Slow Retreat from Python 2 Threatens Code Security

At least one in 10 Python developers and data scientists continue to use the legacy version of the popular programming language as their primary development tool, despite a looming deadline of Jan. 1, 2020, the official "end of life" for Python 2.

The death of the programming language means companies that continue to use the technology — often to support legacy programs — will be at risk, experts say. While vulnerabilities in the core methods of the programming language are uncommon, many Python 2 packages will also be left with no — or dramatically less — support, likely leaving legacy programs unpatched.

The result is that maintainers will no longer step in to fix even serious vulnerabilities, says Jeff Rouse, vice president of product at ActiveState, a software tools maker. 

"The primary security risk is that vulnerabilities will arise and then there is not a core team to get those things fixed in a timely fashion," he says. "And that is not just talking about code language, but the package and ecosystem as well."

As the clock counts down on Python 2, some security professionals have warned that companies that fail to move from the older version of the programming language will put their software in the crosshairs of hackers when a vulnerability is found. As of May, 13% of Python programmers still used version 2 as their primary development language. While still high, that share is half of the 25% who were using the language at the end of 2017, according to JetBrains, a market research firm.

In August, the UK's watchdog for cybersecurity concerns, the National Cyber Security Centre, warned Python programmers that they should move to the latest version of Python.

"[I]f you're still using 2.x, it's time to port your code to Python 3," the NCSC wrote. "If you continue to use unsupported modules, you are risking the security of your organisation and data, as vulnerabilities will sooner or later appear which nobody is fixing."

The Python Software Foundation has made it clear that Python 2 users will find themselves without patches starting in January.

"If people find catastrophic security problems in Python 2, or in software written in Python 2, then most volunteers will not help fix them," the group wrote in an alert on the sunsetting of Python 2.

The move from Python 2 has been more than a decade in the works. The Python Software Foundation released Python 2 in 2000 and, realizing there were many improvements the core maintainers could add to the programming language, released Python 3 in 2006. Yet developers did not move from Python 2, so a couple of years later, the Python Software Foundation announced its volunteers would stop supporting the previous major version of its increasingly popular programming language, beginning in 2015. 

Developers very slowly — half were still using Python 3 in 2013 — started moving from Python 2, but too many remained. The year before the deadline, the project leadership recognized that programmers were not cooperating, so they pushed back the deadline to Jan. 1, 2020.

Now it's time, the group said. Python 2 has been sapping too many resources for too long, the group chastised.

"If you need help with Python 2 software, then many volunteers will not help you, and over time fewer and fewer volunteers will be able to help you," the group said in a blog post. "You will lose chances to use good tools because they will only run on Python 3, and you will slow down people who depend on you and work with you."

The main problem for companies is that Python 3 is not backward-compatible with Python 2. Too many changes were made to the language. Because of those issues, it took Dropbox — a company whose services run widely on Python and that had employed the creator of Python until he retired this month — three years to convert all of its software and infrastructure from Python 2.

"Python 3 adoption has long been a subject of debate in the Python community," Dropbox  said in 2018. "This is still somewhat true, though it's now reached widespread support, with some very popular projects such as Django dropping Python 2 support entirely."

The number of packages downloaded for Python 2 continues to be in the millions per month, with almost two-thirds of downloads for the URL resource module urllib and half of the downloads of Web library requests continuing to be for Python 2.

It does not help that Python 2.7 continues to be the default version installed on Mac OS X, even on Catalina, the latest version of Apple's operating system. Other operating systems have fallen into line, however. In 2018, Ubuntu upgraded to Python 3.6 as the default in 18.04 LTS, also known as Bionic Beaver, and Red Hat dropped support for Python 2 in Red Hat Enterprise Linux 8. Python does not ship by default with Windows.

In addition, many major open source libraries have committed to dropping Python 2 in favor of Python 3 by 2020.

For companies that will not make the deadline, some software firms, such as ActiveState, are offering to extend support for security patches for Python 2.

"It is amazing that even with the amount of notice that the core team and [the Python Software Foundation] has given that enterprises have very large codebases, and they don't have the time or inclination to get off those applications when they still provide value to them," Rouse says. "Some of them are migrating but have not gotten around to it yet, while others don't plan to migrate, but they want someone to have their back. It is a situation where a lot of companies knew it was coming."

Related Content

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.