22 ms·

The risk of unpatched vulnerabilities between now and the next "major release" far exceeds the risk of inconveniencing anyone foolish enough to rely on the syst

The risk of unpatched vulnerabilities between now and the next "major release" far exceeds the risk of inconveniencing anyone foolish enough to rely on the system Python 2.7 installation.

necovek 5y ago
What server-oriented GNU/Linux distributions do is to keep patching those vulnerabilities themselves. If they need to do it for a year, it's not that hard.
- nicce 5y ago
  But is it worth it actually? I doubt that this MacOS version is used on servers…
  - mattl 5y ago
    Define server. Public webserver? Unlikely for sure. Office fileserver? Absolutely. Build server? Sure.
    - nicce 5y ago
      If we go to that road, how often you need Python 2 for fileserver or build server? Now, what is the percentage of that among all MacBooks on latest MacOS out there.
      - reaperducer 5y ago
        If we go to that road, how often you need Python 2 for fileserver or build server? Monthly, for me. Or more often if, like last week, a new customer required it.
      - Wowfunhappy 5y ago
        I think this mindset is dangerous. There's a really long tail of niche things people do on their computers, such that I suspect a majority of users have at least one niche need. Especially today, when Chromebooks and iPads are available for anyone who only needs basic web browsing. If you stop paying attention to the niches, they add up to a lot of people.
        nicce 5y ago
        You are right, but I would say that this is quite extreme case. This is a programming language which support ended 2 years ago. Only reason to use it is to avoid turning old code base to new one. There are some serious questions if that is really a good approach. And if it is, why you need to use pre-installed Python 2 instead of installing it by yourself?
        Wowfunhappy 5y ago
        I expect that there are users, who are not themselves developers, who are using either apps or scripts which rely on the system-installed Python 2. They likely aren't aware that they're using Python, and they may not even know what Python is. It could be one line in one shell script block in one automator action that a coworker put together five years ago. It's okay for that stuff to break. (I wish Apple would put more effort than they do into making it break less often, but that's neither here nor there.) But, it should break in a major release, when the user is prepared for things to break. It should not break in an update that was installed automatically overnight.
- deleted 5y ago
  [deleted]
throw0101a 5y ago
> The risk of unpatched vulnerabilities If a company as 'small' as (pre-IBM) Red Hat can afford to support Python 2.7, then so can Apple: * https://developers.redhat.com/blog/2018/11/14/python-in-rhel-8-3 https://developers.redhat.com/blog/2018/11/14/python-in-rhel... * https://access.redhat.com/solutions/4455511 https://access.redhat.com/solutions/4455511 Further, if Debian has the resources to support Python 2.x, then so does multi-trillion dollar company of Apple: * https://packages.debian.org/search?keywords=python2 https://packages.debian.org/search?keywords=python2 If they wanted to announce at the June 2022 WWDC that macOS 13 wasn't going to have it, that's fine. But we're several months into macOS 12.x and such a large change is bad form.
- Redoubts 5y ago
  Maybe they can afford it, but why should they?
  - simlevesque 5y ago
    To offer a good service. To avoid breaking something the users depend on.
    - danaris 5y ago
      That's what Windows is for.
    - samtheDamned 5y ago
      Apple isn't in the business of spending excess money to avoid breaking things. If anything apple is the opposite.
    - Kalium 5y ago
      Apple supported Python 2 for two years after it was officially sunset by the Python Foundation. They've been advising that they will drop support for longer. How long is long enough to avoid breaking something the users depend on? One more year? Five years? Fifty? I think we can all agree that it's reasonable to drop support at some point, making it just a question of when and at what cost.
omnicognate 5y ago
Python 2 EOL was 2 years ago. 20 months before Monterey was released. Edit: And it hardly came out of the blue. Python 2.7 was 10 years old then and people had known they needed to get off it for years.
superkuh 5y ago
It's funny how people think old, robust software is suddenly going to spring a bunch of vulnerabilities while sitting there, static, unchanging. It's far more likely the bleeding edge python(s) are going to be getting new bugs. Old software isn't inherently more risky.
- WJW 5y ago
  Of course it's not going to get new vulnerabilities, but that doesn't mean hackers won't find previously unknown vulnerabilities that have always been there. Looking through the CVE database, core python alone has had 15 CVE reports in 2020 and 2021, and for old pythons those will never be patched. I'll never understand why people think they can write some software and it'll stay pristine forever. Even if it was had no known bugs at some point in the past, the world is a harsh place and your program, its dependencies, its programming language or even its OS can be found to be subtly broken at any moment. Even if it is not outright buggy, the world will change around you until the interfaces you depend on are no longer there. (looking at you, software program at $WORK that only works with PS/2 keyboards but not USB keyboards)
