23 ms·

Why does OpenBSD still include Perl in its base installation?

100 points by mfontani 6y ago

mister_hn 6y ago
Why not?
- dijit 6y ago
  It's a good question because OpenBSD (rather famously) chases simplicity. Perl is antithetical to simplicity, often jokingly referred to as "write-only software". Not to mention the myriad of packages that usually end up being brought in (thanks CPAN!). So, it's a fair question, not just "why is there a perl interpreter?", which is a decent question given openbsd's overall lack of shipping with much; but also "Why are large parts of the glue code written in perl?" EDIT: I know it's frowned on to talk about downvotes, but I received quite a few and I'm not sure why. Please leave a comment if you're going to flag a comment.
  - clarry 6y ago
    Idk why people would downvote, but I don't agree that OpenBSD ships with little. In fact, I find it to be full of useful tools; it's very much a "batteries included, complete operating system" (as opposed to many small/minimalistic linux distros that really have you go through the pain of having to install every little thing you might need). It's small but not minimalistic. It's small but they managed to pack a ton of useful functionality in small size. And that's what I love about it; the rest of the world seems to be very fixated on extremes.
    - pacija 6y ago
      Agreed. It includes a huge set of tools needed by admins dealing with fundamental stuff such as routing and firewalling. I guess people bashing it are more into higher application layers. Having pf, bgpd, ospfd, isakmpd etc. included in base for systems I administer are crucial for my daily tasks, while I couldn't care less for node.js. But application developers not dealing with network stuff probably have the opposite needs. It's not about "which OS is better" but about "which tool is appropriate for the job".
  - DFHippie 6y ago
    So here's a theory about the downvotes. Some person P likes technology X, but they are aware that others consider it a sport to dump on X. A rare article about X comes up in a popular forum. P clicks on it with dread to see how X is being dumped on this time. But it says positive things! P's dread is replaced with optimism. Then P reads the typical dumping-on-X post, which says something like "X is a hideous monstrosity. I fart in its general direction" or "X is antithetical to simplicity, often jokingly referred to as etc". P's dark mood returns and P does as people do when they feel like someone has been unnecessarily cruel and provoking: they press the shun button.
    - hpcjoe 6y ago
      Alternative theory. Perl aficionados have a long history of being on the receiving end of passive aggressive language zealots. Usually they are Pythonistas, but others have joined in as well. You see this in messages that say "perl is a write once language" or "its too complex" or "line noise" or "why is it still alive when X is better" ... Really, its tiring after 25+ years using it. So, in an effort to express a valid and terse critique of the comment, the respondent does the right thing, and down votes the specific comment making those, frankly, inane points. From there, people draw up interesting theories as to why the passive aggressive behavior was down voted. The reality. Perl is a modern, highly capable, fast, easy to use language. It is comprehensible by mere mortals, while having powerful features that other languages often attempt to replicate poorly (regex, etc.) It is portable, running the same code across *nix, windows, macos, ... . It is fast[1] (yes really). It doesn't claim to solve the worlds problems, but is a tremendously useful and portable tool, embedded in many companies products. Specifically, when they need to get something done, and done well, perl in the toolbox is a godsend. Claims it is dead, hard, slow, incompatible, etc. tend to come from a vocal minority of people with an agenda. I don't claim my theory is correct. I do believe it fits a very long standing pattern in language advocacy. For me personally, I use the best tools for the job. Perl is often the right tool, but not always. Sometimes its python. Sometimes Julia. Sometimes C/C++. Rarely these days Fortran (moving to Julia). This said, I am not going to bash any of the tools I use, or that others use. If visual basic .net works for you, use it. If you need to be portable across systems and OSes, you probably don't want to be writing things in powershell (literally had this conversation at $dayjob a few times over the last few months). Languages come with dependencies and baggage. You can write great maintainable code in Perl, and terrible not comprehensible code in Perl. As you can in any language. Arguing that one language or the other "enables" you to do this "more easily" is a perfect example of that passive aggressive stance that is not helpful to anyone. Use the right tool for the job. Perl, more often than not, is the right tool. [1] https://scalability.org/2020/05/on-optimizing-scripting-languages-and-where-they-are-useful-and-where-they-are-not/ https://scalability.org/2020/05/on-optimizing-scripting-lang...
  - tankenmate 6y ago
    If you write a lot of systems code on Unix in C, write bash scripts, and write awk scripts then Perl largely just makes sense. It takes large chunks from all of the above. So if you don't like UNIX, C, (ba)sh or awk (all of which came from Murray Hill) chances are you won't like Perl either.
    - microtherion 6y ago
      Maybe not so much C, but I saw Perl 4/5 as very attractive for sysadmin-type engineers, because it was pretty much explicitly designed to make onboarding as easy as possible for awk, sh, sed (and BASIC) programmers. Quite a few people I know got started with Perl because they were reasonably comfortable with awk, sh, or sed, started to outgrow their sweet spot, and found that perl provided a very natural transition from each of these languages, could do everything those scripts could do in fairly similar ways, and was obviously more powerful.
deleted 6y ago
[deleted]
Tomte 6y ago
Why is TCL out? Is it about a perceived bad track record or about inherent properties of the language?
- fuball63 6y ago
  I'm also curious as to what the "security" issues are that TCL would be rendered "out".
- rwmj 6y ago
