Add warning for lack of HTTPS support

[sjakobi]

Newcomers to the Haskell ecosystem such as this one often don't realize at first that HTTP lacks HTTPS support.

Could a warning about this be added to the Cabal description? Would a PR be welcome? Should the warning include a recommendation e.g. for http-client?

[hsenag]

Happy to get a PR. Is http-client the clear winner as an alternative? Otherwise is there a web page to point to discussing the options (I had a quick look on the wiki but didn't find anything).

[sjakobi]

Is http-client the clear winner as an alternative?

There are other options like wreq, and more recently req.

http://haskelliseasy.readthedocs.io/en/latest/#http-clients might be a good reference and is probably a good starting point for a newcomer.

There's a (presumably opinionated) discussion of HTTP clients at https://github.com/mrkkrp/req#motivation-and-req-vs-other-libraries.

[hsenag]

OK, maybe just list the alternatives? Neither of those look all that clear to me.

[hvr]

@sjakobi I just wish there was a better list of alternatives; all those lists I see are opinionated towards using http-client under the hood in some way or another... :-/

[sjakobi]

all those lists I see are opinionated towards using http-client under the hood in some way or another...

@hvr I'm simply not aware of any ok-looking HTTP-client library that supports HTTPS and doesn't rely on http-client. I'm also not aware of any issues that would make relying on http-client a bad thing…

We can point people at https://hackage.haskell.org/packages/#cat:Network of course, but we should keep in mind that the target audience for the warning is newcomers who are exploring the ecosystem and may have difficulties telling apart useful packages from less useful or unmaintained packages.

Referring them to http-client/http-client-tls, req and wreq seems better to me than not giving any guidance at all.

[sjakobi]

I have opened #106. If necessary we can discuss the wording there.