Re: FYI: Python 3 migration of distributuion

Matt Lundin <[email protected]> wrote:
> >
> > I have actually been playing with a prototype refactoring of getmail to
> > not just support but require a recent Python 3.x version.  Such a project
> > would give me the opportunity to remove a lot of historical cruft and
> > backwards-compatibility code that getmail has accumulated over 20+ years.
> >
> > Unfortunately, it's difficult to find the hours to devote to this task.  I
> > don't know when, or even if, I could have a beta release ready.
> 
> Thanks, Charles, for getmail, which I've been using happily for over a
> decade! What you've described does indeed sound like a big task, and I
> appreciate all the work you've put into this project over the years.

It's basically a re-write that copies a little bit of old code verbatim.  I'm
also trying to clean up some things from design decisions that I would make
differently today than vs. 20 years ago.

> I believe there are several volunteers (both on the Debian bug report
> and here) who have indicated that they would be willing to help port
> getmail to Python 3. Making the getmail code available on a public git
> repo would likely help with this process.

Updating the code is actually the simple part, and the smallest part.
Updating the documentation, running tests, etc is the bulk of the work.  And
it's not fun work, so no one is likely to contribute.  I've received many
dozens, perhaps hundreds of code contributions over the years - but the number
that updated the docs to match was probably 3 or 4.

Dumping my in-progress refactoring into public would result in not much help
in this regard, and a ton of support requests from people trying to use new
code with old documentation, hitting in-dev bugs, etc.

> Whatever direction the project takes, I don't think it is a viable
> option to advise people to use a v2 version of getmail going forward.
> Python 2 will stop getting security updates in April 2020, leaving users
> of a v2 getmail vulnerable to new exploits found in Python's network and
> security stack.

Not to pick on you personally, but this kind of attitude pisses me off.
Continuing to run getmail on Python 2.7 after the official support for that
version ends is almost certainly NOT a security risk.  A server under the
control of an attacker MIGHT be able to crash getmail by providing corrupt
data, but would almost certainly not be able to achieve anything like a
remote-code-execution or similar attack.  So at worst, they could cause an
*availability* issue, not a *security* one.  And if they've got control of the
server, they don't need to do this to cause availability problems -- they can
just turn the IMAP/POP server off.

So to be clear to concerned getmail users out there:  do not worry.  getmail
does not magically become "insecure" when Python2 goes out of official support
in April.  If your distribution drops it, that's unfortunate, but you can
always install and run it from the tarball from my site.  Installing getmail
is trivially easy - it doesn't even have any external dependencies as of
version 4/5.

Charles
-- 
-----------------------------------------------------------------------
Charles Cazabon
GPL'ed software available at:               http://pyropus.ca/software/
-----------------------------------------------------------------------