  I guess the general answer is that everything is out because they have a lot of Perl already and not a lot of developers so why waste that time rewriting everything? Having said that I wrote a bunch of Tcl last year for a speech[1] and the Tcl community is nowadays very small. It was hard to find answers to some questions online: the active period of the community predated Stackoverflow so there's not much on SO. And the library support is very thin compared to the giant Perl/Python/Javascript/... communities. None of these things are reasons why Tcl is bad - I happen to like it and my talk was a success partly because of Tcl - but it may be a problem for OpenBSD to adopt it. [1] https://www.youtube.com/watch?v=9E5A608xJG0 https://www.youtube.com/watch?v=9E5A608xJG0
  - Tomte 6y ago
    I meant specifically about security. Because everything is a string?
    - rwmj 6y ago
      I doubt it's much different than Perl. Both languages have very loose type systems. In fact the internal implementations are rather similar since both use strings but optimize numbers (IVs etc in Perl which are visible to the programmer, in Tcl the bytecode interpreter optimizes ints/floats to an internal representation but at the language level everything still looks like a string). Perl's tainting feature is the only security-related advantage over Tcl that I can think of right now, but it's not used unless you explicitly enable it.
    - 6y ago
qalmakka 6y ago
Perl 5 is in my humble opinion a really convenient to have installed. I use it all the time as a replacement for those shell scripts that become too big or too cumbersome, or to remove out of the equation the quirkiness of different implementations of standard tools (i.e. GNU sed has certain flags that BSD does not have, gawk is different from mawk, etc). A Perl onliner is often faster and works the same way pretty much everywhere.
- flyinghamster 6y ago
  That's exactly how I treat Perl as well. Things like lists and hashes make it easy to do things that are difficult or impossible in bash. If my bash script gets much beyond simple looping, I switch to Perl.
  - benbristow 6y ago
    Why Perl over Python though? Most Unix distros come with Python bundled and Python has a bigger ecosystem of libraries etc available. And it's generally easier to read/write.
    - thesuperbigfrog 6y ago
      >> Python has a bigger ecosystem of libraries etc available. CPAN (http://www.cpan.org/index.html http://www.cpan.org/index.html) is quite large and has libraries to do almost everything you can imagine. I am not sure if CPAN or pip has more libraries though. >> And it's generally easier to read/write. Python looks nicer, but not everyone likes significant whitespace. The Python 2 to 3 change has also caused some adoption issues. The Perl 4 to 5 happened quite a while ago. Perl 5 has been integral to Unix-like systems since the web went mainstream.
      - aryonoco 6y ago
        Yeah and the Perl 5 to Perl 6 move... oh wait...
jedimastert 6y ago
> - you need something under and acceptable licence, so python is out. I'm not familiar with these types of things, can someone shed some light on this comment? > awk would kind of work, except it's not that readable I don't think I've ever heard someone say a plus side of perl is it's "readability". And this is coming from someone who really enjoys perl
- dijit 6y ago
  Marc Espie elaborates a bit on this in another post on the openbsd-misc mailing list[0]: > As for the license, python’s license appears fairly similar to Perl’s artistic license. I would worry a bit about the strong terms in >> 6. This License Agreement will automatically terminate upon a material breach of its terms and conditions. > for which no equivalent is visible in Perl’s license. [0]: https://marc.info/?l=openbsd-misc&m=157781106212088&w=2 https://marc.info/?l=openbsd-misc&m=157781106212088&w=2
  - kungato 6y ago
    What the hell is this? Is this even legal? Aren't these completely different concepts?
    - masklinn 6y ago
      Why wouldn't it be legal? edit: why the downvote? It states explicitly that the license is only granted as long as its requirements (T&Cs) are upheld. Which seem obvious to me, assuming the license does have conditions? Though I guess it's less obvious to the legal profession as the MPL has a similarly explicit clause (5.1, and 5.2 also terminates the license if you initiate patent infringement litigation against "against any entity", which seems oddly broad)
  - luckylion 6y ago
    What exactly does that part mean? If you're in violation of the license, you cannot correct the violation and be compliant again, but the license will be revoked immediately and there's nothing you can do about it? It's strange though, they also have > 8. By copying, installing or otherwise using Python 3.8.3, Licensee agrees to be bound by the terms and conditions of this License Agreement. which feels very 90ies-EULA-style. If I download ("copy") an archive that contains Python, I should be bound by that License Agreement? Since there's not severability clause, wouldn't that just void the limitations they've set?
teddyh 6y ago
There are many who call GNU people license zealots, and who imagine that GNU somehow shuns BSD licences. But the opposite is true! GNU people happily use BSD licensed code, and include BSD licenced code in the GNU “free software” term, while it is the BSD people who, as can be seen here, reject software like Python and GCC for having “unacceptable” licenses.
- deleted 6y ago
  [deleted]
- posix_me_less 6y ago
  GNU/GPL folks are zealots about user freedoms, not license. Linux leadership (accepting GPL) are less zealotic about user freedoms, but sometimes are zealots about keeping control (rejecting to play nice with the OpenZFS project). BSD people are zealots about getting rid of GPL code so that their product can be used by some stranger in a proprietary way. There is money both in working on GPL software and more liberal licenced software (GPL variants), but it seems everything is set up so that the two camps must not directly cooperate.
- eitland 6y ago
  You can always combine BSD code with your GPL and release the code as GPL. You cannot however mix GPL code into your BSD code and the resulting work as BSD.
  - nix23 6y ago
    >You can always combine BSD code with your GPL and release the code as GPL That is completely wrong, you cannot change the license at your will ESPECIALLY from BSD to a GPL. The BSD-Code stays BSD-licensed-code, you can include it into a GPL Project, but NOT change the License, doesn't matter if its from BSD to GPL or vice versa. Since your not the owner of the code, you have absolutely NO right to change the license.
