Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by godzillabrennus on Wednesday February 01, 2017 @04:14AM (#13539445)

There is so much legacy code written in Python 2 that I can't imagine someone isn't going to have a large enough need that they will backport TLS support. Am I missing something on why that wouldn't work?

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by Lukasa on Wednesday February 01, 2017 @08:10AM (#13540407)

The problem isn't Python, it's OpenSSL.

OpenSSL got TLSv1.2 support in version 1.0.1. Any older version of OpenSSL doesn't support TLSv1.2. That affects a number of platforms:

- the system Python on macOS, which link against the system OpenSSL (an anaemic 0.9.8zh)

- most of the older (pre-3.6) python.org releases on macOS, which have the same problem

- any Python on a Linux operating system with an older OpenSSL

So the backport needed is to backport a newer OpenSSL to the platform.

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by Macha on Wednesday February 01, 2017 @05:21AM (#13539642)

The value proposition might be there if the alternative was a python 3 port, but if you're installing packages of pypi these days it's unlikely you're running python <2.6 and I'm not sure a Python 2.6 -> 2.7.9 upgrade is of comparable difficulty to adding TLS 1.2 support to python < 2.7.9.

I mean, I know there's some old versions of Red Hat and co knocking about with 2.4 but you're probably better off to use your system package manager for those these days.

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by smarx007 on Wednesday February 01, 2017 @05:29AM (#13539671)

In RHEL those old Python interpreters are available precisely via the system package manager. And they won't support you if you install Python from a 3rd party RPM as I understand.

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by srssays on Wednesday February 01, 2017 @05:46AM (#13539740)

And people pay money for that?

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by lmm on Wednesday February 01, 2017 @06:57AM (#13540001)

Yes. There are people who value support for a fixed version for 10 or more years much more than they'd value "rolling" support for a "latest" version that they have to keep updating their apps for.

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by srssays on Wednesday February 01, 2017 @11:58AM (#13542388)

But none of the packages they use will be up-to-date. e.g. Django dropped support for 2.6 years ago and will drop support for 2.7 soon.

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by ubernostrum on Thursday February 02, 2017 @02:28AM (#13548789)

People who use RHEL this way do not keep any third-party packages up-to-date. If that means a decade on Django 1.2, well, they spend a decade on Django 1.2 -- Red Hat will backport security fixes into a Red-Hat-packaged Django 1.2.

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by bandrami on Wednesday February 01, 2017 @07:35AM (#13540197)

Absolutely. Even on the gratis side, Debian stable gets very, very cranky if you mix in anything new. Devs hate it; ops love it.

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by maxerickson on Wednesday February 01, 2017 @06:54AM (#13539986)

It's not a 2.7 vs 3.x issue. There are minor versions of both that have TLS 1.2 support. The issue is making sure that the minor version installed on a system is linked against a library that supports TLS 1.2.

[ Parent | on HN ]