> What's to stop someone else backporting security patches and necessary fixes as needed ad infinitum? Nothing, it may even prove to be a business model, and v

> What's to stop someone else backporting security patches and necessary fixes as needed ad infinitum? Nothing, it may even prove to be a business model, and vendors like Red Hat may be forced to do that anyway. But back-porting security fixes to core Python 2.7 is one thing, but for many 3rd party libraries? Especially if they're GPL'd? That would take a coordinated effort, which again might happen, but hasn't materialized yet. So betting on that seems risky at the moment. Python 2.7 EOL has been public knowledge for quite a while (and even pushed out once before). True, it is very convenient to forget about, and hope somebody else will sort out your tech debt.