  - greggyb 6y ago
    As the sibling mentions, you cannot re-license code you do not hold copyright to. That said, you're very close to the mark. GPL applies to distributions of the copyrighted work and executables based on it. So, the concern is around an OpenBSD release - they are shipping a full OS with source code and compiled work product. The GPL is "viral" in that you cannot make this release without licensing your whole distribution as GPL. OpenBSD does not want to be GPL, and so does not include GPL-ed code in base. The inverse is not true. A Linux distribution can include GPL and BSD-licensed code easily, because the BSD license imposes no constraints on redistribution.
lmm 6y ago
How is TCL less secure than Perl? I've seen a lot less weird surprises in TCL code than Perl code.
- microtherion 6y ago
  * In my recollection, Tcl relies a lot on string interpolation and run time evaluation, both of which carry some risk. * Perl has a built in taint checking facility which is quite good at preventing the naive use of non-vetted user data; I don't recall whether Tcl has anything similar. https://perldoc.perl.org/perlsec.html https://perldoc.perl.org/perlsec.html
- sigzero 6y ago
  Tcl is not less secure than Perl.
econcon 6y ago
I've never written a single line of but written python, bash and c and go. I am not sure how important perl is.
- pferde 6y ago
  So why write this comment? What is your comment adding to the discussion? Knowing when to shut up is a valuable skill to have.
- mfontani 6y ago
  I would strongly recommend you do learn Perl 5 (and Raku, and Haskell, and lua, and functional languages, and ...), even if only to be able to know enough about them to be enlightened about what each of them gets right and wrong. For Perl 5, you could do worse than going through the _free_ "Modern Perl" book, at http://modernperlbooks.com/books/modern_perl_2016/ http://modernperlbooks.com/books/modern_perl_2016/
  - IggleSniggle 6y ago
    Thanks for recommending this book. Mostly I write TypeScript day-to-day, so naturally I typically reach for nodejs when I want to "upgrade" a script from bash to a more expressive language in a cross-platform way. I've been frustrated with that tooling, however, for a whole bunch of reasons, at lot of it to do with how clunky nodejs actually is in shell pipelines. I've thought about reaching for python, but it has some similar issues to nodejs: you need a particular environment, and some things which ought to be natural in a shell environment just...aren't...in python. I think someone here suggested Lua, and I just...don't care for Lua (although I haven't tried it in a scripting-like context). Anyhow, I've been reading this for a half-hour or so and I'm struck by how incredibly similar common Perl idioms feel to JavaScript as it is commonly used today. I think part of this familiarity has to do partly with type coercion, partly with destructing assignments, partly with function "context"(as in Perl) as it is commonly deployed in the nodejs ecosystem, partly because of the way default arguments and function passing relates to the default scalar variable in Perl. I've been playing around with OCaml and Rust a bunch recently, but haven't had any good reason to reach for them "in real life." The fact that Perl is "everywhere" (much the way JavaScript is "everywhere" as a side effect of browsers being ubiquitous), means that I'm likely to start reaching for Perl instead of nodejs when I need to move beyond Bash. It really does seem to be the right tool for the job. So, a hearty "thank you" for the recommendation.
cutler 6y ago
Coz Perl rocks. Long live The Camel.
fpoling 6y ago
It is interesting that PHP is ruled out as insecure. I am not sure that for system administration tasks modern PHP is particularly worse than Perl and these days more people know PHP than Perl.
- captn3m0 6y ago
  Yeah, for scripting, PHP can easily be more readable, especially because of its amazing (sometimes confusing) Standard library. It lets you parse INI files in a single call for eg.
  - tankenmate 6y ago
    As does Perl if you use Config::Inifiles or Config::INI::Reader (depending on whether you want a full blown solution or just a quick INI file => hash solution).
- dtech 6y ago
  Yeah, quite weird. PHP as a webserver has a large amount of known language design things which decreased security (most have been removed over the years afaik), but for scripting? I can't think why it's particularly insecure compared to Python or Perl.
  - acomjean 6y ago
    perhaps its built in web server? python has that too though.
- aganame 6y ago
  No, it's not interesting at all. PHP is fairly good at web things, but that's it.
  - acomjean 6y ago
    I use php for small scripts that need to read csv and database lookup from the command line. It has built ins for these that work without any environment setup which is great sometimes. Perl has some easy oneliners too. Depending on where I'm working sometimes I don't want to set up an environment.
tyingq 6y ago
My guess is that it's because Perl is very comfortable for a team that mostly writes C on a Unix like platform. The general syntax, operators, etc, are close, and familiar things like stat(), gethostbyname(), etc, work almost the same. Edit: One of their Perl scripts for reference: https://github.com/openbsd/src/blob/b66614995ab119f75167daaa7755b34001836821/libexec/security/security https://github.com/openbsd/src/blob/b66614995ab119f75167daaa... And pkg_add, which has quite a lot of Perl: https://github.com/openbsd/src/tree/master/usr.sbin/pkg_add https://github.com/openbsd/src/tree/master/usr.sbin/pkg_add
juangacovas 6y ago
A pretty amount of tools still use Perl under the hood and I'm pretty sure some of the "granted, they just work" tools that we're used to be just there or install, use Perl in some way. Two examples I can give in my case are the good old rsnapshot, and CSF firewall
- mfontani 6y ago
  GNU Parallel is also a very useful tool, and it's written in Perl 5.
  - xyproto 6y ago
    A useful tool with a highly annoying message to the user if you're using Fedora.
    - mfontani 6y ago
      That's odd, but interesting. What warning? Is it Fedora-specific?
      - xyproto 6y ago
