I'm glad you chose the login script, it was an excellent example.

As I started to read through it I thought I was going to have a few valid complaints - overly descriptive error messages, storing passwords in plain text, and not checking the username before opening the file (I should have known better ;-). About 10 seconds after I thought of those I saw the bullet list describing the exact same errors and how/why they should be fixed. So there's only use CGI::Carp   qw/fatalsToBrowser/; in the final example that I'm wondering about - isn't it bad to leave that in production code?

Also, one lowly typo to report - right after the second code box and before the bullet list there's a line that starts with "I went ahead and saved that in my cgi-gin"

Once again, great job.