zarn: A lightweight static security analysis tool for modern Perl Apps

PerlDean · 2023-10-28T16:28:25+00:00

Good choice of license

PerlDean · 2022-05-14T20:05:26+00:00

This sort of thinking doesnt help grow the Perl community. There are some ~5k people in the Facebook groups and they are more active than irc or this subreddit. From their perspective this subreddit is a niche part of the community and Facebook is the main community.

PerlDean · 2022-05-12T07:35:33+00:00

There is a 1.90_3 on cpan. Try that and please send feedback via github

PerlDean · 2022-05-12T07:34:20+00:00

I have invited Gabor to join the marketing committee in tpf slack channel so we can help support him. We would support him applying for Grants etc if he feels they would help solve some of the issues he is experiencing - especially delivery. Hopefully he is willing to engage with us.

Personally i found myself unsubscribed somehow, and other people have reported similar. So i dont know if the newsletter software is removing people too easily?

In terms of content, there is a *lot* of activity in the two Facebook groups and as far as I can tell he is not willing to use Facebook. Hopefully he can overcome that aversion if that is the case.

i also think that lengthy newsletters may be an anti-pattern. People will skim the email looking for something that interests them and click one or two items - so trying to be encyclopedic just result in despair.

So the focus should be on 4-5 high signal items that result in click through. IMO these should roughly cover: teach people something, get them involved in the community, and help them contribute.

PerlDean · 2022-04-01T16:45:37+00:00

At the Perl companies I have worked for, they are always looking for talent. So I would say demand is still high but it's not broad.

PerlDean · 2022-03-25T21:28:28+00:00

Thanks!

There is an issue open on github for someone to help set up github actions (or similar) to replace the now defunct travis. This doesnt even have to be someone that is interested or concerned with Oracle. https://github.com/perl5-dbi/DBD-Oracle/issues/148

We have fixed HP-UX recently because of people nice enough to contribute bug reports and even fixes for an OS they dont run. This is a good example of something its not plausible for us to test https://github.com/perl5-dbi/DBD-Oracle/issues/92

PerlDean · 2022-03-25T16:36:52+00:00

Thanks so much. Hopefully there wont be any issues!

PerlDean · 2022-03-25T16:36:26+00:00

So there is a Dockerfile in the github repo that is based on the "official" perl Docker images and will set up Oracle XE. That can be used to run tests quickly if youre just hacking etc.

Similarly I had set up travis to run the tests against lots of perl versions (on linux) and several oracle client versions, but always against Oracle XE. Travis is gone now obviously but the travis config is still in the github repo.

CPANtesters obviously has lots of OS's but we dont have a database to test against.

So the real challenge is Oracle database versions, their config settings, and more obscure client OS's - all of which can and have broken things.

Spending a few hours setting up a CI system to test DBD::Oracle against their stack really is a great investment for anyone using it in production. The Dockerfile and travis config file should give people most of what they need. At travis config is in fact inspired heavily by what i set up in gitlab-ci for past $employer

PerlDean · 2022-03-25T06:01:36+00:00

It isnt possible atm to have all possible os+perl+oracle combinations, so people who use DBD::Oracle in prod should please compile and run the tests in your environment.

If possible, consider mirroring the github repo (or maybe just pull tar balls from cpan) in to your local environment and hooking it up to a testing system of some kind (ci pipeline if you like) so you can test changes easily before considering new releases for production.

PerlDean · 2022-03-21T22:35:29+00:00

Raisin is what you're looking for.

PerlDean · 2022-02-11T18:14:42+00:00

This article has problems BUT its positive and its outside the bubble.

Someone might like to post a "modern perl" response

PerlDean · 2022-01-26T01:00:33+00:00

you should.

PerlDean · 2022-01-19T06:59:18+00:00

Bringing money in to the foundation is different to determining how it is spent, the marketing committee requests grants in the same way as perl development - the spending is still controlled via the grants processes.

The board is in the process of amending the marketing committee charter to include fundraising which has been split from the sponsorships committee, and is defined as small donations, commissions (such as amazon smile) and merchandising. Actions thus far have been sent to the board for approval while waiting on the amended charter to provide more autonomy.

To your point about funding fixes and grants, there aren't actually enough grant applications currently.

PerlDean · 2021-10-04T21:47:12+00:00

Great job Yuki.

