4 ms·

> Not to mention paid FOSS developers at places like RedHat, who want to keep supporting their LTS and enterprise customers... Well RedHat annouced a long time

> Not to mention paid FOSS developers at places like RedHat, who want to keep supporting their LTS and enterprise customers... Well RedHat annouced a long time ago that RHEL 8 will drop support for Python 2 [0], so at least it appears they also want to leave Python 2 behind. RHEL7 is already receiving security fixes only [1], which doesn't look like a huge "support" effort to me. Especially, behavior bugs and ports of Python 3 features to python 2 won't be done. [0] https://www.phoronix.com/scan.php?page=news_item&px=RHEL-8-No-Python-2 https://www.phoronix.com/scan.php?page=news_item&px=RHEL-8-N... [1] https://access.redhat.com/support/policy/updates/errata#Maintenance_Support_1_Phase https://access.redhat.com/support/policy/updates/errata#Main...

em500 7y ago
> RHEL7 is already receiving security fixes only [1], which doesn't look like a huge "support" effort to me. Nobody expects new features in python 2.7, so this is basically all the support that people are looking for. RHEL7 will have security maintenance till Jun 2024.
- PeterisP 7y ago
  As we see from the python3 switch motivation, the key support people need is support for their favorite libraries. In that regard, maintenance for python 2.7 would involve backporting security fixes also for popular 2.7 third-party opensource libraries and frameworks even if those libraries themselves have already switched to python 3 only.
  - bigiain 7y ago
    I wonder how many 3rd party Python2 libraries RHEL ships with? I wonder if Redhat have left themselves enough weasel words in their contracts to say "Oh Python2? No security updates to the interpreter! Oh, you wanted explioted-library-de-jour updated? Well that's not covered in your support contract here. Left me put you through to our professional service division. Please have your contract ID and credit card number ready when they answer - transferring you now!" I'm 99.99% certain that if you ran "pip install numpy" on your RHEL7 box, and it's infected by a cryptominer the next day due to a know vulnerabilty, Redhat support are gonna laugh you off the phone when you call them up asking what they're gonna do about it...
    - em500 7y ago
      > I wonder how many 3rd party Python2 libraries RHEL ships with? Workstation: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/package_manifest/chap-base-workstation-variant https://access.redhat.com/documentation/en-us/red_hat_enterp... Server: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/package_manifest/chap-base-server-variant https://access.redhat.com/documentation/en-us/red_hat_enterp... Search for "python" > I'm 99.99% certain that if you ran "pip install numpy" on your RHEL7 box, and it's infected by a cryptominer the next day due to a know vulnerabilty, Redhat support are gonna laugh you off the phone when you call them up asking what they're gonna do about it... If course they don't do fixes for all of pip / PyPI, nobody does/can be reasonably expected to do. They explicitly only cover what they ship (which does includes numpy and scipy, but not pandas). If you can demonstrate an exploit with just "yum install numpy" I'm pretty sure they'll work on it.

em500 7y ago

> RHEL7 is already receiving security fixes only [1], which doesn't look like a huge "support" effort to me. Nobody expects new features in python 2.7, so this is basically all the support that people are looking for. RHEL7 will have security maintenance till Jun 2024.

PeterisP 7y ago
As we see from the python3 switch motivation, the key support people need is support for their favorite libraries. In that regard, maintenance for python 2.7 would involve backporting security fixes also for popular 2.7 third-party opensource libraries and frameworks even if those libraries themselves have already switched to python 3 only.
- bigiain 7y ago
  I wonder how many 3rd party Python2 libraries RHEL ships with? I wonder if Redhat have left themselves enough weasel words in their contracts to say "Oh Python2? No security updates to the interpreter! Oh, you wanted explioted-library-de-jour updated? Well that's not covered in your support contract here. Left me put you through to our professional service division. Please have your contract ID and credit card number ready when they answer - transferring you now!" I'm 99.99% certain that if you ran "pip install numpy" on your RHEL7 box, and it's infected by a cryptominer the next day due to a know vulnerabilty, Redhat support are gonna laugh you off the phone when you call them up asking what they're gonna do about it...
  - em500 7y ago
    > I wonder how many 3rd party Python2 libraries RHEL ships with? Workstation: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/package_manifest/chap-base-workstation-variant https://access.redhat.com/documentation/en-us/red_hat_enterp... Server: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/package_manifest/chap-base-server-variant https://access.redhat.com/documentation/en-us/red_hat_enterp... Search for "python" > I'm 99.99% certain that if you ran "pip install numpy" on your RHEL7 box, and it's infected by a cryptominer the next day due to a know vulnerabilty, Redhat support are gonna laugh you off the phone when you call them up asking what they're gonna do about it... If course they don't do fixes for all of pip / PyPI, nobody does/can be reasonably expected to do. They explicitly only cover what they ship (which does includes numpy and scipy, but not pandas). If you can demonstrate an exploit with just "yum install numpy" I'm pretty sure they'll work on it.