        It's specific to the tool, but most distros disable the message. > If you want GNU Parallel to be maintained in the future, and not just wither away like so many other free software tools, you need to help finance the development. etc For more details, check out the Arch Linux patches that patch this super-annoying message out: https://git.archlinux.org/svntogit/community.git/tree/trunk?h=packages/parallel https://git.archlinux.org/svntogit/community.git/tree/trunk?... The message appears every time when using GNU parallel unless a very long flag is given or the executable has been patched. I think it goes against the philosophy of most open source software that comes with Linux distros, where you are given software freely, but pay back by contributing to the overall open source community, if you can and want. (This is my subjective interpretation of the matter).
        6y ago
pvaldes 6y ago
If you had used Postgresql you may be familiar with psql, createdb, createuser or pg_createcluster. All are perl scripts. So if you remove Perl, either you renounce also to include Postgresql in your distro, or you would need to rewrite a non trivial amount of scripts in a different language to restore Postgresql support.
- dchest 6y ago
  This post is about base system, which doesn’t include postgres. Obviously, if you don’t have Perl in the base, Postgres package could just include Perl as a dependency.
  - pvaldes 6y ago
    Then it is a different problem. Thanks for the clarification.
- tyingq 6y ago
  Is postgres in the base distribution for any BSD or Linux distribution? I'd assume it would just have a dependency on Perl.
- anttisalmela 6y ago
  createdb, createuser and pg_createcluster are not part of the PostgreSQL, but part of the postgresql-common packaging for Debian compatible distributions: https://salsa.debian.org/postgresql/postgresql-common/-/tree/master https://salsa.debian.org/postgresql/postgresql-common/-/tree...
danieldk 6y ago
I have never programmed Lua, but it also seems to fit the bill fairly well. - Acceptable license? MIT - you need something that builds everywhere. It probably does? At least it compiles with Turbo C 1.0. - Modicum of security: probably. Lua is also small compared to Perl, is easily embeddable, and seems to have a sane syntax compared to Perl. I do understand why they use Perl though, probably more OpenBSD developers/users are familiar with it.
- tyingq 6y ago
  I suspect they would need the lua-posix extension, which appears to be maintained by a fairly small number of people. Lua doesn't have some basic stuff they would want, like stat(), chmod(), sleep(). Edit: Sort of makes me wonder why a VERY C-like, small, dynamically typed, scripting language never emerged. Squirrel is kind of close, but not quite what I mean.
  - thesuperbigfrog 6y ago
    >> Sort of makes me wonder why a VERY C-like, small, dynamically typed, scripting language never emerged. Csh (https://en.wikipedia.org/wiki/C_shell https://en.wikipedia.org/wiki/C_shell) was the de facto standard shell on many Unix systems and still is widely used. However, it has some issues: http://www.faqs.org/faqs/unix-faq/shell/csh-whynot/ http://www.faqs.org/faqs/unix-faq/shell/csh-whynot/ https://www.grymoire.com/Unix/CshTop10.txt https://www.grymoire.com/Unix/CshTop10.txt
- heinrichhartman 6y ago
  Standard library is another factor. Lua does not come with any batteries. Even sockets are an external dependencies. So you would need to ship (and maintain) a lot of libs.
- trasz 6y ago
  That might me the direction FreeBSD follows. It started with integrating Lua into the bootloader, replacing Forth. There’s now also the userspace flua(1) interpreter, used in a few places in the build system, IIRC.
bjarneh 6y ago
It's nice to read something positive about Perl again
tosh 6y ago
context: the start of the thread is about the base system > I was wondering if I need the package manager in the minimal installation of the system as I only use built-in deamons (httpd, sshd) and UNIX utilities (vi, sed)? By package manager I mean pkg_* executables as well as its dependencies (most notably Perl). (The size of /usr/libdata/perl5 is about 50MB on my machine). I just want the minimal installation without any unnecessary scripting language. > Looking at FreeBSD for a moment it seems like Perl left the base system in May 2002 (18 years ago) https://marc.info/?l=openbsd-misc&m=159005284016345&w=2 https://marc.info/?l=openbsd-misc&m=159005284016345&w=2
pwdisswordfish2 6y ago
OpenSSL/LibreSSL still requires Perl to compile. Normally I do not have Perl installed, to conserve space. NetBSD thankfully has always done without a large scripting language, only recently have they included Lua. I wonder how long it would take to rewrite the OpenSSL perl scripts in lua.
- clort 6y ago
  > recently 10 years ago
  - pwdisswordfish2 6y ago
    First 17 years without a scripting language.
anthk 6y ago
Perl5 is pledged.
- notaplumber 6y ago
  No it's not. It has language bindings for pledge(2), which is different. There can be no one size fits all pledge for an interpreted language like perl, as programs can make arbitrary calls to anything they want. But those programs can use pledge, as long as they consider the requirements of the runtime itself. http://man.openbsd.org/man3p/OpenBSD::Pledge.3p http://man.openbsd.org/man3p/OpenBSD::Pledge.3p
  - anthk 6y ago
    That's what I wanted to mean, sorry. OFC an interpreter itself can't be pledged.
    - notaplumber 6y ago
      Saying something is pledged has a very specific meaning. And in this context, has no relevance to the discussion as none of the perl components in base make use of these bindings.
CalChris 6y ago
you need something under and acceptable licence, so python is out. Can someone explain the difference here? OpenBSD is BSD licensed [1]. Python is a BSD-style, permissive free software license which is compatible with the GNU General Public License [2][3]. Licenses are always contentious, but how does this rule Python out? (Granted, the dynamic libraries technical point makes this kind of a moot question.) [1] https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html [2] https://docs.python.org/3/license.html https://docs.python.org/3/license.html [3] https://en.wikipedia.org/wiki/Python_Software_Foundation_License https://en.wikipedia.org/wiki/Python_Software_Foundation_Lic...
- deleted 6y ago
  [deleted]
protomyth 6y ago
I have always wondered what a scripting language designed with the values of the OpenBSD project would look like. It would interesting to sit down and think how pledge, veil, and privilege separation among other things would effect the design.
eruci 6y ago
Why not? Perl is an awesome tool for both sysadmin and web dev, two of the main tasks I use it for.

