Hacker News Reader

Comment by TylerE | Hacker News Reader

Ok, so what happens when several of your dependencies never ported?

This isn't strawmanning - this is literally the case for a codebase I'm working with today.

You should not be using those dependencies today. Looks like they have been unmaintained for a decade and can contain a ton of vulnerabilities.

Though I find it hard to believe that there are some useful dependencies that have not been ported and don't have better alternatives. Typically a "never ported" dependency is never ported because it is deprecated in favor of something better.

We're in a rather niche market. It's geocoding related stuff that only talks to a trusted endpoint.

Does no one work in a business? Does no one work with science instruments purchased more than 5 years ago? Businesses have lots of useful dependencies that have not ported. If you are running a payroll system and it’s working, there is a real aversion to going to a new code base, and the cost benefit is not there for many businesses. You do realize python 2 is downloaded 3 million times per month now? Yes that’s down - but it’s not nothing - probably 300 - 400 thousand plus users easily

> Ok, so what happens when several of your dependencies never ported?

If you're consuming dependencies which were never updated in the past decade then you have more worrying problems to deal with than porting your code to python3.

That’s not true at all - in high compliance industries if the dependency has been validated and is working changing it brings risk.

Reply on news.ycombinator.com