Re: [cti-users] Re: [EXT] Re: [cti-users] CTI Python libraries and Python 2.6

[Robert Simmons <rsimmons0@gmail.com>]

I wanted to add more reasons not to support 2.6 and 3.3. Pip dropped 2.6 support on March 18th. Now there are fewer ways to even install the python libraries under 2.6:

https://github.com/pypa/pip/pull/4343

The same thing is on the way for 3.3. On March 21st, pip deprecated 3.3 support:

https://github.com/pypa/pip/commit/6b5414578371ed6816964cb2a82a4cf6fd5552ed

As stated in the comment at the top of that pull request, this is being used as justification in many other projects to drop 2.6 support. Example: requests:

https://github.com/requests/requests/issues/3928

On Wed, Apr 19, 2017 at 8:08 AM, Back, Greg <gback@mitre.org> wrote:

As I’ve said several times now, this thread is *specifically* about Python 2.6, and for *exactly* the reason Jason mentions (thanks for the better explanation, with specific dates, Jason!).

 

I was simply trying to get a feel for the number of people who need 2.6 support. Compared to 2.7, it’s just a couple syntactic differences and backported dependencies. I can tell people to newer versions of Python until I’m blue in the face, but very often the people who I would be talking to aren’t the people who can make that change; otherwise they likely would have.

 

Greg

 

From: <cti-users@lists.oasis-open.org> on behalf of Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Date: Wednesday, April 19, 2017 at 6:56 AM
To: Robert Simmons <rsimmons0@gmail.com>
Cc: "cti-users@lists.oasis-open.org" <cti-users@lists.oasis-open.org>

Subject: Re: [cti-users] Re: [EXT] Re: [cti-users] CTI Python libraries and Python 2.6

 

This is not totally accurate. The various Linux vendors normally take it upon themselves to maintain Python 2.6, as they simply can not move packages up a major version like that without also having a major release.

As an example, RedHat Linux 6.X ships with Python 2.6. This OS (specifically RedHat 6.7) is supported by RedHat until July 31, 2018. RedHat continually back-ports all security fixes and some feature/functions into Python 2.6 line to enable this. Ubuntu does the same thing, as does SUSE.

RedHat 7.0 has moved to Python 2.7.X as the default python.

-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security

Without data, all you are is just another person with an opinion - Unknown




From:        Robert Simmons <rsimmons0@gmail.com>
To:        "cti-users@lists.oasis-open.org" <cti-users@lists.oasis-open.org>
Date:        04/18/2017 11:50 PM
Subject:        Re: [cti-users] Re: [EXT] Re: [cti-users] CTI Python libraries and Python 2.6
Sent by:        <cti-users@lists.oasis-open.org>

---

Please, do *not* supporting Python 2.6. The following is from the official PEP about Python 2.6:
"With its release on October 29, 2013, all official support for Python 2.6 has ended. Python 2.6 is no longer being maintained for any purpose."
https://www.python.org/dev/peps/pep-0361/

As for Python 3: I suggest *not* supporting 3.3 either. Only support 3.4+. My reasoning here is that 3.3's end of life is September. I'm not sure you want to spend the cycles making sure the toolset works in 3.3 just to be able to use it for a month or two then have the language version EOL occur. Again, here is the text from the official PEP on Python 3.3:
"3.3 will receive bugfix updates approximately every 4-6 months for approximately 18 months. After the release of 3.4.0 final, a final 3.3 bugfix update will be released. After that, security updates (source only) will be released until 5 years after the release of 3.3 final, which will be September 2017."
https://www.python.org/dev/peps/pep-0398/


On Tue, Apr 18, 2017 at 6:17 PM, John-Mark Gurney <jmg@newcontext.com> wrote:
Bret Jordan wrote this message on Mon, Apr 10, 2017 at 19:40 +0000:
> I guess I would ask the question this way, for this community.
>
>
> For those implementing a STIX 2.0 and TAXII 2.0 solution, who will be using the MITRE libraries, which version of Python would you prefer:
>
> 1) 2.6
> 2) 2.7
> 3) 3.x

#2 and #3 both, and I'll echo the 3.3+ or something more recent as
minimum too...  No need to support 3.0 anymore, and iirc, 3.3 was
when they fixed Unicode support in Python..

