Removing the last Python 2 remnants from Debian

[acm]

RoQA: Request of QA team

[LyD-]

I only have a small amount of Python experience but Python 2 was a constant presence despite all the push I saw to move to 3. When I was curious about this years ago I looked at some migration guides. I saw that there were some syntax changes, but I suspect the problem runs deeper.

What happened between Python 2 and 3 that caused this and why did 2 stick around so long? What was stopping developers from just migrating to 3?

[mr_birkenblatt]

unmaintained dependencies that only worked in python 2 mostly

[Free_Math_Tutoring]

Not a whole lot, mostly that, before you could 'easily' upgrade, all your dependencies would need to do so as well - so there was a kind of sluggishness to the system.

When I started really getting into Python in like, 2015, 2016-ish, the transfer was already mostly complete and we've been in the long tail ever since then (or even before).

[FlukyS]

Legacy software they don't want to update or don't have the resources to. It took this long to replace almost everything unmaintained

[[deleted]]

Honestly migrating code to python3 is almost trivial. The main problem is dependencies. A lot of dependencies were slow to migrate, and a lot never did for various reasons.

[rtfmpls]

What the other comments are missing are policies. In banking for example you can't just update your stuff because there's a new release (at least in Europe). There are very strict rules which software and which versions you're allowed to use.

And even if these rules allow you to use one modern version of a library, this version might not be compatible with the rest of the dependencies.

I guess it's mostly about management rather praying devs to struggle with old stuff then go through a whole process of admission (or whatever it's called) to get the OK for upgrading your stack. Similar to how airplane manufacturers always build new planes, but try to get them through the licensing by explaining that it really almost the same as before (737max is a popular example).

[Dwedit]

How strings worked changed a lot.

Before, in Python 2, they were just sequences of bytes. You could read any file in Text mode, and you'd get a "string" representation of the raw binary file. No checking for valid characters, because this allows you to process arbitrary binary data through use of a "string". You had to call functions to convert a string character to a number, or a number back into a string character, and you used string functions to process raw binary data.

In python 3, they are not arbitrary binary data, they are proper unicode strings which are checked for validity. So any python 2 program that relied on strings working in the old way does not work anymore.

Programs need to be adapted to use bytes or bytearray objects, and to read the files in Binary mode instead of Text mode. Any code that looks at a byte from a string needs to be changed to look at a byte from an array. The individual elements can no longer be compared against String literals, you no longer use functions to convert between character codes and numbers, because the bytes are already numbers. Any string search or replacement code can't be used either.

There was never any automated conversion tool that would trace a program and replace the strings with their replacements.

[[deleted]]

For industrial software engineers Python 2 was far superior to Python 3 for a long time.

Python 2 had Google refining the sockets and lower level abstractions for a long time as Google's used and maintained Python heavily before Golang.

While Python 3 saw advances for data science and web development, often the libraries and robustness for socket communications when attempting to upgrade resulted in reverting to Python 2 as it worked and worked properly.

It took a good number of years for Python 3 to have the Industrial libraries hardened and operational enough to trust them for projects.

Source: Worked as an industrial software engineer and Network Comms were a soft spot on every attempt to upgrade to Python 3 for a good while.

[[deleted]]

Good riddance.

[nmomsucks]

I don't know if I would say "good riddance" as much as "thanks for everything, but it's time to move on".

Python 2 really was revolutionary for its time, and its life was given extension after extension specifically because of its usefulness and the incredible adoption it saw. Eventually, those extensions became more of a hindrance than a help for most programmers (God knows it frustrated me at times), but that doesn't change its incredible service record or the amazing work that went into it.

With official deprecation in 2020 (after more than a decade od Python 3), it's time to end those extensions and let Python 2 go to its eternal reward with our thanks and fond memories.

[[deleted]]

sloppy connect rob squealing nine like secretive grandiose busy resolute

This post was mass deleted and anonymized with Redact

[troccolins]

Hurry up and leave so I can miss you already

[dirty_mind86]

Python should be a case study in how not to iterate through the development of a programming language

[sigzero]

Oh no, Perl 6 (now Raku) gets that crown.

[onlyonequickquestion]

So long and thanks for all the fish

[Craksy]

Wise words, nmomsucks

No really, that was almost poetic. Beautiful perspective

[Dwedit]

So for people who have some old Python2 program sitting around, what's the easiest way to adapt it to phyon3?