100 points by mfontani 6y ago

mister_hn 6y ago

Why not?

dijit 6y ago
It's a good question because OpenBSD (rather famously) chases simplicity. Perl is antithetical to simplicity, often jokingly referred to as "write-only software". Not to mention the myriad of packages that usually end up being brought in (thanks CPAN!). So, it's a fair question, not just "why is there a perl interpreter?", which is a decent question given openbsd's overall lack of shipping with much; but also "Why are large parts of the glue code written in perl?" EDIT: I know it's frowned on to talk about downvotes, but I received quite a few and I'm not sure why. Please leave a comment if you're going to flag a comment.
- clarry 6y ago
  Idk why people would downvote, but I don't agree that OpenBSD ships with little. In fact, I find it to be full of useful tools; it's very much a "batteries included, complete operating system" (as opposed to many small/minimalistic linux distros that really have you go through the pain of having to install every little thing you might need). It's small but not minimalistic. It's small but they managed to pack a ton of useful functionality in small size. And that's what I love about it; the rest of the world seems to be very fixated on extremes.
  - pacija 6y ago
    Agreed. It includes a huge set of tools needed by admins dealing with fundamental stuff such as routing and firewalling. I guess people bashing it are more into higher application layers. Having pf, bgpd, ospfd, isakmpd etc. included in base for systems I administer are crucial for my daily tasks, while I couldn't care less for node.js. But application developers not dealing with network stuff probably have the opposite needs. It's not about "which OS is better" but about "which tool is appropriate for the job".
- DFHippie 6y ago
  So here's a theory about the downvotes. Some person P likes technology X, but they are aware that others consider it a sport to dump on X. A rare article about X comes up in a popular forum. P clicks on it with dread to see how X is being dumped on this time. But it says positive things! P's dread is replaced with optimism. Then P reads the typical dumping-on-X post, which says something like "X is a hideous monstrosity. I fart in its general direction" or "X is antithetical to simplicity, often jokingly referred to as etc". P's dark mood returns and P does as people do when they feel like someone has been unnecessarily cruel and provoking: they press the shun button.
  - hpcjoe 6y ago
    Alternative theory. Perl aficionados have a long history of being on the receiving end of passive aggressive language zealots. Usually they are Pythonistas, but others have joined in as well. You see this in messages that say "perl is a write once language" or "its too complex" or "line noise" or "why is it still alive when X is better" ... Really, its tiring after 25+ years using it. So, in an effort to express a valid and terse critique of the comment, the respondent does the right thing, and down votes the specific comment making those, frankly, inane points. From there, people draw up interesting theories as to why the passive aggressive behavior was down voted. The reality. Perl is a modern, highly capable, fast, easy to use language. It is comprehensible by mere mortals, while having powerful features that other languages often attempt to replicate poorly (regex, etc.) It is portable, running the same code across *nix, windows, macos, ... . It is fast[1] (yes really). It doesn't claim to solve the worlds problems, but is a tremendously useful and portable tool, embedded in many companies products. Specifically, when they need to get something done, and done well, perl in the toolbox is a godsend. Claims it is dead, hard, slow, incompatible, etc. tend to come from a vocal minority of people with an agenda. I don't claim my theory is correct. I do believe it fits a very long standing pattern in language advocacy. For me personally, I use the best tools for the job. Perl is often the right tool, but not always. Sometimes its python. Sometimes Julia. Sometimes C/C++. Rarely these days Fortran (moving to Julia). This said, I am not going to bash any of the tools I use, or that others use. If visual basic .net works for you, use it. If you need to be portable across systems and OSes, you probably don't want to be writing things in powershell (literally had this conversation at $dayjob a few times over the last few months). Languages come with dependencies and baggage. You can write great maintainable code in Perl, and terrible not comprehensible code in Perl. As you can in any language. Arguing that one language or the other "enables" you to do this "more easily" is a perfect example of that passive aggressive stance that is not helpful to anyone. Use the right tool for the job. Perl, more often than not, is the right tool. [1] https://scalability.org/2020/05/on-optimizing-scripting-languages-and-where-they-are-useful-and-where-they-are-not/ https://scalability.org/2020/05/on-optimizing-scripting-lang...
- tankenmate 6y ago
  If you write a lot of systems code on Unix in C, write bash scripts, and write awk scripts then Perl largely just makes sense. It takes large chunks from all of the above. So if you don't like UNIX, C, (ba)sh or awk (all of which came from Murray Hill) chances are you won't like Perl either.
  - microtherion 6y ago
    Maybe not so much C, but I saw Perl 4/5 as very attractive for sysadmin-type engineers, because it was pretty much explicitly designed to make onboarding as easy as possible for awk, sh, sed (and BASIC) programmers. Quite a few people I know got started with Perl because they were reasonably comfortable with awk, sh, or sed, started to outgrow their sweet spot, and found that perl provided a very natural transition from each of these languages, could do everything those scripts could do in fairly similar ways, and was obviously more powerful.

deleted 6y ago

[deleted]

Tomte 6y ago

Why is TCL out? Is it about a perceived bad track record or about inherent properties of the language?

