Oh, I know and I specifically thought of mentioning MSA but the CPAN was a better comparison for what I saw. This was c 2003 and it wasn’t some lone dude’s awful code that unwitting people were using, it was one of the PEAR packages that *everyone* was using while also putting passwords in GET query strings as a standard practice. I know the community and code improved since then but a lot of the training wheels without the bike critique of PHP still applies.