我怎么知道我是否可以信任CPAN模块

Question

I am just thinking before I install and use a CPAN module how do I know if it is safe to use it.

Anyone else has the same concern ?

Thanks

Answer 1

There are various sides of being "safe to use":

• Can I trust it, eg might it be malicious? This is the question you should also ask to your operating system, perl installation, hardware producer etc.
• Is the CPAN repository safe, eg did someone hack with the module? While some modules have a signature most don't. So you might be better with using a packed module from your OS, which often add a signature when packing the module.
• Is the module stable enough to use? For that you might look at the history, test coverage and bug statistics, eg does the author even care about the module any more or was it abandoned years ago with lots of bugs open.