fuball63 6y ago
I'm also curious as to what the "security" issues are that TCL would be rendered "out".
rwmj 6y ago
I guess the general answer is that everything is out because they have a lot of Perl already and not a lot of developers so why waste that time rewriting everything? Having said that I wrote a bunch of Tcl last year for a speech[1] and the Tcl community is nowadays very small. It was hard to find answers to some questions online: the active period of the community predated Stackoverflow so there's not much on SO. And the library support is very thin compared to the giant Perl/Python/Javascript/... communities. None of these things are reasons why Tcl is bad - I happen to like it and my talk was a success partly because of Tcl - but it may be a problem for OpenBSD to adopt it. [1] https://www.youtube.com/watch?v=9E5A608xJG0 https://www.youtube.com/watch?v=9E5A608xJG0
- Tomte 6y ago
  I meant specifically about security. Because everything is a string?
  - rwmj 6y ago
    I doubt it's much different than Perl. Both languages have very loose type systems. In fact the internal implementations are rather similar since both use strings but optimize numbers (IVs etc in Perl which are visible to the programmer, in Tcl the bytecode interpreter optimizes ints/floats to an internal representation but at the language level everything still looks like a string). Perl's tainting feature is the only security-related advantage over Tcl that I can think of right now, but it's not used unless you explicitly enable it.
  - 6y ago

qalmakka 6y ago

Perl 5 is in my humble opinion a really convenient to have installed. I use it all the time as a replacement for those shell scripts that become too big or too cumbersome, or to remove out of the equation the quirkiness of different implementations of standard tools (i.e. GNU sed has certain flags that BSD does not have, gawk is different from mawk, etc). A Perl onliner is often faster and works the same way pretty much everywhere.

flyinghamster 6y ago
That's exactly how I treat Perl as well. Things like lists and hashes make it easy to do things that are difficult or impossible in bash. If my bash script gets much beyond simple looping, I switch to Perl.
- benbristow 6y ago
  Why Perl over Python though? Most Unix distros come with Python bundled and Python has a bigger ecosystem of libraries etc available. And it's generally easier to read/write.
  - thesuperbigfrog 6y ago
    >> Python has a bigger ecosystem of libraries etc available. CPAN (http://www.cpan.org/index.html http://www.cpan.org/index.html) is quite large and has libraries to do almost everything you can imagine. I am not sure if CPAN or pip has more libraries though. >> And it's generally easier to read/write. Python looks nicer, but not everyone likes significant whitespace. The Python 2 to 3 change has also caused some adoption issues. The Perl 4 to 5 happened quite a while ago. Perl 5 has been integral to Unix-like systems since the web went mainstream.
    - aryonoco 6y ago
      Yeah and the Perl 5 to Perl 6 move... oh wait...

jedimastert 6y ago

> - you need something under and acceptable licence, so python is out. I'm not familiar with these types of things, can someone shed some light on this comment? > awk would kind of work, except it's not that readable I don't think I've ever heard someone say a plus side of perl is it's "readability". And this is coming from someone who really enjoys perl

dijit 6y ago
Marc Espie elaborates a bit on this in another post on the openbsd-misc mailing list[0]: > As for the license, python’s license appears fairly similar to Perl’s artistic license. I would worry a bit about the strong terms in >> 6. This License Agreement will automatically terminate upon a material breach of its terms and conditions. > for which no equivalent is visible in Perl’s license. [0]: https://marc.info/?l=openbsd-misc&m=157781106212088&w=2 https://marc.info/?l=openbsd-misc&m=157781106212088&w=2
- kungato 6y ago
  What the hell is this? Is this even legal? Aren't these completely different concepts?
  - masklinn 6y ago
    Why wouldn't it be legal? edit: why the downvote? It states explicitly that the license is only granted as long as its requirements (T&Cs) are upheld. Which seem obvious to me, assuming the license does have conditions? Though I guess it's less obvious to the legal profession as the MPL has a similarly explicit clause (5.1, and 5.2 also terminates the license if you initiate patent infringement litigation against "against any entity", which seems oddly broad)
- luckylion 6y ago
  What exactly does that part mean? If you're in violation of the license, you cannot correct the violation and be compliant again, but the license will be revoked immediately and there's nothing you can do about it? It's strange though, they also have > 8. By copying, installing or otherwise using Python 3.8.3, Licensee agrees to be bound by the terms and conditions of this License Agreement. which feels very 90ies-EULA-style. If I download ("copy") an archive that contains Python, I should be bound by that License Agreement? Since there's not severability clause, wouldn't that just void the limitations they've set?

teddyh 6y ago

There are many who call GNU people license zealots, and who imagine that GNU somehow shuns BSD licences. But the opposite is true! GNU people happily use BSD licensed code, and include BSD licenced code in the GNU “free software” term, while it is the BSD people who, as can be seen here, reject software like Python and GCC for having “unacceptable” licenses.

deleted 6y ago
[deleted]
posix_me_less 6y ago
GNU/GPL folks are zealots about user freedoms, not license. Linux leadership (accepting GPL) are less zealotic about user freedoms, but sometimes are zealots about keeping control (rejecting to play nice with the OpenZFS project). BSD people are zealots about getting rid of GPL code so that their product can be used by some stranger in a proprietary way. There is money both in working on GPL software and more liberal licenced software (GPL variants), but it seems everything is set up so that the two camps must not directly cooperate.
eitland 6y ago
You can always combine BSD code with your GPL and release the code as GPL. You cannot however mix GPL code into your BSD code and the resulting work as BSD.
- nix23 6y ago
  >You can always combine BSD code with your GPL and release the code as GPL That is completely wrong, you cannot change the license at your will ESPECIALLY from BSD to a GPL. The BSD-Code stays BSD-licensed-code, you can include it into a GPL Project, but NOT change the License, doesn't matter if its from BSD to GPL or vice versa. Since your not the owner of the code, you have absolutely NO right to change the license.
- greggyb 6y ago
  As the sibling mentions, you cannot re-license code you do not hold copyright to. That said, you're very close to the mark. GPL applies to distributions of the copyrighted work and executables based on it. So, the concern is around an OpenBSD release - they are shipping a full OS with source code and compiled work product. The GPL is "viral" in that you cannot make this release without licensing your whole distribution as GPL. OpenBSD does not want to be GPL, and so does not include GPL-ed code in base. The inverse is not true. A Linux distribution can include GPL and BSD-licensed code easily, because the BSD license imposes no constraints on redistribution.

