5 ms·

I suspect that someone, or a group of people, will step up to unofficially maintain Python 2 for the foreseeable future. It's clear that there are a lot of peop

I suspect that someone, or a group of people, will step up to unofficially maintain Python 2 for the foreseeable future. It's clear that there are a lot of people using it that either can't easily migrate or are unwilling to do so for the various reasons already discussed in this thread.

takeda 7y ago
I'm sure that for the right money you can find someone. Don't forget that that person/organization would not only have to maintain python but also all the packages that you will be used.
JohnFen 7y ago
If I encounter Python 2 bugs that matter to me, I can and will fix them myself if needed, and submit or otherwise publish the change. I'm quite certain I'm not the only one.
- marcus_holmes 7y ago
  Why not just migrate to 3? genuinely curious...
  - JohnFen 7y ago
    Because of the amount of work involved in porting my existing Python code. Python 3 doesn't offer any advantages that matter to me, so that's a lot of effort for little gain.
    - marcus_holmes 7y ago
      OK, thanks. Good luck with the bug fixing ;)
      - JohnFen 7y ago
        I'm not really worried about bugs, because the code I have works well, and I doubt I'm going to do any serious new Python 2 development.
        marcus_holmes 7y ago
        I meant the bugs in your dependencies that you'll have to backport fixes to. But hey, if you're writing bug-free code that'll be easy ;)
        JohnFen 7y ago
        I understood what you meant. What I'm saying is that my existing code works fine, so whatever bugs are in the dependencies are ones that don't affect me. Should I make a code change that surfaces one, then I have the means to deal with it -- but that is almost certainly going to be a rare event, as my Python projects are stable and aren't going to see much change. I wasn't commenting on how buggy my own code is. Which version of a language I'm using doesn't really affect that variable.
        marcus_holmes 7y ago
        I get that. But the interesting thing about dependencies is how they surface vulnerabilities that can hurt code that works perfectly well. Your current code probably doesn't have many bugs, but includes an unknown number of vulnerabilities from your dependencies. The bad people probably won't bother examining your code for vulnerabilities, but they will be informed of vulnerabilities in popular libs, and then looking for projects that use those versions of those libs is a lot easier than scanning all those projects individually. So you end up having to backport a bunch of fixes to other people's code because that code was popular and came under intense scrutiny. But I guess you know this, and are OK with the compromises involved. I'll stop here ;)
        JohnFen 7y ago
        > but they will be informed of vulnerabilities in popular libs, and then looking for projects that use those versions of those libs is a lot easier than scanning all those projects individually. This is true, and if we were talking about code that is exposed to the world at large, then my stance might be different. However, the projects that I've used Python for are not exposed in that way. Note that I'm talking about personal projects, not work-related ones. At work, I use whatever is required.

takeda 7y ago

I'm sure that for the right money you can find someone. Don't forget that that person/organization would not only have to maintain python but also all the packages that you will be used.

JohnFen 7y ago

If I encounter Python 2 bugs that matter to me, I can and will fix them myself if needed, and submit or otherwise publish the change. I'm quite certain I'm not the only one.

marcus_holmes 7y ago
Why not just migrate to 3? genuinely curious...
- JohnFen 7y ago
  Because of the amount of work involved in porting my existing Python code. Python 3 doesn't offer any advantages that matter to me, so that's a lot of effort for little gain.
  - marcus_holmes 7y ago
    OK, thanks. Good luck with the bug fixing ;)
    - JohnFen 7y ago
      I'm not really worried about bugs, because the code I have works well, and I doubt I'm going to do any serious new Python 2 development.
      - marcus_holmes 7y ago
        I meant the bugs in your dependencies that you'll have to backport fixes to. But hey, if you're writing bug-free code that'll be easy ;)
        JohnFen 7y ago
        I understood what you meant. What I'm saying is that my existing code works fine, so whatever bugs are in the dependencies are ones that don't affect me. Should I make a code change that surfaces one, then I have the means to deal with it -- but that is almost certainly going to be a rare event, as my Python projects are stable and aren't going to see much change. I wasn't commenting on how buggy my own code is. Which version of a language I'm using doesn't really affect that variable.
        marcus_holmes 7y ago
        I get that. But the interesting thing about dependencies is how they surface vulnerabilities that can hurt code that works perfectly well. Your current code probably doesn't have many bugs, but includes an unknown number of vulnerabilities from your dependencies. The bad people probably won't bother examining your code for vulnerabilities, but they will be informed of vulnerabilities in popular libs, and then looking for projects that use those versions of those libs is a lot easier than scanning all those projects individually. So you end up having to backport a bunch of fixes to other people's code because that code was popular and came under intense scrutiny. But I guess you know this, and are OK with the compromises involved. I'll stop here ;)
        JohnFen 7y ago
        > but they will be informed of vulnerabilities in popular libs, and then looking for projects that use those versions of those libs is a lot easier than scanning all those projects individually. This is true, and if we were talking about code that is exposed to the world at large, then my stance might be different. However, the projects that I've used Python for are not exposed in that way. Note that I'm talking about personal projects, not work-related ones. At work, I use whatever is required.