NCSC warns developers to drop Python 2 due to looming EOL & security risks

guest · Aug 22, 2019

Time to shed Python 2
Don’t constrict yourself, Python 2 slithers off into the sunset in 2020
August 22, 2019
https://www.ncsc.gov.uk/blog-post/time-to-shed-python-2

The end of life (EOL) date for Python 2 has been a long time coming, but it's finally in sight. As of the 1st of January 2020, Python 2 will no longer be supported. There will be no more bug fixes, or security updates, from Python's core developers.

So, if you're still using 2.x, it's time to port your code to Python 3. If you continue to use unsupported modules, you are risking the security of your organisation and data, as vulnerabilities will sooner or later appear which nobody is fixing.
Scale of the problem
Below is a table of ten popular Python packages and their stats from the Python Package Index, a repository of software developed and shared by the Python community.
Even if only a portion of these downloads are being used in live projects, the Python 2 EOL could potentially affect the security of millions of systems.
Click to expand...

guest · Sep 12, 2019

JPMorgan's Athena has 35 million lines of Python code, and won't be updated to Python 3 in time
September 12, 2019
https://www.techrepublic.com/articl...code-and-wont-be-updated-to-python-3-in-time/

Support for Python 2 is ending on January 1, 2020, just over 11 years following the introduction of Python 3—a major restructuring of the language that eliminated duplicate structures and modules in the pursuit of modernization. Given Python's popularity and ubiquity, the amount of business logic hinging on Python is quite vast, presenting an issue for organizations still clinging to Python 2.

Migrating 35 million lines of code from Python 2 to Python 3 is quite the undertaking—and JPMorgan is going to miss the deadline, according to eFinancialCareers, stating that JPMorgan's roadmap puts "most strategic components" compatible with Python 3 by the end of Q1 2020—that is, three months after the end of security patches—with "all legacy Python 2.7 components" planned for compatibility with Python 3 by Q4 2020.
Click to expand...

guest · Nov 1, 2019

Slow Retreat from Python 2 Threatens Code Security
November 1, 2019
https://www.darkreading.com/applica...thon-2-threatens-code-security/d/d-id/1336236

At least one in 10 Python developers and data scientists continue to use the legacy version of the popular programming language as their primary development tool, despite a looming deadline of Jan. 1, 2020, the official "end of life" for Python 2.

The result is that maintainers will no longer step in to fix even serious vulnerabilities, says Jeff Rouse, vice president of product at ActiveState, a software tools maker.

"The primary security risk is that vulnerabilities will arise and then there is not a core team to get those things fixed in a timely fashion," he says. "And that is not just talking about code language, but the package and ecosystem as well."
The Python Software Foundation has made it clear that Python 2 users will find themselves without patches starting in January.
"If people find catastrophic security problems in Python 2, or in software written in Python 2, then most volunteers will not help fix them," the group wrote in an alert on the sunsetting of Python 2.
Click to expand...

It does not help that Python 2.7 continues to be the default version installed on Mac OS X, even on Catalina, the latest version of Apple's operating system.

Other operating systems have fallen into line, however. In 2018, Ubuntu upgraded to Python 3.6 as the default in 18.04 LTS, also known as Bionic Beaver, and Red Hat dropped support for Python 2 in Red Hat Enterprise Linux 8. Python does not ship by default with Windows.
In addition, many major open source libraries have committed to dropping Python 2 in favor of Python 3 by 2020.
Click to expand...

guest · Nov 15, 2019

Programming language Python 2's end looms, so why will many miss the deadline?
Python 2 may be reaching end of life, but old Python 2 code will remain around for years to come
November 15, 2019
https://www.zdnet.com/article/progr...end-looms-so-why-will-many-miss-the-deadline/

That problem is compounded by developers who created dependencies or software libraries with Python 2, which in turn prevent developers downstream from upgrading to Python version 3.

It's been a slow road to getting developers to migrate code bases to Python 3, which was launched in 2008. Six years before Python 2 would reach the end of its life, the recently retired Python creator Guido van Rossum declared in 2014 that "it's time to move on to Python 3".
There's even a countdown clock to remind people exactly how many minutes of support remain for Python 2.7.

Vicki Boykis, a US-based data scientist, has now outlined on the Stack Overflow blog her views on why it's taking developers so long to port their Python 2 code to Python 3.

"Many people didn't switch for what they perceived to be as mostly an inconvenience," writes Boykis. "At that time, the largest difference was changing of the print statement to Python function syntax, which broke a lot of code. As a result, Python 2 continued to be in active development."
Click to expand...

Why is the Migration to Python 3 Taking So Long?

guest · Apr 29, 2020

Continued Use of Python 2 Will Heighten Security Risks
April 28, 2020
https://www.darkreading.com/vulnera...2-will-heighten-security-risks/d/d-id/1337681

Nearly five months after the Python Software Foundation finally ended support for the Python 2 programming language, many developers are continuing to use it, heightening security risks for their organizations in the process.

Support for Python 2 ended Jan. 1, 2020. The Python Software Foundation has stopped making any improvement updates or security fixes for it and has urged everyone using Python 2 to move to Python 3.
The decision means that organizations using Python 2 will most likely be on their own if any major security issues — new and legacy — were to suddenly crop up in the software.

"If people find catastrophic security problems in Python 2 or in software written in Python 2, then most volunteers will not help fix them," the Python Software Foundation had bluntly noted in its Python 2 end-of-life announcement.
A survey of 1,200 individuals conducted by ActiveState between last October and November showed 31% of organizations didn't have a plan to migrate to Python 3.
One reason has to do with a "if it ain't broke, don't fix it mentality," security analysts say. In many cases, organizations have been successfully using Python 2 for years without incident. It also has had very few security issues.
Click to expand...

Jonn Callahan, principal security consultant at application security provider nVisium, says even though an organization may not currently have any issues with Python 2, it still is a good idea to port to Python 3. Not updating a technology just because it works is what results in organizations accumulating insurmountable amounts of technical debt, Callahan notes.

"The truth is, applications require regular maintenance, even if nothing 'new' is being introduced," he says.
Click to expand...

Log in or Sign up

NCSC warns developers to drop Python 2 due to looming EOL & security risks

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

NCSC warns developers to drop Python 2 due to looming EOL & security risks

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches