in reply to Re: Perl Monks += TMTOWTDI
in thread Perl Monks += TMTOWTDI

Tell me, what would be the advantages of an all-controlling CPAN site?

A quality-control mechanism of some kind. Whether this is through authorized people reviewing the source code of modules or through some sort of module or author voting/ranking system. I'm aware CPAN isn't currently doing this, and it would involve a very large amount of work, but I believe it would prove advantageous.

Think of the current situation, do you conduct testing and thorough code reviews of every CPAN module you use? I do because I'm required to (and trust me, it sucks). This is a rather major problem facing large businesses wanting to use Perl. If you're wondering, oddly enough, my company's policy does not require I do this for core modules.

Replies are listed 'Best First'.
Re: Perl Monks += TMTOWTDI
by Abigail-II (Bishop) on Apr 16, 2003 at 07:38 UTC
    I don't see a relation between a centrally controlled CPAN site, and a quality control mechanism. You can now start a quality control mechanism, and for that, you do not need to modify how CPAN works. OTOH, turning CPAN into an all-controlling site doesn't make quality control happen.

    Well, I don't think it's odd for large business to do some testing before using random pieces of code downloaded from the internet before using them in their programs. In fact, I would find it odd for a business *not* to do so. Regardless whether that piece of code was written in Perl, C, Java or vi macros. Core modules are part of the main distribution, and those have been through the hands of p5p - who has a proven track record of producing good code. But Joe Random Hacker does not.

    Abigail

[reply]

      Thanks for the reply. With regards to being able to start a quality control mechanism now, are you just referring to signing the modules? If so, how would you deal with other CPAN mirrors not following the practice? Any other suggestions how to go about creating a quality-control mechanism?

[reply]
        The idea for some kind of quality contol of CPAN modules is actually quite old, but I've never done anything with it. Many people have had ideas, but it all turned out to be harder than you would think.

        But this has nothing to do with signing modules. Or CPAN mirrors following some practise. Quality control is saying "this module rocks" and "that module sucks", but then in a polite and useful way.

        Signing modules have all to do with authentication. There's no real signing going on right now, but for all modules, a MD5 hash is stored in the CHECKSUMS file in the authors CPAN directory. You could always check the MD5 hash from a module you downloaded against the MD5 hash stored on a CPAN mirror you trust.

        And of course, module authors could always leave a PGP signature of the files containing code in their module distribution.

        Abigail

[reply]

In Section Meditations