4 ms·

This is one area that Perl's CPAN really got right. Pick just about any random module, and you're immediately greeted with a short synopsis showing the use-case

This is one area that Perl's CPAN really got right. Pick just about any random module, and you're immediately greeted with a short synopsis showing the use-case. When you search for something and find 5 matching modules, you can quickly evaluate them on the basis of how easy they are to use relative to your codebase. Random obscure module: http://search.cpan.org/~prasad/X12-0.80/lib/X12/Parser.pm http://search.cpan.org/~prasad/X12-0.80/lib/X12/Parser.pm OK so in the first paragraph, I know how to parse an X12 transaction file and get the results into my code. This boils down to know your audience.

pwenzel 9y ago
I think this is a great example. I don't even know what an X12 transaction file is, but boy howdy, I know how to parse it now!
- avian 9y ago
  It is a double-edged sword though. It makes it easier for people to use a module without understanding it fully (or at all). The CGI.pm fiasco is one example, where people were copy-pasting the one-liner in the synopsis and opened themselves to an attack. A lot of things are complicated and can’t be usefully summarized in a few lines.
  - plttn 9y ago
    I wasn't around for this fiasco, what exactly was it?
    - avian 9y ago
      Check the “Perl jam” series of talks given at CCC. They are quite inflammatory, but the author does have a few good points. Specifically, he shows that one of the examples in the documentation for the CGI.pm module had an exploitable vulnerability.
      - chromatic 9y ago
        Specifically, he shows that one of the examples in the documentation for the CGI.pm module had an exploitable vulnerability. I think that's overstating things. He reported a "vulnerability" in Bugzilla which wasn't a security problem in Bugzilla because Bugzilla uses taint, which didn't do any database injection like he claimed, and which is unrelated to CGI.pm becaues Bugzilla doesn't use CGI.pm: https://bugzilla.mozilla.org/show_bug.cgi?id=1230932 https://bugzilla.mozilla.org/show_bug.cgi?id=1230932 Furthermore, the examples in his presentation don't actually work, he relies on ignorance of lists and Perl data structures, and the one potentially interesting point he makes about calling functions in list context in hash initializers has been documented well understood as a potential mishap in web applications since 2000: https://events.ccc.de/congress/2014/Fahrplan/system/attachments/2542/original/the-perl-jam-netanel-rubin-31c3.pdf https://events.ccc.de/congress/2014/Fahrplan/system/attachme... His presentation may have some value to someone spending their first week with Perl in a web context, but that person would have to wade through a lot of nonsense to get at that value.

pwenzel 9y ago

I think this is a great example. I don't even know what an X12 transaction file is, but boy howdy, I know how to parse it now!

avian 9y ago
It is a double-edged sword though. It makes it easier for people to use a module without understanding it fully (or at all). The CGI.pm fiasco is one example, where people were copy-pasting the one-liner in the synopsis and opened themselves to an attack. A lot of things are complicated and can’t be usefully summarized in a few lines.
- plttn 9y ago
  I wasn't around for this fiasco, what exactly was it?
  - avian 9y ago
    Check the “Perl jam” series of talks given at CCC. They are quite inflammatory, but the author does have a few good points. Specifically, he shows that one of the examples in the documentation for the CGI.pm module had an exploitable vulnerability.
    - chromatic 9y ago
      Specifically, he shows that one of the examples in the documentation for the CGI.pm module had an exploitable vulnerability. I think that's overstating things. He reported a "vulnerability" in Bugzilla which wasn't a security problem in Bugzilla because Bugzilla uses taint, which didn't do any database injection like he claimed, and which is unrelated to CGI.pm becaues Bugzilla doesn't use CGI.pm: https://bugzilla.mozilla.org/show_bug.cgi?id=1230932 https://bugzilla.mozilla.org/show_bug.cgi?id=1230932 Furthermore, the examples in his presentation don't actually work, he relies on ignorance of lists and Perl data structures, and the one potentially interesting point he makes about calling functions in list context in hash initializers has been documented well understood as a potential mishap in web applications since 2000: https://events.ccc.de/congress/2014/Fahrplan/system/attachments/2542/original/the-perl-jam-netanel-rubin-31c3.pdf https://events.ccc.de/congress/2014/Fahrplan/system/attachme... His presentation may have some value to someone spending their first week with Perl in a web context, but that person would have to wade through a lot of nonsense to get at that value.