Thu

2 2

ICFP 2014 Final Call for Participation
by David Van Horn 01 Aug '14

01 Aug '14

[ Early registration ends 3 Aug; Invited speakers and conference program have been announced. ] ===================================================================== Final Call for Participation ICFP 2014 19th ACM SIGPLAN International Conference on Functional Programming and affiliated events August 31 - September 6, 2014 Gothenburg, Swedenhttp://icfpconference.org/icfp2014/ ===================================================================== ICFP provides a forum for researchers and developers to hear about the latest work on the design, implementations, principles, and uses of functional programming. The conference covers the entire spectrum of work, from practice to theory, including its peripheries. A full week dedicated to functional programming: 1 conference, 1 symposium, 10 workshops, tutorials, programming contest results, student research competition * Program: http://icfpconference.org/icfp2014/program.html * Accepted Papers: http://icfpconference.org/icfp2014/accepted.html * Local arrangements (including travel and accommodation): http://icfpconference.org/icfp2014/local.html * Registration is available via: https://regmaster4.com/2014conf/ICFP14/register.php Early registration is due 3 August, 2014. * Programming contest, 25-28 July, 2014: http://icfpcontest.org/ * Follow @icfp_conference on twitter for the latest news: http://twitter.com/#!/icfp_conference Keynote speakers: * Kathleen Fisher (Tufts University): Using Formal Methods to Enable More Secure Vehicles: DARPA's HACMS Program * Robert Bruce Findler (Northwestern University): Behavioral Software Contracts * Stephanie Weirich (University of Pennsylvania): Depending on Types There are several events affiliated with ICFP: Sunday, August 31 ACM SIGPLAN Workshop on Generic Programming ACM SIGPLAN Workshop on Higher-order Programming with Effects Monday, September 1 – Wednesday, September 3 ICFP Thursday, September 4 ACM SIGPLAN Commercial Users of Functional Programming: Day 1, Tutorials ACM SIGPLAN Haskell Symposium: Day 1 ACM SIGPLAN Workshop on Functional High-Performance Computing ACM SIGPLAN ML Family Workshop Friday, September 5 ACM SIGPLAN Commercial Users of Functional Programming: Day 2, Tutorials ACM SIGPLAN Haskell Symposium: Day 2 ACM SIGPLAN OCaml Workshop ACM SIGPLAN Erlang Workshop Saturday, September 6 ACM SIGPLAN Commercial Users of Functional Programming: Day 3, Talks ACM SIGPLAN Haskell Implementors Workshop ACM SIGPLAN Workshop on Functional Art, Music, Modeling and Design Conference Organizers General Chair: Johan Jeuring, Utrecht University Program Chair: Manuel Chakravarty, University of New South Wales Local Arrangements Chair: Björn von Sydow, Chalmers University Industrial Relations Chair: Anil Madhavapeddy, University of Cambridge Workshop Co-Chairs: Tom Schrijvers, Ghent University Sam Tobin-Hochstadt, Indiana University Programming Contest Co-Chairs: Duncan Coutts, Well Typed LLP Nicolas Wu, University of Oxford Student Research Competition Chair: Meng Wang, Chalmers University Publicity Chair: David Van Horn, University of Maryland Video Chair: Iavor Diatchki, Galois Malcolm Wallace, Standard Chartered Bank Industrial partners: Platinum partners Jane Street Capital Gold partners Google Microsoft Research Mozilla Oracle Labs Standard Chartered Bank Silver partners Bloomberg Credit Suisse CyberPoint Erlang Solutions Facebook Galois Klarna Lexifi Twitter Bronze partners Alephcloud IntelliFactory Opera Software QuviQ Systeor Vest AS =====================================================================

1 0

haskell on Debian
by Kees Bleijenberg 01 Aug '14

01 Aug '14

I want to reinstall Haskell on Debian (in Virtualbox on Windows). So: apt-get remove haskell-platform Deleted all maps with packages in it. apt-get install haskell-platform (installing previous selected ... etc) cabal update All this without errors of warnings. cabal install cabal-install Error: /var/lib/ghc/package.conf.d: openFile: does not exist Why this error? Setup doesn't create this directory?