> ________________________________
> From: cti-users@lists.oasis-open.org<cti-users@lists.oasis-open.org> on behalf of Terry MacDonald <terry.macdonald@cosive.com>
> Sent: Monday, April 10, 2017 1:30:26 PM
> To: Back, Greg
> Cc: cti-users@lists.oasis-open.org; Raphaël Vinot
> Subject: [EXT] Re: [cti-users] CTI Python libraries and Python 2.6
>
> I think we can lose python 2.6, but I agree that python 2.7 will be around for a while.
>
> Cheers
> Terry MacDonald
>
> On 11/04/2017 02:57, "Back, Greg" <gback@mitre.org<mailto:gback@mitre.org>> wrote:
> I would love for the libraries to be 3.3+ only, and I agree that it is prudent for people to start planning a migration from Python 2 to Python 3 now, before 2020. I’m thrilled that MISP is already switching to be Python 3 only.
>
> Realistically, I believe a significant portion of users will be using 2.7 for several more years, and some may even still be using 2.6 (hence my question).  The Python library for STIX 2 is currently under development [1], and will support at least Python 2.7 (if not Python 2.6 also). If you (or anyone else) are interested in helping, we’d love the help. Check out the contributing guide [2] or send me an email if you’d like to help or have any feedback.
>
> My question also applies to the older (python-stix, python-cybox, libtaxii, etc.) libraries, where we are still trying to fix bugs that users find, even if we aren’t actively adding new features. Those libraries already support Python 2.6. We could drop 2.6 support if no one needs it, which is part of why I asked my question.
>
> Greg
>
> [1] https://github.com/oasis-open/cti-python-stix2<https://clicktime.symantec.com/a/1/2VQuBU6FixHYGy3W2qWqTdXA5hrXCIaKFwNOGxZAe7c=?d=RYh0cFVUugD-CMgme2wggyVRvwxFPg6A-u39qqSzD7vqEXwPy3Lxu7dmu1ZCJBMo3k0XPTh8ql3qiykefpVN4IUvvuoQ5jPFQWqOkINdk-In6Z2DevGXnNEhHnRLk26DEsB76ONtnRLPOFcVgVkV9WKrwmJoAoxbf5LQ1I4JCjwENxeuCaoGBM8wh6KBqOsad5z0LcFNFXOa91sQiN_MWs2yt7sgHg5EvbvoGwUdAbNcHMsxzwYCnFojRwbpSNAaBILakhRRpqY6qH_vNbK4QSy1mrK0djBrphZicQZLvSiOD71XkslQ4C990HPoDl3QturJnEUC5iHK1Ydh7rPZ6ugybsRNw32ABtJ-0bC-K6b4VPI4g_tD7olIYqO3VRun0jZ9_0wzam1Nju8Bvqr-DTf5O9AGTu2_T5iEtN9h6caiYWgKhI8DGQG7ugTnQMPW3WawwhiWoSOvcioxTMkWC8jJjm6QJY2EM3xY-t8%3D&u=https%3A%2F%2Fgithub.com%2Foasis-open%2Fcti-python-stix2>
> [2] https://stix2.readthedocs.io/en/latest/contributing.html<https://clicktime.symantec.com/a/1/M1sCODCJrovQXHKznxBN8W-MUnsFez1ormUuSZVVNik=?d=RYh0cFVUugD-CMgme2wggyVRvwxFPg6A-u39qqSzD7vqEXwPy3Lxu7dmu1ZCJBMo3k0XPTh8ql3qiykefpVN4IUvvuoQ5jPFQWqOkINdk-In6Z2DevGXnNEhHnRLk26DEsB76ONtnRLPOFcVgVkV9WKrwmJoAoxbf5LQ1I4JCjwENxeuCaoGBM8wh6KBqOsad5z0LcFNFXOa91sQiN_MWs2yt7sgHg5EvbvoGwUdAbNcHMsxzwYCnFojRwbpSNAaBILakhRRpqY6qH_vNbK4QSy1mrK0djBrphZicQZLvSiOD71XkslQ4C990HPoDl3QturJnEUC5iHK1Ydh7rPZ6ugybsRNw32ABtJ-0bC-K6b4VPI4g_tD7olIYqO3VRun0jZ9_0wzam1Nju8Bvqr-DTf5O9AGTu2_T5iEtN9h6caiYWgKhI8DGQG7ugTnQMPW3WawwhiWoSOvcioxTMkWC8jJjm6QJY2EM3xY-t8%3D&u=https%3A%2F%2Fstix2.readthedocs.io%2Fen%2Flatest%2Fcontributing.html>