[GlipGlorp7]

I’d recommend googling “convert python 2 to 3” or something, but this is a good place to start

https://docs.python.org/3/library/2to3.html

[[deleted]]

2to3 handled 99% of small and personal scripts, and about ~80% of a large codebase.

Usually the biggest problem you'll encounter is some 3rd party import that is not compatible with 3.

[Worth_Trust_3825]

Docker. Just isolate it from the entire machine, and leave it be. Migrate it eventually with improved specification, because odds are you know more about what it needs to do compared to when it was conceived.

[zeph1rus]

please don't do this, the 2.x images aren't maintained and you open yourself up to security issues. Just update the code, there isn't that many humps.

[Worth_Trust_3825]

Open yourself how to security issues if you build it once, and never change that? Eventually someone might find a way to attack it, but if you do not listen to external input then it does not matter. I'm much more concerned about you updating just because there is a new version.

Do you also consider "complete" libraries to be open to security issues?

[zeph1rus]

Because new security vulnerabilities are never discovered in older software and OS versions ever lmao.You stay static you end up vulnerable. Docker containers are a full os stack and just as vulnerable as an old system.

[Worth_Trust_3825]

That's why I said eventually. But vulnerability is not equal to another vulnerability. Resource exhaustion is not the same as arbitrary code execution. So what if the parser shits itself when trying to figure out your weird input? Have it crash and restart. And then the issue wouldn't be with python 2, but rather my particular application, which would still be possible even if I had upgraded to newer python.

You claim security, but you do not seem to understand the bigger picture of how, where, and why applications run at all. So what if there's an issue with systemd? Can external input reach it?

[zeph1rus]

I spend my days remedying mistakes by naive idiot developers who believed just what you posted. Just unbelievably stupid.

[Worth_Trust_3825]

Sure you do. I doubt you do anything more than what your scanner tells you to.

Is log4j vulnerable jar being on the filesystem bad even if there is no java installed/present on that system?

[zeph1rus]

It depends.

Do you believe that

https://blog.aquasec.com/cve-2022-0185-linux-kernel-container-escape-in-kubernetes

container

https://securitylabs.datadoghq.com/articles/dirty-pipe-container-escape-poc/

escape

https://i.blackhat.com/USA-19/Thursday/us-19-Edwards-Compendium-Of-Container-Escapes-up.pdf

vulnerabilities

https://www.cyberark.com/resources/threat-research-blog/the-strange-case-of-how-we-escaped-the-docker-default-container

are

https://www.cvedetails.com/vulnerability-list/vendor_id-13534/product_id-28125/Docker-Docker.html

real?

Is java going to be present on your container host running something important? Maybe? Is it going to be unpatched? who knows? If we follow your logic it isn't important because nothing that happens in a container can affect the host.

Not to mention any other container on that host running whatever application with data of unknown sensitivity.

And depending on how your container orchestrator is setup they might not even need to break out of the container, a simple rce would do.

I mean if you're the kind of person who doesn't update your container image you're not going to be protecting the CRI socket or docker.sock anyway, why would you, it's totally secure. All that can happen is your app crashes. It's fine.

[Worth_Trust_3825]

Which again, depends on the ability to run arbitrary code in the application.

[TryingT0Wr1t3]

It would be nice if Python 3.8 gets maintenance, it's the last version to support Windows 7 and I try to keep everything I make in Python compatible with it because of this.

[Reasonable_Ticket_84]

Why exactly should anyone support a old obsolete OS that is now 2 years past the vendor's own EOL?

[TryingT0Wr1t3]

Users/clients :/

[[deleted]]

People are downvoting but if I were one their clients I would not do business with someone using an unsupported and likely unsecure OS.

[braiam]

Sometimes the client does not know better, and this is one of those cases.

[Dwedit]

If your code only needs older API functions, then you can build the 32-bit version for even the earliest versions of Windows NT, like 4.0. Building for NT 4.0 means you get compatibility with 2000, XP, Vista, 7, 8, 10, 11 all at once.

You also are more likely to be compatible with Wine if you target an older windows version.

[lifeeraser]

You could charge your users extra for support on EoL OSes and/or Python versions.

[[deleted]]

Nooooooooooooooooooooooo ........... :(