1 0

Tor project and Haskell (FPL) ,..
by Vasili I. Galchin 01 Aug '14

01 Aug '14

I wasn't trying to offend anybody .... Only trying to provoke a lively discussion in order lift all boats. Sometimes one sentence IHMO provokes thought. In any case I appreciate all responders :-) Kind thanks friends. Vasya

2 1

Re: [Haskell-cafe] Tor project
by Tobias Dammers 01 Aug '14

01 Aug '14

On Fri, Aug 01, 2014 at 12:03:34PM +0200, Wojciech Narczyński wrote: > > W dniu 2014-08-01 11:56, Tobias Dammers pisze: > >On Fri, Aug 01, 2014 at 09:35:37AM +0200, Wojtek Narczyński wrote: > >>Why the gimmick, for each and every piece of crypto code? Why not just use > >>the clock for timing? The crypto lib would probably have to tune itself on > >>startup. > >Sorry, I didn't mean use the crypto function to cause the delay; I meant > >using a cryptographic hash to determine how long the delay should be. > >Once we have a number, the system clock should of course be used to > >actually delay things. > > > > > This is poinlessly complicated. > > Just measure how much each execution takes, remove outliers, take the upper > bound, wait appropriate amount of time on each call so that the attacker > sees constant time for each call. > I think you are underestimating the statistical aspect to this. In order to do this in a useful way, you'd have to sample your own code on a regular basis, for a large number of inputs, and you better get the padding exactly right, because if it's off by a tiny amount, that tiny amount will remain after averaging. It will basically boil down to a sampling war between you and the attacker - if your sampling is really good, your error may be really small, but the attacker can counter this by sampling more. To make matters worse, you are playing this game blindly: you don't know how much sampling is enough, or how much the attacker can afford to sample. I also think you are over-estimating the complexity of the crypto-hash solution: suitable hashing functions are there for the taking (it doesn't even have to be a time-hard function like bcrypt/scrypt/... AFAIK, just one that's cryptographically sound), converting a hash into a delay value is trivial, and you need to implement a delay mechanism anyhow. The most "challenging" part, I think, is managing a secret to seed the hash function.

2 1

Re: [Haskell-cafe] www.galois.com vs Google??
by Vasili I. Galchin 01 Aug '14

01 Aug '14

Tobias, I pretty agree with your response. I was trying to challenge the entire audience to think about the issue about software correctness(e.g. strong typefullness (and static type checking) like Haskell, et. al. vs no type-checking/ dynamic type checking). My point is how can we as a community respond to Google's challenge?? In my humble opinion (IMHO) I think Google has missed the point regarding contemporary software correctness problems .. (and also the Tor project . given the languages of implementation) .. Here is a very simple and cheesy example .. I worked at HP on a contract .. . a predecessor of mine used with typefullnes of C++ (I thinking using type casting ) and did a buffer overrun of "heap" allocated that corrupted "the heap allocator metadata" (malloc) .... of course I used to "gdb" to do a "postmordum after the patient died" ... IHMO I would been more happier if this "overrun" had been detected at compile-tyime .. due to static strong type checking ... :-) Alll grammer errors are due to my cat Buddy ... Vasya On Thu, Jul 31, 2014 at 5:24 AM, Tobias Dammers <tdammers(a)gmail.com> wrote: > The way I read that article, those are two very different goals and > approaches. > > The "Project Zero" thing seems to be about subjecting "everything" to > thorough security checking by the best experts Google can buy, in order > to fix as many security problems on the internet as they possibly can. > > The software correctness problem is somewhat related, but not entirely - > not all security problems are software bugs, and not all software bugs > are security problems. > > On a side note, I think both problems are inherently unsolvable - we can > go a long way cleaning up the solvable problems, and building an > infrastructure that avoids them by design, but some potential for bugs > and flaws will always remain, at least as long as we're using reasonable > definitions of "programming" and "software". > > On Wed, Jul 30, 2014 at 10:08:06PM -0500, Vasili I. Galchin wrote: >> Hello Haskellers(and all FPL people), >> >> I just ran across the following effort by Google: >> http://blogs.techworld.com/war-on-error/2014/07/googles-project-zero-flaw-p… >> >> It seems to me that www.galois.com(www.janestreetcapital.com) >> realizes that the solution to software correctness problems doesn't >> lie with uncontrolled "mutability" ... >> >> Question: does Google concur with www.galois.com or google's >> effort just "more of the same"?? >> >> Vasili >> _______________________________________________ >> Haskell-Cafe mailing list >> Haskell-Cafe(a)haskell.org >> http://www.haskell.org/mailman/listinfo/haskell-cafe

