Should an author be able to delete a currently-indexed distribution on the
CPAN? Yes, without reservation or exception. Open source is free, and that
freedom includes removing my consent for my name to be attached to a
publication at any time.

However, we (the CPAN community) can do a lot of things after that to
mitigate any damage. I wholeheartedly agree with transferring namespace
permissions to something that the PAUSE admins control, so any random joe
cannot claim the namespace and upload whatever he likes into it (this is an
attack vector we must keep closed).  We also need to be able to act quickly
to publish something in its place so installations pulling directly from
the CPAN do not break.  I would suggest an email alert go out to the
modules@ list (or another list, should this prove too noisy) providing
notification that an indexed module is being deleted and de-indexed.

Reply via email to