On Tue, 12 Sep 2017 09:40 pm, Chris Angelico wrote: [...] >> Yet look at your answer; "upgrade". For a person working on a server there's >> usually no economic choice to do. The OS python must stay in place and the >> newly installed upgrade must be personally maintained, updated, and tested >> when security patches come out. For one desktop that's not an issue. For >> dozens, or hundreds, or thousands, its not likely to happen. > > Until you get hit by a vulnerability that was patched four years ago, > but you didn't get the update. Now your server is down - or, worse, > has been compromised. What's the economic cost of that?
Chris, that's what your subscription to RHEL pays for: backports of security fixes that the free Python 2.6 doesn't contain. You'll probably get them on Centos and Fedora too, the community editions of RHEL. You *won't* get them from the Python website. That's the whole point of the ten year support for RHEL (longer if you pay more). > You might choose to accept that risk, but you have to at least be > aware that you're playing with fire. Laziness is not the cheap option > in the long run. You're making unjustified assumptions about the attack surface here. Maybe any attacker has to break through three firewalls *and* get root on the server before they can attack the Python app -- in which case they've got bigger problems than the Python vulnerability. It's one thing to mention in a friendly way the advantages of upgrading. It's another to continue to brow-beat the poster about the (supposed) necessity to give up their paid RHEL support and security patches in favour of taking their chances with the free, but more recent, version where they have to monitor the Python website or mailing lists themselves and manually upgrade each time there's an security patch. Feel free to continue to talk in general terms about the costs and benefits of upgrading, but stop badgering Leam. Not everyone values being on the bleeding edge, and Red Hat customers as a rule value stability and long term support over the latest shiny new features. -- Steve “Cheer up,” they said, “things could be worse.” So I cheered up, and sure enough, things got worse. -- https://mail.python.org/mailman/listinfo/python-list
