4 ms·
The reason the crypto module was using this particular deprecated feature is that it hasn't been updated at all in 8 years. The OP should have dropped it becau
by glyph 6y ago
The reason the crypto module was using this particular deprecated feature is that it hasn't been updated at all in 8 years.
The OP should have dropped it because it's unmaintained, and a maintained replacement has existed for a long time: https://cryptography.io/ https://cryptography.io/
This is an especially important consideration for security-critical libraries like cryptographic libraries.
- mywittyname 6y agoOP here, thanks a bunch for this! I will take your advice and dump the crypto library for this one.
- mehrdadn 6y agoSee, when you explain what's wrong it's so much better than just blaming the victim with "You've had 8 years"!
- toyg 6y agoOne issue the ecosystem currently has, really (and its not the only one, I believe it's difficult almost everywhere), is that tracking dependency-rot is hard. Unless something breaks outright, you'll never know if a library has been abandoned; and manually checking dozens of github/gitlab repos is expensive and tedious. Pypi has an api (https://pypi.org/pypi/<pkg-name>/json https://pypi.org/pypi/<pkg-name>/json) that can be leveraged to implement alerts like "this pkg last released 5 years ago, it might be dead!". I guess that's what the "security" package uses already. It would be cool if they added an option to report on this sort of thing.