Building Secure Systems in Haskell
summary
Claim: language-level information flow control enforces data policies everywhere so missed checks stop being vulnerabilities. Implementation uses LIO (a labeled IO monad) and the Hails web framework, attaching labels to rows that follow data and checking them on all IO. Built apps include a GitHub clone, blog and review systems; policy code is ~250 lines versus ~200,000 lines of untrusted app code, and enforcement prevents leaks at render and network boundaries.
AI-written summary · about
chapters (7)
- 0:00Introduction and context
- 0:31The problem with current apps
- 0:55Root cause of vulnerabilities
- 1:25Example: blogging application
- 6:38A new approach to security
- 6:51Hails framework introduction
- 23:13Implementation and conclusion
related talks
15mLiquid Information Flow Control
21mSecurely Compiling F* Programs With IO and Then Linking Them Against Weakly-Typ...
21mSecuring Verified IO Programs Against Unverified Code in F*
01h 00mAI Safety through Programming?
32mSubstructural Information Flow via Polymorphism
44mInfoflow LSM
15mStructural Information Flow: A Fresh Look at Types for Non-Interference
54mSecuring Software by Construction