Hacker News Reader

Comment by 2rsf | Hacker News Reader

Calibre developed by Kovid Goyal it's a one stop shop for eBook management. His reply to the issue

"Python 2 is retiring in thirty months. Calibre needs to convert to Python 3."

was

"No, it doesn't. I am perfectly capable of maintaining python 2 myself. Far less work than migrating the entire calibre codebase.

status wontfix"

[1] https://bugs.launchpad.net/calibre/+bug/1714107

View on HN

You had me until the anecdote. I understand the sentiment and intent of what’s being said, but as a security professional it just paints themselves, their applications, and their user base as targets. Knowing it’s a won’t fix means it’s also easier to sell exploits if not disclosing as it’s clear he doesn’t intend to upgrade to a maintained and supported version of Python, so it should work for longer than most exploits.

On a second look I see that they did moved to Python 3 with Calibre 5 on Sep 2020

Calibre has a bad history with security already - for example https://lwn.net/Articles/464824/

If you use the program its plainly obvious this kind of opinion is well spread through it. Of course I deeply respect anyone who puts their work out for free as FOSS but the tool is not a shining example of good software.

TIL that my favorite terminal[1] was written by the author of Calibre.

[1]: https://sw.kovidgoyal.net/kitty/

His name must have been really unfortunate at the start of the pandemic…

+1 for Calibre. It is such a wonder of software to me. I respected his reasoning though as another commenter has observed [1], it seemed inevitable that they would have to migrate at some point.

[1] https://news.ycombinator.com/item?id=33517830

Reply on news.ycombinator.com