"Hey Joe, why did our customer database get leaked and published on a dark-net site?"

"Hey boss, we're using an outdated programming language for which security updates are no longer provided, because we were told there's no budget for fixing technical debt."

"Congratulations, you're fired."

Same outcome either way... might as well make some effort to do the right thing along the way...

You’re confusing runtimes with the language. Py27 as a language has no security flaws that would allow a database to get leaked.

People will continue to use py27 going forward with likely a pay-for-support runtime because that’s cheaper and less risky than changing a million lines of python code.

I would assume it’s the dependent libraries in your 27 project that no longer get support, not the language itself.

Nah, you're not fired. That's why you CYA and get it in writing. It's the manager who decided that they didn't want to do a rewrite, it's not your problem they didn't listen to your advice.

Like it or not, there are a lot of teams that choose to incur technical debt to avoid what is seen as needless work on something that is working fine at the moment.

You're missing the point. If decision makers saw it coming that Python will just break in two, they would have never allowed its use. Other "serious" programming languages rarely if ever break, and when they do, it's usually minor.

Python2 will almost certainly still remain in widespread use and it will still get security updates through alternative distribution channels. It's not that much work fixing such relatively rare issues versus migrating a major codebase.

It's not "broken"... Python3 is just the evolution of the language. Languages change and evolve, some more and some less than others. Sure, Java or COBOL maybe have done a better job of not breaking backwards compatibility, but Python 3 isn't exactly Perl 6 here.

But hey, if some 3rd party group effectively forks the language and maintains a Python2 branch after the official EOL date, good on them. But I'd argue that using that is risky in the same way that using a Pale Moon or Waterfox is (arguably) riskier than using mainstream Firefox.

> Python 3 isn't exactly Perl 6 here.

For what it’s worth, Perl 6 can load Perl 5 libraries: https://github.com/niner/Inline-Perl5

> It's not "broken"... Python3 is just the evolution of the language.

Python3 broke compatibility for spurious reasons. The language didn't change that much, it could have kept compatibility with minor concessions.

> Java or COBOL maybe have done a better job of not breaking backwards compatibility...

Literally every single other major language has done a better job at it. That's a big part of why they are major languages. Also, most of these are statically typed, so any minor breaking change is far less risky to pull off.

> ...but Python 3 isn't exactly Perl 6 here.

Well, maybe if Perl6 didn't happen Perl wouldn't be irrelevant today.

> Literally every single other major language has done a better job at it.

C++'s upgrade woes make Python 3 look downright trivial in comparison.

What are you talking about? C++ has had very few breaking changes in the language.

If you're talking about ABI breaking, that's a different story. Python breaks the ABI in every major release as well. That generally requires a recompile, not a major code migration.

IceWeasel FTW.

Security through obscurity, baby...