Re:Python 2.7.18, the last release of Python 2
by mehrdadn on Monday April 20, 2020 @11:52PM
(#22931684)
See, when you explain what's wrong it's so much better than just blaming the victim with "You've had 8 years"!
Re:Python 2.7.18, the last release of Python 2
by toyg on Tuesday April 21, 2020 @05:20AM
(#22933326)
One issue the ecosystem currently has, really (and its not the only one, I believe it's difficult almost everywhere), is that tracking dependency-rot is hard. Unless something breaks outright, you'll never know if a library has been abandoned; and manually checking dozens of github/gitlab repos is expensive and tedious.
Pypi has an api (https://pypi.org/pypi/<pkg-name>/json) that can be leveraged to implement alerts like "this pkg last released 5 years ago, it might be dead!". I guess that's what the "security" package uses already. It would be cool if they added an option to report on this sort of thing.
Re:Python 2.7.18, the last release of Python 2
by mywittyname on Monday April 20, 2020 @11:29PM
(#22931575)
OP here, thanks a bunch for this! I will take your advice and dump the crypto library for this one.
The OP should have dropped it because it's unmaintained, and a maintained replacement has existed for a long time: https://cryptography.io/
This is an especially important consideration for security-critical libraries like cryptographic libraries.