  - loeg 5y ago
    Many of those CVEs will not impact your application code, though. This is just a side effect of Python having a huge and somewhat crusty standard library.
  - Someone 5y ago
    If it is dynamically linked (probably the case, as that’s the norm on Mac OS), it might even get new vulnerabilities. The combination (old Python, new shared library) could have vulnerabilities that neither (old python, old shared library) nor (new python, new shared library) has.
  - lanstin 5y ago
    In the old days, software was like math - it had immutable, provable qualities. In the last several decades software has gradually become more and more like biology, where the core mechanisms are shrouded in mystery and we rely on observation and experiments to understand. The Star Trek game in Basic I typed into a computer is eternally true, a platonic form in a way software now no longer even aspires to be.
loeg 5y ago
I've previously worked at a vendor using Python2. Someone brought up this concern. I looked up the number of security releases we had cut in the past due to Python2 vulnerabilities -- it was zero.
- ShamelessC 5y ago
  This is the reason they are referred to as 0-day exploits and believe me, given enough time they will begin to appear.
  - loeg 5y ago
    Maybe? The timeline here is over a decade. It’s hard to imagine RCE without network facing services.
  - kortilla 5y ago
    We’re talking about a Python interpreter here. It already executes arbitrary input with the ability to write to files and make network connections. What type of vulnerability with it just sitting there as an executable do you expect?
    - ShamelessC 5y ago
      Doesn't need to be an RCE to be considered an exploit of the user's intentions. I can't fathom how people are still trying to use an EOL language or why they would even want to. Learn some new syntax, you'll live and the writing has been on the wall for like 20 years.
      - Wowfunhappy 5y ago
        I don't think a whole lot of people are writing new software in Python 2, but I think a lot of people are still running old software via Python 2. Software they didn't write themselves and wouldn't know how to modify. And that's not to say those users won't have to find something new eventually (or migrate the software to a contained environment). It just shouldn't happen in an automatically installed update.
nonethewiser 5y ago
>The risk of unpatched vulnerabilities between now and the next "major release" His point doesn't necessitate waiting. You could just classify it as a major release instead. That is not to say it should be a major release necessarily.
- Wowfunhappy 5y ago
  Right, Apple could have removed Python 2 last fall with the release of Monterrey, and I would have been neither surprised nor unhappy. I was actually kind of surprised when it was still in Big Sur.
  - diebeforei485 5y ago
    > I was actually kind of surprised when it was still in Big Sur. Removing support in the middle of 2020 would have been very unpopular.
    - Wowfunhappy 5y ago
      Then they could have done it in 2021 with the release of Monterrey. Heck, Monterrey was released before Omicron, so if we're concerned about COVID that should have been less disruptive than doing it now.
      - diebeforei485 5y ago
        This wouldn't have worked either. Lots of countries, where vaccines weren't widely available yet, were going through a huge Delta wave before and after WWDC. Now that most places have vaccines, it probably doesn't make sense to wait for the next major release because this has already been long delayed. Other factors could have also been at play - perhaps Apple Inc had a lot of internal tools on 2.X and has only recently gotten around to migrating all of those.
reaperducer 5y ago
The risk of unpatched vulnerabilities between now and the next "major release" far exceeds the risk of inconveniencing anyone foolish enough to rely on the system Python 2.7 installation. You make an assumption that the way your system and method of working is the same as everyone else on the planet. It is not. I have two tools that I use monthly which require python 2.7. The people who made the tools never updated them to work with 3. For this reason, I have a work box that I cannot upgrade. I know that Macs are aimed at end users, and not developers, but it really is getting harder and harder for me to use my Macs for the kind of work I do. Each major software update borks my virtual hosts. PHP has been removed, and because of code signing requirements, adding it back is so complicated it takes an entire day and filtering through a dozen half-baked online tutorials. No, the ones that say "Just use brew!" are not the answer unless you have a very simple job. I don't use Docker, but from what I read on HN, that's six miles of bad road, too. But as I understand the situation, that's Docker's fault, not Apple's.
- NavinF 5y ago
  The doctor says to the patient, "What seems to be the trouble?" The patient says, "It hurts when I do this." The doctor says, "Don't do that."
makecheck 5y ago
As a counter-point, my app was able to rely on the system Python 2.7 for FIFTEEN YEARS because it was an extremely stable component of the OS (and it allowed the app binary to be literally 10 megabytes). Now? I honestly can’t think of a way to release without adding something like 100-200 MB to the app bundle, consisting of an entire Python installation. With a user-facing app it is not ideal to try to say something like “just download Python and tell me where it is”.

