Re: CTI Python libraries and Python 2.6

["Back, Greg" <gback@mitre.org>]

I phrased my request (“If you are using or need to use 2.6, let me know.”) the way I did for a reason.

 

Supporting 2.7 is going to happen. There are people who will need it for at least the next few years. Starting a library from scratch without Python 3 support is similarly not negotiable, IMO. Supporting 2.7 and 3.3+ is pretty standard for most libraries these days, anyway.

 

As a library maintainer, there is some amount of work that goes into supporting both 2.7 and 3.x at the same time. We will be doing that anyway. The amount of additional work to support 2.6 is small, but non-zero (there are a few syntax structures you can’t use, that would otherwise make the code cleaner). If no one needs 2.6 support, it doesn’t make sense to support it (but people have already contacted me saying they need 2.6 support, at least in the short term). I’ve encouraged them to start looking at upgrading.

 

My question also applied to the older libraries that already support 2.6. These libraries generally aren’t getting new features, so IMO it doesn’t make sense to “deprecate” them (other than to steer people towards upgrading to 2.7 or beyond as soon as feasible). Similarly, it doesn’t make sense to release a new version *just* to “break” people’s installs.

 

Many of the old libraries already support Python 3, but not all of them do. (If you need Python 3 support, let me know!)

 

By the way, I should have mentioned in my last message that we are targeting an early-May release of a version of python-stix2 that supports serialization and deserialization, and tries to make it hard or impossible to accidentally create invalid STIX 2 content… otherwise, just using json.dump/load would work perfectly well ;-)

 

FWIW, I’m doing as much Python development as I can in 3.6, and understand all the reasons to upgrade. I just didn’t want this thread to become a 2 vs. 3 discussion.

 

Greg

 

From: Patrick Maroney <pmaroney@wapacklabs.com>
Date: Monday, April 10, 2017 at 3:05 PM
To: Bret Jordan <Bret_Jordan@symantec.com>, Terry MacDonald <terry.macdonald@cosive.com>, Greg Back <gback@mitre.org>, "cti-users@lists.oasis-open.org" <cti-users@lists.oasis-open.org>, Raphaël Vinot <raphael.vinot@circl.lu>
Subject: Re: [cti-users] Re: [EXT] Re: [cti-users] CTI Python libraries and Python 2.6

 

[+1] on Python 2.7 and 3.x as baseline support bars. 

 

While I believe 2.7 support is a must for a number of reasons,  I personally would deprecate 2.6  support.

 

Patrick Maroney

Principal Engineer - Data Science & Analytics

Wapack Labs LLC

(609)841-5104

pmaroney@wapacklabs.com

 

Public Key: http://pgp.mit.edu/pks/lookup?op=get&search=0x7C810C9769BD29AF

 

On Apr 10, 2017, at 3:40 PM, Bret Jordan <Bret_Jordan@symantec.com> wrote:

 

I guess I would ask the question this way, for this community.  

 

For those implementing a STIX 2.0 and TAXII 2.0 solution, who will be using the MITRE libraries, which version of Python would you prefer:
 
1) 2.6
2) 2.7
3) 3.x  

 

Bret

---

From: cti-users@lists.oasis-open.org <cti-users@lists.oasis-open.org> on behalf of Terry MacDonald <terry.macdonald@cosive.com>
Sent: Monday, April 10, 2017 1:30:26 PM
To: Back, Greg
Cc: cti-users@lists.oasis-open.org; Raphaël Vinot
Subject: [EXT] Re: [cti-users] CTI Python libraries and Python 2.6

 

I think we can lose python 2.6, but I agree that python 2.7 will be around for a while.

 

Cheers

Terry MacDonald

 

On 11/04/2017 02:57, "Back, Greg" <gback@mitre.org> wrote:

I would love for the libraries to be 3.3+ only, and I agree that it is prudent for people to start planning a migration from Python 2 to Python 3 now, before 2020. I’m thrilled that MISP is already switching to be Python 3 only.

Realistically, I believe a significant portion of users will be using 2.7 for several more years, and some may even still be using 2.6 (hence my question).  The Python library for STIX 2 is currently under development [1], and will support at least Python 2.7 (if not Python 2.6 also). If you (or anyone else) are interested in helping, we’d love the help. Check out the contributing guide [2] or send me an email if you’d like to help or have any feedback.

My question also applies to the older (python-stix, python-cybox, libtaxii, etc.) libraries, where we are still trying to fix bugs that users find, even if we aren’t actively adding new features. Those libraries already support Python 2.6. We could drop 2.6 support if no one needs it, which is part of why I asked my question.

Greg

[1] https://github.com/oasis-open/cti-python-stix2
[2] https://stix2.readthedocs.io/en/latest/contributing.html

On 2017-04-10, 9:10 AM, "Raphaël Vinot" <raphael.vinot@circl.lu> wrote:

    Short answer: nope, even python 2.7 is not relevant IMO

    As we speak, we are far from having a usable Python library for STIX 2.0
    so backporting code to EOL (or close to EOL) languages is useless.

    FYI, we will remove python2 support to all MISP libraries this year.

    Cheers,
    Raphaël


    On 04/06/2017 07:02 PM, Back, Greg wrote:
    > Hi-
    >
    >
    >
    > If you currently use any of the Python libraries for STIX, TAXII, or
    > CybOX (either the older 1.x libraries or the newer 2.0 libraries) with
    > Python 2.6, please let me know. The information will help me determine
    > what level of effort (for both new development and ongoing support) we
    > should be putting into supporting Python 2.6.
    >
    >
    >
    > (Yes, I know Python 2.6 is officially end-of life.)
    >
    >
    >
    > Greg Back
    >
    > MITRE
    >

    --
    Raphaël Vinot
    CIRCL - Computer Incident Response Center Luxembourg

    41, Avenue de la Gare
    L-1611 Luxembourg

    (+352) 247 88444 - info@circl.lu - www.circl.lu