[Python-Dev] [python-committers] [RELEASED] Python 3.4.9 and Python 3.5.6 are now available

[Michael Felt]

On 8/6/2018 11:38 AM, Charalampos Stratakis wrote:
> A side note on your side note. Different distro's have different
> standards, use/customer cases to address etc. In enterprise
> distributions the usual scheme is that the version that you see is the
> minimum one and many fixes coming from upstream or the redistributor
> are incorporated on top of that version. Just check the package
> changelogs. :) CVE's do get fixed and there is actually cooperation
> with upstream on different levels in regards to those. And speaking
> here as one of the people doing that for one of the enterprise
> distros.
>
a) good to hear
b) On AIX they stayed with ssh at version 6.0 for so long, that even
with all the CVE et al included it was still extremely weak compared to
6.7 and later when they tightened the default ciphers. And yes, I fell
over the change - but was glad, in the end, to rid of weak ssh clients.
c) read package changelogs. The :) is because they are hard to read or
non-existent.

I do not mean to criticize any "enterprise" methods. My "enterprise" of
choice is AIX and when it comes to OSS I dare say everyone else does a
better job (which is why I got started with packaging in the first place
- but only what I need and/or someone requests). However, I do find it
very very hard to know what python 2.7.5 has or has not, that 2.7.15 now
has. There are, iirc, quite a few important changes. The "hard" freeze
seems to have come at roughly 2.7.8 or 2.7.9 (just a guess).

Also, as I am trying to test on other platforms it gets a bit
frustrating when the latest python3 I can find is a v3.4.X.

Might be good project developers (in general, not meant as specific to
python) to understand that version number changes are not followed -
blindly - by enterprise patch management and being too quick with
version number changes will make it more difficult for users to know
what they have.

p.s. I do not do this (packaging/patch management) for any "distro". In
that sense I am "just a consumer" who "rolls his own" when/if needed.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: pEpkey.asc
Type: application/pgp-keys
Size: 1765 bytes
Desc: not available
URL: <http://mail.python.org/pipermail/python-dev/attachments/20180807/23f39bf6/attachment.key>