Hacker News Reader

Comment by godzillabrennus | Hacker News Reader

There is so much legacy code written in Python 2 that I can't imagine someone isn't going to have a large enough need that they will backport TLS support. Am I missing something on why that wouldn't work?

View on HN

The problem isn't Python, it's OpenSSL.

OpenSSL got TLSv1.2 support in version 1.0.1. Any older version of OpenSSL doesn't support TLSv1.2. That affects a number of platforms:

- the system Python on macOS, which link against the system OpenSSL (an anaemic 0.9.8zh)

- most of the older (pre-3.6) python.org releases on macOS, which have the same problem

- any Python on a Linux operating system with an older OpenSSL

So the backport needed is to backport a newer OpenSSL to the platform.

The value proposition might be there if the alternative was a python 3 port, but if you're installing packages of pypi these days it's unlikely you're running python <2.6 and I'm not sure a Python 2.6 -> 2.7.9 upgrade is of comparable difficulty to adding TLS 1.2 support to python < 2.7.9.

I mean, I know there's some old versions of Red Hat and co knocking about with 2.4 but you're probably better off to use your system package manager for those these days.

In RHEL those old Python interpreters are available precisely via the system package manager. And they won't support you if you install Python from a 3rd party RPM as I understand.

And people pay money for that?

Yes. There are people who value support for a fixed version for 10 or more years much more than they'd value "rolling" support for a "latest" version that they have to keep updating their apps for.

But none of the packages they use will be up-to-date. e.g. Django dropped support for 2.6 years ago and will drop support for 2.7 soon.

People who use RHEL this way do not keep any third-party packages up-to-date. If that means a decade on Django 1.2, well, they spend a decade on Django 1.2 -- Red Hat will backport security fixes into a Red-Hat-packaged Django 1.2.

Absolutely. Even on the gratis side, Debian stable gets very, very cranky if you mix in anything new. Devs hate it; ops love it.

It's not a 2.7 vs 3.x issue. There are minor versions of both that have TLS 1.2 support. The issue is making sure that the minor version installed on a system is linked against a library that supports TLS 1.2.

Reply on news.ycombinator.com