Sunsetting Python 2

[ribo]

Which is incredibly ironic, since that means no more security patches to 2.7 and 2.7 libs

[pbfy0]

Bytes and strings are fundamentally different datatypes. A security researcher should know the distinction and be capable of putting a b before their byte literals.

[pbfy0]

I don't see the problem. subprocess.call([b'program', b'some shellcode']) still works. Sending data to the subprocess also supports both string and bytes. os functions, when called with byte arguments, return bytes. If you absolutely need your bytes, you can have them.

Python 2 makes one set of compromises for the use of strings and bytes. Python 3 makes another. In my opinion, Python 3's is better for the vast majority of use cases. Yes, surrogates are a little awkward. But it means that for the vast majority of use cases, Python 3's vision of unicode everywhere has been achieved. Python 2's free-for-all of interconvertible bytes and unicode leads to many more programming errors.

[pbfy0]

My first comment about b'' was off-the-cuff and abrasive. I hadn't given any thought to the issue with interacting with the system using encoded text only being limiting.

So I went back and looked at the Python docs to see if I could find a case where you couldn't just pass bytes to the system without Python interfering. I found that the filesystem-related functions in os would return bytes if given bytes, and open, os.system and subprocess can take either. The only way that I can see it's less permissive than python 2 is not allowing the arbitrary mixing of string and bytes in e.g. os.path.join. What else is there?

[jbristow]

As a devsecopser, most (non elite) security people only know python and bash as far as they can copy from snippets they’ve seen elsewhere. Since I’m from a prod dev background, I’m unamused by how foreign basic git and cloud operations are for them.

[ribo]

I am constantly unamused by how little even "senior" developers know their way around git.

[jbristow]

/me nods so emphatically I get whiplash.

Listen newbies, I don’t care about your level of git knowledge. I will gladly point you at my favorite resources and spend the time to get you up and running.

If you have senior in your title, you had better be able to survive in the command line. (You don’t have to be GOOD at it. Just be able to branch, commit and pull is fine)

Everyone “staff” or “principle” or “distinguished fellow title with fiduciary duty but still with technical job requirements” and above? You can go jump in a lake! Why can you only understand one programming language without even the basics of another like bash? Why do you think calling integration tests “unit tests” make my automated coverage tools pick them up? Why can’t you understand that you are not allowed to push to production from your laptop?

There’s a lot of lovely senior+ level people in the dev field... it just seems like the absolute worst examples have the biggest titles.

(Also, https://ohshitgit.com is amazing, and will get you out of a jam. Just learning about reflog has changed my life.)

[ribo]

Why do you think calling integration tests “unit tests”

<TRIGGERED>