I believe you _can_ do it without good specs (we all do, I am sure). But, it always tends to lead to some problem or another. At my last "real" position (which I left partly for this reason) my Project Manager (I use the term very very loosly) was terrible at giving specs. She would give me printouts with pen marks and say "Make it look like this". Well, you couldn't since there were about 50 things that needed to be done in the background to make that happen, which are what specs are for. I would say back "No, when you give me specs I will make it happen". Would she get me specs? Nope. "Kevin, how is that project going?", "I don't know, you tell me. Where are the specs I asked for?". So, basically I would push back at my manager to do her job, so I could adequately do mine.

Do most Web development companies take security seriously, or is it treated as an afterthought?

I think this varies from company to company. When I worked for DEC, we were very secure. The job I spoke about above, we were very secure (I implemented the security model). At my current place of employment, it is very important. A few consulting places, it wasn't. The best way to make sure things are secure is to simply do it while programming. A CIO, or IT manager may not as for 'tainting', so you just have to do it yourself. Why wait to be asked to do it? Just Do It! (I hope Nike doesn't sue me).

Is your company averse to installing CPAN modules, even if they have been reviewed carefully?

Not this company, or any other I have worked for.

o you have a job for a Portland, OR monk ;)

Maybe if that Monk wants to move to Floriduh. (No positions at this moment, but I know some will be created next year)

Generally, whenever I have walked into a new company and looked at the Perl code, I have been disgusted. I generally hear things like "That was first written by (SA's|C Programmers|Monkeys) and never updated, since it worked." Then, I promptly start redoing things, because I can't stand it (and find holes). Many people, I think, have Perl in their toolbox in case they need it but don't know how to use it properly. For example, I have a faucet wrench thingy in my toolbox. So, when I had to change a faucet I took it out thinking "This is the perfect tool for it." But, I don't really know how to use that wrench, so I did a terrible job with it. It took me likely 3 times as long, much more cussing, and less red knuckles than someone who actually knows how to use it. AND, it leaked after a day so I had to call a plumber anyways. Perl has the curse of being able to do a lot, by knowing a little. So, crap code and the like are easy to create. I fear it is something that we have to live with, and try to help cow-orkers, and the company to realize the benefits of good, solid, quality code.. as well as what developers need to create it.

Cheers,
KM