>
>
>
> On 2017-04-10, 9:10 AM, "Raphaël Vinot" <raphael.vinot@circl.lu<mailto:raphael.vinot@circl.lu>> wrote:
>
>     Short answer: nope, even python 2.7 is not relevant IMO
>
>     As we speak, we are far from having a usable Python library for STIX 2.0
>     so backporting code to EOL (or close to EOL) languages is useless.
>
>     FYI, we will remove python2 support to all MISP libraries this year.
>
>     Cheers,
>     Raphaël
>
>
>     On 04/06/2017 07:02 PM, Back, Greg wrote:
>     > Hi-
>     >
>     >
>     >
>     > If you currently use any of the Python libraries for STIX, TAXII, or
>     > CybOX (either the older 1.x libraries or the newer 2.0 libraries) with
>     > Python 2.6, please let me know. The information will help me determine
>     > what level of effort (for both new development and ongoing support) we
>     > should be putting into supporting Python 2.6.
>     >
>     >
>     >
>     > (Yes, I know Python 2.6 is officially end-of life.)
>     >
>     >
>     >
>     > Greg Back
>     >
>     > MITRE
>     >
>
>     --
>     Raphaël Vinot
>     CIRCL - Computer Incident Response Center Luxembourg
>
>     41, Avenue de la Gare
>     L-1611 Luxembourg
>
>     (+352) 247 88444 - info@circl.lu<mailto:info@circl.lu> - www.circl.lu<https://clicktime.symantec.com/a/1/JRdN0oeqLlG3l7k0ug_H4FGSU9-Ax-_v-vW_OigMqIA=?d=RYh0cFVUugD-CMgme2wggyVRvwxFPg6A-u39qqSzD7vqEXwPy3Lxu7dmu1ZCJBMo3k0XPTh8ql3qiykefpVN4IUvvuoQ5jPFQWqOkINdk-In6Z2DevGXnNEhHnRLk26DEsB76ONtnRLPOFcVgVkV9WKrwmJoAoxbf5LQ1I4JCjwENxeuCaoGBM8wh6KBqOsad5z0LcFNFXOa91sQiN_MWs2yt7sgHg5EvbvoGwUdAbNcHMsxzwYCnFojRwbpSNAaBILakhRRpqY6qH_vNbK4QSy1mrK0djBrphZicQZLvSiOD71XkslQ4C990HPoDl3QturJnEUC5iHK1Ydh7rPZ6ugybsRNw32ABtJ-0bC-K6b4VPI4g_tD7olIYqO3VRun0jZ9_0wzam1Nju8Bvqr-DTf5O9AGTu2_T5iEtN9h6caiYWgKhI8DGQG7ugTnQMPW3WawwhiWoSOvcioxTMkWC8jJjm6QJY2EM3xY-t8%3D&u=http%3A%2F%2Fwww.circl.lu>
>
>
>
>

--
John-Mark

This publicly archived list provides a forum for asking questions,
offering answers, and discussing topics of interest on STIX,
TAXII, and CybOX.  Users and developers of solutions that leverage
STIX, TAXII and CybOX are invited to participate.

In order to verify user consent to OASIS mailing list guidelines
and to minimize spam in the list archive, subscription is required
before posting.

Subscribe: cti-users-subscribe@lists.oasis-open.org
Unsubscribe: cti-users-unsubscribe@lists.oasis-open.org
Post: cti-users@lists.oasis-open.org
List help: cti-users-help@lists.oasis-open.org
List archive: http://lists.oasis-open.org/archives/cti-users/
List Guidelines: http://www.oasis-open.org/maillists/guidelines.php
CTI Technical Committee: https://www.oasis-open.org/committees/cti/
Join OASIS: http://www.oasis-open.org/join/