Back in April the #Perl NOC turned off the #CPAN mail forwarding.

https://log.perl.org/2026/04/cpanorg-email-forwarding-has-been-shut.html

If you're like me, you've been using that for 25+ years, and it's everywhere (and unfortunately that includes spammer lists).

Here's what you can do in the meantime, via @timlegge @cpansec

https://security.metacpan.org/2026/06/14/cpan.org-email-forwarding-shutdown.html

I have a question about potential #Perl search modules to use.

Search::Xapian is no longer being actively maintained.

Lucy is retired.

Are there good replacements?

CPANSec @cpansec has revised our default disclosure dates

#Perl #CPAN #infosec

https://security.metacpan.org/docs/revised-disclosure-delay

What's worse than an inconsistent API?

How about one that doesn't behave as documented?

What's worse than that?

Getting AI slop response from support that ignores the question and refers to the incorrect documentation.

Oddly enough, the logo for Drive is still a triangle, which is the symbol for danger.

I get a notification from Drive and wonder that something is wrong with my phone.

So Google decides to rebrand and change the app icons again... and I will be confused for a few days because marketing is more important than usability.

I've uploaded a prototype module for generating and parsing metadata about software #AI and automation policies, based on ideas from the #Perl Toolchain Summit in April.

The idea is to have machine-readavle information about how code is generated, what kind of automated contributions are handled are allowed, and what kind of automation the maintainers of a project use.

There's a draft spec at https://github.com/CPAN-Security/cpan-metadata-v3/blob/main/automation-policy.md but it's already out-of-sync with the Perl code.

Ideas and feedback would be appreciated.

https://metacpan.org/release/RRWO/Dist-AutomationPolicy-v0.1.0

#CPAN

Enough of my neighbours have Ring cameras on their doors that yesterday I set off a cascade of chimes as I walked down the street, like a passing digital breeze.

"575 Pull Requests in Three Weeks: What Happens When #AI Meets #CPAN Maintenance"

This is an interesting read, including the comments.

https://blogs.perl.org/users/todd_rinaldo/2026/04/575-pull-requests-in-three-weeks-what-happens-when-ai-meets-cpan-maintenance.html

#Perl #LLM #Claude

https://metacpan.org/release/RRWO/Perl-Critic-Policy-Security-RandBytesFromHash-v0.1.1

I've uploaded a new version of the #Perl Critic policy.

I've uploaded a new #Perl Critic policy that checks code for naive random data generation from a hash over not-so-randonm sources like rand(), system time, pid such as

md5_hex( rand . time . $$ . ++$counter )

This anti-pattern is used in many places, and has been the reason for several CVEs.

https://metacpan.org/release/RRWO/Perl-Critic-Policy-Security-RandBytesFromHash-v0.1.0

#CPAN #security

As a scholarly aside, I am curious as to who first came up this anti-pattern.

#TIL that

both My Neighbor Totoro and Grave of the Fireflies were released on the same bill in 1988. The dual billing was considered "one of the most moving and remarkable double bills ever offered to a cinema audience".

https://en.wikipedia.org/wiki/My_Neighbor_Totoro#Releaae

I'm not sure that I could have watched both films in the same sitting.

MetaCPAN @metacpan now displays security advisories when you are viewing a module with advisories.

#Perl #CPAN #security #infosec #CVE @cpansec

Alas, it would be nice in #Perl to be able to write

my $result = something() and return $result;

Using

if ( my $result = something() ) {
return $result;
}

doesn't feel as nice.

Or maybe I'm just brain-damaged from writing too many shell scripts.

I've released a new version of the #Perl module Hash::Util::Merge to #CPAN.

This module lets you merge hashes by applying a function to each value per key.

This version allows you to merge an arbitrary number of hashes

https://metacpan.org/release/RRWO/Hash-Util-Merge-v0.3.0

As much as I like the #Perl built-in try/catch syntax, I do not like the following:

my $result;
try {
$result = ...
}

Putting it in a do expression just seems messy

my $result = do {
try {
...
}
}

I've been playing with @Waterfox for a few days.

Ad blocking does not work as well for Waterfox though. Enough that for now I will switch back.

I've imported all of my Firefox plugins and settings. Compared the settings manually. I'm not sure of the problem.

I'm at a cinema. The film just stopped in the middle. After a minute wondering if it was part of the story, we realised something was wrong.

It's 2300 and I wandered around an empty theatre looking for employees. Nearly empty. Spooky, even. Made me wonder if some disaster happened while we were there.

Finally found an employee and told them what happened.

Went back in the room. Everyone is on their phone. There are loud unhappy voices coming from the projection room.

Lights came on. Manager said the projector "fully shut down as if it's had enough" but they are trying to restart it in ten minutes.

This might be the best part of the film.

Supermarkets requiring loyalty cards to get the better prices is pretty vile.

But requiring shoppers to use an app instead is worse.

My muscle memory acts as if #bash auto-completion adds a space after a command.

It's no longer doing that on #Debian 12.

It still does that on Ubuntu, so I know I'm not completely mad.

Has something changed in a recent Debian update in the past few days? Is there a setting to change?