lmm 6y ago

How is TCL less secure than Perl? I've seen a lot less weird surprises in TCL code than Perl code.

microtherion 6y ago
* In my recollection, Tcl relies a lot on string interpolation and run time evaluation, both of which carry some risk. * Perl has a built in taint checking facility which is quite good at preventing the naive use of non-vetted user data; I don't recall whether Tcl has anything similar. https://perldoc.perl.org/perlsec.html https://perldoc.perl.org/perlsec.html
sigzero 6y ago
Tcl is not less secure than Perl.

econcon 6y ago

I've never written a single line of but written python, bash and c and go. I am not sure how important perl is.

pferde 6y ago
So why write this comment? What is your comment adding to the discussion? Knowing when to shut up is a valuable skill to have.
mfontani 6y ago
I would strongly recommend you do learn Perl 5 (and Raku, and Haskell, and lua, and functional languages, and ...), even if only to be able to know enough about them to be enlightened about what each of them gets right and wrong. For Perl 5, you could do worse than going through the _free_ "Modern Perl" book, at http://modernperlbooks.com/books/modern_perl_2016/ http://modernperlbooks.com/books/modern_perl_2016/
- IggleSniggle 6y ago
  Thanks for recommending this book. Mostly I write TypeScript day-to-day, so naturally I typically reach for nodejs when I want to "upgrade" a script from bash to a more expressive language in a cross-platform way. I've been frustrated with that tooling, however, for a whole bunch of reasons, at lot of it to do with how clunky nodejs actually is in shell pipelines. I've thought about reaching for python, but it has some similar issues to nodejs: you need a particular environment, and some things which ought to be natural in a shell environment just...aren't...in python. I think someone here suggested Lua, and I just...don't care for Lua (although I haven't tried it in a scripting-like context). Anyhow, I've been reading this for a half-hour or so and I'm struck by how incredibly similar common Perl idioms feel to JavaScript as it is commonly used today. I think part of this familiarity has to do partly with type coercion, partly with destructing assignments, partly with function "context"(as in Perl) as it is commonly deployed in the nodejs ecosystem, partly because of the way default arguments and function passing relates to the default scalar variable in Perl. I've been playing around with OCaml and Rust a bunch recently, but haven't had any good reason to reach for them "in real life." The fact that Perl is "everywhere" (much the way JavaScript is "everywhere" as a side effect of browsers being ubiquitous), means that I'm likely to start reaching for Perl instead of nodejs when I need to move beyond Bash. It really does seem to be the right tool for the job. So, a hearty "thank you" for the recommendation.

cutler 6y ago

Coz Perl rocks. Long live The Camel.

fpoling 6y ago

It is interesting that PHP is ruled out as insecure. I am not sure that for system administration tasks modern PHP is particularly worse than Perl and these days more people know PHP than Perl.

captn3m0 6y ago
Yeah, for scripting, PHP can easily be more readable, especially because of its amazing (sometimes confusing) Standard library. It lets you parse INI files in a single call for eg.
- tankenmate 6y ago
  As does Perl if you use Config::Inifiles or Config::INI::Reader (depending on whether you want a full blown solution or just a quick INI file => hash solution).
dtech 6y ago
Yeah, quite weird. PHP as a webserver has a large amount of known language design things which decreased security (most have been removed over the years afaik), but for scripting? I can't think why it's particularly insecure compared to Python or Perl.
- acomjean 6y ago
  perhaps its built in web server? python has that too though.
aganame 6y ago
No, it's not interesting at all. PHP is fairly good at web things, but that's it.
- acomjean 6y ago
  I use php for small scripts that need to read csv and database lookup from the command line. It has built ins for these that work without any environment setup which is great sometimes. Perl has some easy oneliners too. Depending on where I'm working sometimes I don't want to set up an environment.

tyingq 6y ago

My guess is that it's because Perl is very comfortable for a team that mostly writes C on a Unix like platform. The general syntax, operators, etc, are close, and familiar things like stat(), gethostbyname(), etc, work almost the same. Edit: One of their Perl scripts for reference: https://github.com/openbsd/src/blob/b66614995ab119f75167daaa7755b34001836821/libexec/security/security https://github.com/openbsd/src/blob/b66614995ab119f75167daaa... And pkg_add, which has quite a lot of Perl: https://github.com/openbsd/src/tree/master/usr.sbin/pkg_add https://github.com/openbsd/src/tree/master/usr.sbin/pkg_add

juangacovas 6y ago

A pretty amount of tools still use Perl under the hood and I'm pretty sure some of the "granted, they just work" tools that we're used to be just there or install, use Perl in some way. Two examples I can give in my case are the good old rsnapshot, and CSF firewall

mfontani 6y ago
GNU Parallel is also a very useful tool, and it's written in Perl 5.
- xyproto 6y ago
  A useful tool with a highly annoying message to the user if you're using Fedora.
  - mfontani 6y ago
    That's odd, but interesting. What warning? Is it Fedora-specific?
    - xyproto 6y ago
      It's specific to the tool, but most distros disable the message. > If you want GNU Parallel to be maintained in the future, and not just wither away like so many other free software tools, you need to help finance the development. etc For more details, check out the Arch Linux patches that patch this super-annoying message out: https://git.archlinux.org/svntogit/community.git/tree/trunk?h=packages/parallel https://git.archlinux.org/svntogit/community.git/tree/trunk?... The message appears every time when using GNU parallel unless a very long flag is given or the executable has been patched. I think it goes against the philosophy of most open source software that comes with Linux distros, where you are given software freely, but pay back by contributing to the overall open source community, if you can and want. (This is my subjective interpretation of the matter).
      - 6y ago

pvaldes 6y ago

If you had used Postgresql you may be familiar with psql, createdb, createuser or pg_createcluster. All are perl scripts. So if you remove Perl, either you renounce also to include Postgresql in your distro, or you would need to rewrite a non trivial amount of scripts in a different language to restore Postgresql support.

