You know, anytime I expose Msg in any kind of library code, I wind up regretting it. And it's also a really big newbie trap... I wonder if Evan is considering making that a new package rule, like, packages allow Debug.todo, it'd make sense to now allow security breach's from Msg as well.
Well, imho the only case when getting new dependencies for everything would be acceptable, would be if we had formal verification of all that code. I mean if we wanted get an external sorting implementation it would need a type like (Ord a, Sorted ys) => [a] - > (ys::[a]) and would need to be typechecked for totality.
Also, there is a great example in the presentation - if the library operates on strings then it won't do any IO. Using types we can limit the vulnerabilities and potentially even eliminate them.
That was a good joke about the dependencies, comparing it to somewhat with a process footprint of kilobytes and then bragging over the 10% reduction he did. Ignoring the Browser, the Elm compiler and the whole JavaScript mess this ecosystem is based on as dependency, is a form of art, too.
(Wikipedia) A conduit, in esoterism, and spiritual discourse, is a specific object, person, location, or process (such as engaging in a séance or entering a trance) which allows a person to connect or communicate with a spiritual realm, metaphysical energy, or spiritual entity, or vice versa. Medium is another name for that kind of person.
I'm pretty sure it's more about these definitions: Medium - The materials or empty space through which signals, waves or forces pass. Conduit - A means by which something is transmitted. (en.wiktionary.org)