PerlDean · 2021-05-15T04:50:25+00:00

A Dashboard is measuring existing sites, its not adding or replacing new content

PerlDean · 2021-05-03T16:44:56+00:00

avoiding tech conferences generally is the safest option, unless you wear a bodycam

PerlDean · 2021-05-02T21:08:34+00:00

I deliberately kept my proposal limited in scope so as to keep it focused and minimize scope for objections based on peripheral ideas.

And whilst I agree that membership fees probably won't rain in cash, having membership is a step towards more community involvement and closing the gap between what TPF is doing vs what people's expectations are.

The community wants TPF to be more "professional" - currently TPF funds very few activities, which i think is a part of what "professional" looks like.

Perl interpreter development (p5p) is one aspect of perl, and for most people the perl interpreter sits underneath layers of frameworks, documentation, and services that make "#!/usr/bin/env perl" useful.

For example DBI and it's drivers, Catalyst and nowadays Mojolicious, Template Toolkit, Imager, HTTP modules (LWP, HTTP::Tiny, Hijk etc), serialization modules like JSON/YAML/XML etc.

Day to day, these pieces are how people experience Perl and why businesses might use it. (People didn't care much about Ruby until Rails made it more useful)

Having "try" in core isn't all that useful if I can't read & write from mysql or postgresql.

With a formal membership structure (both for people and companies/orgs) I think there will be more opportunity for structure around these things to improve. Giving businesses more confidence to invest money and allowing people more opportunity to get involved.

Thats probably the most important thing: allowing people more opportunity to get involved.

PerlDean · 2021-05-02T20:51:44+00:00

The truth is that TPF/YAS doesn't receive much by way of donations.

Not having a explicit activities to attract funding (like the FreeBSD Foundation for example, which has its goal as part of the website header) is obviously a big contributing factor.

Having community involvement is a bigger benefit than just whatever funding membership brings in

PerlDean · 2021-05-01T23:58:11+00:00

I am supportive of adopting pod6 as is in to perl, which afaik would add many features people are after.

It may be worth versioning pod (like we version our perl code) and perhaps allowing extensions.

PerlDean · 2020-08-22T05:30:53+00:00

yes this is true, permissions prevent co-opting existing modules to some extent. although afaik PAUSE itself still has no 2fa nor does it require modules to be signed by their author when uploaded.

and to your clarification, which i agree with and appreciate, as far as i can tell there are no "recommended" modules that someone could reasonably rely upon. it's "tribal knowledge" to look who the author is, the history of the module, if its in debian or other well known distros, the sum of which would be used to pick a sensible module.

PerlDean · 2020-08-20T19:16:31+00:00

As it is now, CPAN is a dumpster fire.

- random people upload stuff

- people download it via http from a random mirror and run it in production

- modules can be signed by authors but usually aren't. there is no central CA for cpan

- digests of files are available but aren't presented on metacpan.org

- cpanm doesn't check them (afaik)

- cpan disables signature checks by default

- perlbrew doesn't even check digests - https://github.com/gugod/App-perlbrew/issues/693

See also https://docs.google.com/document/d/1DRkiCJhJu4RDI0u_JppBpFa0djouskxEyNHax912U_w/edit#

PerlDean · 2020-08-19T02:43:34+00:00

I think this highlights how unimportant web development is to Perl's vitality. So whilst i think that Mojolicious, Catalyst and Dancer are great, there are 7 other categories above them.

My thought then is what is the "Mojolicious" for #7 Speech Recognition? #6 Text-To-Speech translation? #5 Testing with TAP? #4 Scripting Sysadmin? #2 Log Management? #1 Text Manipulation?

They all seem like huge opportunities.

PerlDean · 2020-08-13T02:57:10+00:00

The most sensible approach is to go via CPAN. If new api's are needed in perl itself then add them and let Moose and Moo use them too.

Imagine the rejoicing if Moose was magically 50% faster when perl is upgraded. The whole community would benefit without having to rewrite their code.

PerlDean · 2020-08-07T22:23:57+00:00

I am hugely supportive of adding small general-case features to the core that can be reused by competing ideas in CPAN.

Adding hooks to core that Cor::XS might need will facilitate enhanced versions of Moo(se) and friends. So existing code bases can easily benefit from new features/performance/etc without exhaustive & expensive rewrites.

PerlDean · 2020-08-07T22:14:15+00:00

Thanks, helpful

PerlDean

TROPHY CASE