dchest 6y ago
This post is about base system, which doesn’t include postgres. Obviously, if you don’t have Perl in the base, Postgres package could just include Perl as a dependency.
- pvaldes 6y ago
  Then it is a different problem. Thanks for the clarification.
tyingq 6y ago
Is postgres in the base distribution for any BSD or Linux distribution? I'd assume it would just have a dependency on Perl.
anttisalmela 6y ago
createdb, createuser and pg_createcluster are not part of the PostgreSQL, but part of the postgresql-common packaging for Debian compatible distributions: https://salsa.debian.org/postgresql/postgresql-common/-/tree/master https://salsa.debian.org/postgresql/postgresql-common/-/tree...

danieldk 6y ago

I have never programmed Lua, but it also seems to fit the bill fairly well. - Acceptable license? MIT - you need something that builds everywhere. It probably does? At least it compiles with Turbo C 1.0. - Modicum of security: probably. Lua is also small compared to Perl, is easily embeddable, and seems to have a sane syntax compared to Perl. I do understand why they use Perl though, probably more OpenBSD developers/users are familiar with it.

tyingq 6y ago
I suspect they would need the lua-posix extension, which appears to be maintained by a fairly small number of people. Lua doesn't have some basic stuff they would want, like stat(), chmod(), sleep(). Edit: Sort of makes me wonder why a VERY C-like, small, dynamically typed, scripting language never emerged. Squirrel is kind of close, but not quite what I mean.
- thesuperbigfrog 6y ago
  >> Sort of makes me wonder why a VERY C-like, small, dynamically typed, scripting language never emerged. Csh (https://en.wikipedia.org/wiki/C_shell https://en.wikipedia.org/wiki/C_shell) was the de facto standard shell on many Unix systems and still is widely used. However, it has some issues: http://www.faqs.org/faqs/unix-faq/shell/csh-whynot/ http://www.faqs.org/faqs/unix-faq/shell/csh-whynot/ https://www.grymoire.com/Unix/CshTop10.txt https://www.grymoire.com/Unix/CshTop10.txt
heinrichhartman 6y ago
Standard library is another factor. Lua does not come with any batteries. Even sockets are an external dependencies. So you would need to ship (and maintain) a lot of libs.
trasz 6y ago
That might me the direction FreeBSD follows. It started with integrating Lua into the bootloader, replacing Forth. There’s now also the userspace flua(1) interpreter, used in a few places in the build system, IIRC.

bjarneh 6y ago

It's nice to read something positive about Perl again

tosh 6y ago

context: the start of the thread is about the base system > I was wondering if I need the package manager in the minimal installation of the system as I only use built-in deamons (httpd, sshd) and UNIX utilities (vi, sed)? By package manager I mean pkg_* executables as well as its dependencies (most notably Perl). (The size of /usr/libdata/perl5 is about 50MB on my machine). I just want the minimal installation without any unnecessary scripting language. > Looking at FreeBSD for a moment it seems like Perl left the base system in May 2002 (18 years ago) https://marc.info/?l=openbsd-misc&m=159005284016345&w=2 https://marc.info/?l=openbsd-misc&m=159005284016345&w=2

pwdisswordfish2 6y ago

OpenSSL/LibreSSL still requires Perl to compile. Normally I do not have Perl installed, to conserve space. NetBSD thankfully has always done without a large scripting language, only recently have they included Lua. I wonder how long it would take to rewrite the OpenSSL perl scripts in lua.

clort 6y ago
> recently 10 years ago
- pwdisswordfish2 6y ago
  First 17 years without a scripting language.

anthk 6y ago

Perl5 is pledged.

notaplumber 6y ago
No it's not. It has language bindings for pledge(2), which is different. There can be no one size fits all pledge for an interpreted language like perl, as programs can make arbitrary calls to anything they want. But those programs can use pledge, as long as they consider the requirements of the runtime itself. http://man.openbsd.org/man3p/OpenBSD::Pledge.3p http://man.openbsd.org/man3p/OpenBSD::Pledge.3p
- anthk 6y ago
  That's what I wanted to mean, sorry. OFC an interpreter itself can't be pledged.
  - notaplumber 6y ago
    Saying something is pledged has a very specific meaning. And in this context, has no relevance to the discussion as none of the perl components in base make use of these bindings.

CalChris 6y ago

you need something under and acceptable licence, so python is out. Can someone explain the difference here? OpenBSD is BSD licensed [1]. Python is a BSD-style, permissive free software license which is compatible with the GNU General Public License [2][3]. Licenses are always contentious, but how does this rule Python out? (Granted, the dynamic libraries technical point makes this kind of a moot question.) [1] https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html [2] https://docs.python.org/3/license.html https://docs.python.org/3/license.html [3] https://en.wikipedia.org/wiki/Python_Software_Foundation_License https://en.wikipedia.org/wiki/Python_Software_Foundation_Lic...

deleted 6y ago
[deleted]

protomyth 6y ago

I have always wondered what a scripting language designed with the values of the OpenBSD project would look like. It would interesting to sit down and think how pledge, veil, and privilege separation among other things would effect the design.

eruci 6y ago

Why not? Perl is an awesome tool for both sysadmin and web dev, two of the main tasks I use it for.