The risk of unpatched vulnerabilities between now and the next "major release" far exceeds the risk of inconveniencing anyone foolish enough to rely on the system Python 2.7 installation.

necovek 5y ago

What server-oriented GNU/Linux distributions do is to keep patching those vulnerabilities themselves. If they need to do it for a year, it's not that hard.

nicce 5y ago
But is it worth it actually? I doubt that this MacOS version is used on servers…
- mattl 5y ago
  Define server. Public webserver? Unlikely for sure. Office fileserver? Absolutely. Build server? Sure.
  - nicce 5y ago
    If we go to that road, how often you need Python 2 for fileserver or build server? Now, what is the percentage of that among all MacBooks on latest MacOS out there.
    - reaperducer 5y ago
      If we go to that road, how often you need Python 2 for fileserver or build server? Monthly, for me. Or more often if, like last week, a new customer required it.
    - Wowfunhappy 5y ago
      I think this mindset is dangerous. There's a really long tail of niche things people do on their computers, such that I suspect a majority of users have at least one niche need. Especially today, when Chromebooks and iPads are available for anyone who only needs basic web browsing. If you stop paying attention to the niches, they add up to a lot of people.
      - nicce 5y ago
        You are right, but I would say that this is quite extreme case. This is a programming language which support ended 2 years ago. Only reason to use it is to avoid turning old code base to new one. There are some serious questions if that is really a good approach. And if it is, why you need to use pre-installed Python 2 instead of installing it by yourself?
        Wowfunhappy 5y ago
        I expect that there are users, who are not themselves developers, who are using either apps or scripts which rely on the system-installed Python 2. They likely aren't aware that they're using Python, and they may not even know what Python is. It could be one line in one shell script block in one automator action that a coworker put together five years ago. It's okay for that stuff to break. (I wish Apple would put more effort than they do into making it break less often, but that's neither here nor there.) But, it should break in a major release, when the user is prepared for things to break. It should not break in an update that was installed automatically overnight.
deleted 5y ago
[deleted]

throw0101a 5y ago

> The risk of unpatched vulnerabilities If a company as 'small' as (pre-IBM) Red Hat can afford to support Python 2.7, then so can Apple: * https://developers.redhat.com/blog/2018/11/14/python-in-rhel-8-3 https://developers.redhat.com/blog/2018/11/14/python-in-rhel... * https://access.redhat.com/solutions/4455511 https://access.redhat.com/solutions/4455511 Further, if Debian has the resources to support Python 2.x, then so does multi-trillion dollar company of Apple: * https://packages.debian.org/search?keywords=python2 https://packages.debian.org/search?keywords=python2 If they wanted to announce at the June 2022 WWDC that macOS 13 wasn't going to have it, that's fine. But we're several months into macOS 12.x and such a large change is bad form.

Redoubts 5y ago
Maybe they can afford it, but why should they?
- simlevesque 5y ago
  To offer a good service. To avoid breaking something the users depend on.
  - danaris 5y ago
    That's what Windows is for.
  - samtheDamned 5y ago
    Apple isn't in the business of spending excess money to avoid breaking things. If anything apple is the opposite.
  - Kalium 5y ago
    Apple supported Python 2 for two years after it was officially sunset by the Python Foundation. They've been advising that they will drop support for longer. How long is long enough to avoid breaking something the users depend on? One more year? Five years? Fifty? I think we can all agree that it's reasonable to drop support at some point, making it just a question of when and at what cost.

omnicognate 5y ago

Python 2 EOL was 2 years ago. 20 months before Monterey was released. Edit: And it hardly came out of the blue. Python 2.7 was 10 years old then and people had known they needed to get off it for years.

superkuh 5y ago

It's funny how people think old, robust software is suddenly going to spring a bunch of vulnerabilities while sitting there, static, unchanging. It's far more likely the bleeding edge python(s) are going to be getting new bugs. Old software isn't inherently more risky.