2 1

Haskell Platform 2014.2.0.0 Release Candidate 3
by Mark Lentczner 31 Jul '14

31 Jul '14

Small update to the Haskell Platfrom 2014.2.0.0 release: We have new Release Candidate 3 versions of the source tarball... and a new generic-linux bindist of the platform! - source tarball: haskell-platform-2014.2.0.0-srcdist-RC3.tar.gz <http://www.ozonehouse.com/mark/platform/haskell-platform-2014.2.0.0-srcdist…> - generic linux: haskell-platform-2014.2.0.0-unknown-linux-x86_64-RC3.tar.gz <http://www.ozonehouse.com/mark/platform/haskell-platform-2014.2.0.0-unknown…> *Windows and OS X users: There are no RC3 versions - as the RC2 versions seem to be holding up fine!* *General* - hptool (and hence ./platform.sh script) take a new --prefix parameter that is used for generic (non-OS X, non-Windows) builds: It sets the root under which haskell installations are located. Defaults to /usr/local/haskell. Everything will be placed in a directory named ghc-7.8.3-<arch> under this prefix. - activate-hs script for default Posix-like builds - small fixes to allow bootstrapping the platform with GHC 7.4 - README and LICENSE updated *Source Tarball* - all missing pieces now present - build platfrom from source tarball verified *Generic Linux Binary Dist* - Built from the GHC's generic Linux bindist for Deb 7 style systems - Complete tarball: this is all you need to install Haskell on a compatible system - Built on Ubuntu 12.04LTS - Tested on Ubuntu 14 - my system needed a symlink from libgmp.so to libgmp.so.10 - this seems to be an issue with the GHC bindist built components To install this: cd / sudo tar xvf ~/haskell-platform-2014.2.0.0-unknown-linux-x86_64-RC3.tar.gz sudo /usr/local/haskell/ghc-7.8.3-x8_64/bin/activate-hs This will finish the package registration, and install symlinks from /usr/local/bin for all the standard haskell command line tools. — Mark *shasum -a 256:* ab759ec50618f2604163eca7ad07e50c8292398a2d043fdc1012df161b2eb89a haskell-platform-2014.2.0.0-srcdist-RC3.tar.gz 0da6879ae657481849e7ec4e5d3c4c035e090824167f97434b48af297ec17cf9 haskell-platform-2014.2.0.0-unknown-linux-x86_64-RC3.tar.gz

1 0

[ANN] hsimport 0.5: configurable pretty printing and placing of imports
by Daniel Trstenjak 31 Jul '14

31 Jul '14

Hi all, hsimport[1] is a command line program for extending the import list of a Haskell source file. There's an integration[2] for the vim editor, which can automatically extend the import list for the symbol under the cursor. hsimport 0.5 changes: - configurable[3] pretty printing of imports - configurable placing of new imports - support of multi line imports - better handling of incomplete/invalid Haskell source files Grettings, Daniel [1] https://github.com/dan-t/hsimport [2] https://github.com/dan-t/vim-hsimport [3] https://github.com/dan-t/hsimport/blob/master/README.md

1 0