Hacker News Reader

Comment by SignalsFromBob | Hacker News Reader

I suspect that someone, or a group of people, will step up to unofficially maintain Python 2 for the foreseeable future. It's clear that there are a lot of people using it that either can't easily migrate or are unwilling to do so for the various reasons already discussed in this thread.

View on HN

I'm sure that for the right money you can find someone.

Don't forget that that person/organization would not only have to maintain python but also all the packages that you will be used.

If I encounter Python 2 bugs that matter to me, I can and will fix them myself if needed, and submit or otherwise publish the change.

I'm quite certain I'm not the only one.

Why not just migrate to 3?

genuinely curious...

Because of the amount of work involved in porting my existing Python code. Python 3 doesn't offer any advantages that matter to me, so that's a lot of effort for little gain.

OK, thanks. Good luck with the bug fixing ;)

I'm not really worried about bugs, because the code I have works well, and I doubt I'm going to do any serious new Python 2 development.

I meant the bugs in your dependencies that you'll have to backport fixes to. But hey, if you're writing bug-free code that'll be easy ;)

I understood what you meant. What I'm saying is that my existing code works fine, so whatever bugs are in the dependencies are ones that don't affect me. Should I make a code change that surfaces one, then I have the means to deal with it -- but that is almost certainly going to be a rare event, as my Python projects are stable and aren't going to see much change.

I wasn't commenting on how buggy my own code is. Which version of a language I'm using doesn't really affect that variable.

I get that. But the interesting thing about dependencies is how they surface vulnerabilities that can hurt code that works perfectly well. Your current code probably doesn't have many bugs, but includes an unknown number of vulnerabilities from your dependencies. The bad people probably won't bother examining your code for vulnerabilities, but they will be informed of vulnerabilities in popular libs, and then looking for projects that use those versions of those libs is a lot easier than scanning all those projects individually. So you end up having to backport a bunch of fixes to other people's code because that code was popular and came under intense scrutiny.

But I guess you know this, and are OK with the compromises involved. I'll stop here ;)

> but they will be informed of vulnerabilities in popular libs, and then looking for projects that use those versions of those libs is a lot easier than scanning all those projects individually.

This is true, and if we were talking about code that is exposed to the world at large, then my stance might be different. However, the projects that I've used Python for are not exposed in that way.

Note that I'm talking about personal projects, not work-related ones. At work, I use whatever is required.

Reply on news.ycombinator.com