[e12e]

> Separately, Cabal is a package manager for development dependencies for the Haskell programming ecosystem.

And cargo/rustup, go for golang, pip for python, gem/bundle for ruby...

But they all tend to depend on parts of the Os - or their own c compile chain to compile their own version of c libs.

Which leads to the question of how you most easily write a tool in haskell that you can distribute as a deb package.

Saying that "for haskell, playing nice with Perl's ssl-dependencies is hard, so we won't bother" is one approach. It certainly is one way to use up additional resources provided by moore's law: no shared libraries, just thousands of copies of statically linked strlen-functions, in thousands of chroots. (also, hello there, docker).

Snapshots and isolation are great tools, but I don't think it's clear cut what's best yet. Especially when you want to ensure you're not running code with well-known vulnerabilities - be that in bash, ssl keygen, or mallloc.