WJW 5y ago
Of course it's not going to get new vulnerabilities, but that doesn't mean hackers won't find previously unknown vulnerabilities that have always been there. Looking through the CVE database, core python alone has had 15 CVE reports in 2020 and 2021, and for old pythons those will never be patched. I'll never understand why people think they can write some software and it'll stay pristine forever. Even if it was had no known bugs at some point in the past, the world is a harsh place and your program, its dependencies, its programming language or even its OS can be found to be subtly broken at any moment. Even if it is not outright buggy, the world will change around you until the interfaces you depend on are no longer there. (looking at you, software program at $WORK that only works with PS/2 keyboards but not USB keyboards)
- loeg 5y ago
  Many of those CVEs will not impact your application code, though. This is just a side effect of Python having a huge and somewhat crusty standard library.
- Someone 5y ago
  If it is dynamically linked (probably the case, as that’s the norm on Mac OS), it might even get new vulnerabilities. The combination (old Python, new shared library) could have vulnerabilities that neither (old python, old shared library) nor (new python, new shared library) has.
- lanstin 5y ago
  In the old days, software was like math - it had immutable, provable qualities. In the last several decades software has gradually become more and more like biology, where the core mechanisms are shrouded in mystery and we rely on observation and experiments to understand. The Star Trek game in Basic I typed into a computer is eternally true, a platonic form in a way software now no longer even aspires to be.

loeg 5y ago

I've previously worked at a vendor using Python2. Someone brought up this concern. I looked up the number of security releases we had cut in the past due to Python2 vulnerabilities -- it was zero.

ShamelessC 5y ago
This is the reason they are referred to as 0-day exploits and believe me, given enough time they will begin to appear.
- loeg 5y ago
  Maybe? The timeline here is over a decade. It’s hard to imagine RCE without network facing services.
- kortilla 5y ago
  We’re talking about a Python interpreter here. It already executes arbitrary input with the ability to write to files and make network connections. What type of vulnerability with it just sitting there as an executable do you expect?
  - ShamelessC 5y ago
    Doesn't need to be an RCE to be considered an exploit of the user's intentions. I can't fathom how people are still trying to use an EOL language or why they would even want to. Learn some new syntax, you'll live and the writing has been on the wall for like 20 years.
    - Wowfunhappy 5y ago
      I don't think a whole lot of people are writing new software in Python 2, but I think a lot of people are still running old software via Python 2. Software they didn't write themselves and wouldn't know how to modify. And that's not to say those users won't have to find something new eventually (or migrate the software to a contained environment). It just shouldn't happen in an automatically installed update.

nonethewiser 5y ago

>The risk of unpatched vulnerabilities between now and the next "major release" His point doesn't necessitate waiting. You could just classify it as a major release instead. That is not to say it should be a major release necessarily.

Wowfunhappy 5y ago
Right, Apple could have removed Python 2 last fall with the release of Monterrey, and I would have been neither surprised nor unhappy. I was actually kind of surprised when it was still in Big Sur.
- diebeforei485 5y ago
  > I was actually kind of surprised when it was still in Big Sur. Removing support in the middle of 2020 would have been very unpopular.
  - Wowfunhappy 5y ago
    Then they could have done it in 2021 with the release of Monterrey. Heck, Monterrey was released before Omicron, so if we're concerned about COVID that should have been less disruptive than doing it now.
    - diebeforei485 5y ago
      This wouldn't have worked either. Lots of countries, where vaccines weren't widely available yet, were going through a huge Delta wave before and after WWDC. Now that most places have vaccines, it probably doesn't make sense to wait for the next major release because this has already been long delayed. Other factors could have also been at play - perhaps Apple Inc had a lot of internal tools on 2.X and has only recently gotten around to migrating all of those.

reaperducer 5y ago

The risk of unpatched vulnerabilities between now and the next "major release" far exceeds the risk of inconveniencing anyone foolish enough to rely on the system Python 2.7 installation. You make an assumption that the way your system and method of working is the same as everyone else on the planet. It is not. I have two tools that I use monthly which require python 2.7. The people who made the tools never updated them to work with 3. For this reason, I have a work box that I cannot upgrade. I know that Macs are aimed at end users, and not developers, but it really is getting harder and harder for me to use my Macs for the kind of work I do. Each major software update borks my virtual hosts. PHP has been removed, and because of code signing requirements, adding it back is so complicated it takes an entire day and filtering through a dozen half-baked online tutorials. No, the ones that say "Just use brew!" are not the answer unless you have a very simple job. I don't use Docker, but from what I read on HN, that's six miles of bad road, too. But as I understand the situation, that's Docker's fault, not Apple's.

NavinF 5y ago
The doctor says to the patient, "What seems to be the trouble?" The patient says, "It hurts when I do this." The doctor says, "Don't do that."

makecheck 5y ago

As a counter-point, my app was able to rely on the system Python 2.7 for FIFTEEN YEARS because it was an extremely stable component of the OS (and it allowed the app binary to be literally 10 megabytes). Now? I honestly can’t think of a way to release without adding something like 100-200 MB to the app bundle, consisting of an entire Python installation. With a user-facing app it is not ideal to try to say something like “just download Python and tell me where it is”.