quicklisp-client

Quicklisp still doesn't support HTTPS, which is apparently also necessary to do signature check. Use HTTPS instead of HTTP - https://github.com/quicklisp/quicklisp-client/issues/167

Quicklisp doesn’t use TLS or signatures? How have I not heard this before? That would be unbelievably irresponsible. Has this really not been addressed by the CL community? Edit: here’s the issue: https://github.com/quicklisp/quicklisp-client/issues/167 Thanks for bringing this up!

Yes, that's clear. I'm not very familiar with how quicklisp works. I thought that “updates once a month” implies a separate update channel (distribution, ...). Looking at the relevant issue, https://github.com/quicklisp/quicklisp-client/issues/167 , it's not clear that even hashes are in place. I recently found out that most Nix fetchers use https, but do not actually do verification (`curl --insecure` or equivalent libcurl settings). Channel updates do verify and include hashes, so the overall chain is authenticated.

It looks interesting, however this is a bit scary: > WARNING: This software is BETA quality. I use it as my daily driver, but it is still a little rough around the edges and it may accidentally eat your files. And for QuickLisp, this is scary: https://github.com/quicklisp/quicklisp-client/issues/167#iss... > It would be good to do, but there's no straightforward path to do it. Implementations do not all provide HTTPS support, it's not straightforward to make it from scratch or use HTTPS libraries on all supported platforms. The fact that the package manager (!!!) isn't able to ensure use of HTTPS libraries as its own dependency on all platforms is... super scary.

> That's what regular devs do, they don't even bother writing articles or commenting on HN :-) I'll take the bait, and roll up several of my comments into one. First, the support contract costs from the commercial vendors can make sense. It's one of the most expensive parts of software. We joke about fixing relatives' printers, but it's not false. Support costs introduce a counter-balance. Second, a message to everyone looking into or using QuickLisp, it uses http instead of https: https://github.com/quicklisp/quicklisp-client/issues/167 You can patch your version to fix this. I'd also recommend adding firewall rules to deny in case your patches roll back. And any other mitigation. Or stricter policies, such as not using it, if it makes sense for your organization. And the AI bots? I hope there aren't people herding them who don't

AFAIK, Xach is no longer working for Clozure. Since 2015. One can donate for Quicklisp work, even for specific features: https://www.quicklisp.org/donations.html Xach is working on a fundraiser effort to get it out of beta. https://twitter.com/quicklisp/status/798316176082354176 > To make matters even worse, most functions lack documentation strings It's not that there are no documentation strings. Example: https://github.com/quicklisp/quicklisp-client/blob/master/qu... > I also advocate against it to friends and colleagues who share my views on software distribution mechanisms. It would be better to advocate to friends to help improve it.

IYAI Common lisp's quicklisp implements and uses cdb https://github.com/quicklisp/quicklisp-client/blob/master/qu...