Normally a Perl program runs with the privileges of the user who executed it. The passwd program for example uses setuid to acquire writing permission to the system password file, thus allowing users to change their own passwords. This can be useful, but it can also be very dangerous. Beware that just being careful in what you do inside your setuid script doesn't always solve the problem.
Some operating systems have bugs in the kernel that make setuid scripts inherently insecure.
We will discuss taint mode in our next article. In security critical applications, random numbers are used intensely for many important tasks ranging from password generation to cryptography. This routine is not very secure. In many implementations of C, and in all version of Perl before 5.004, if a seed is not explicitly specified, it is computed from the current value of the system timer, which is anything but random. Another solution is to use a secure implementation of one of the more complicated cryptographic random number generators such as Yarrow.