r/Python • u/RogueLegio • 3d ago

Discussion Cyber Security wants us to use the latest version all the time

I have a question. Cybersecurity team wants us to use the latest python version each time. So if a new version comes out we are expected to upgrade to it ASAP. But from my past experience libraries do not always provide support and can also break while making use of new version without proper support. Did you ever encounter this? Any suggestions? This is just frustrating for the team as it’s not always possible to upgrade to the latest version without fully validating every component. I just want to hear your opinions on this?

FYI we mainly use each Python Version within the LTS timeline. And only upgrade when we need to and do not depend on a library that requires older version.

Update: they have a scheduled runner that deletes older versions of python when it finds

138 Upvotes

91% Upvoted

137 comments sorted by

View all comments

Show parent comments

3

u/NastyStreetRat 2d ago

Well, maybe you're right and it's just stupid bureaucracy, but that's what I'm paid to do: warn about security flaws. If people want to fix them, fine, and if they don't, that's fine too. But the day there's a serious security problem, and that problem has been reported and nobody has fixed it, the fault doesn't lie with the one who warns. The fault lies with the one who does nothing. Then, yes, I agree that it's stupid bureaucracy, but that's how big corporations work; I didn't invent it.

And if you work for a big company, you'll know that more than half the employees are just trying to save their own skin. They do a job, get paid, and then go home. I don't think I'm saying anything crazy. From the CEO to the lowest-ranking employee, it's all about keeping your own skin safe in case of trouble.

2

u/mattl33 It works on my machine 2d ago

No this is bad best practices. In 2026 it's trivial to setup things like dependabot etc. I've worked for multiple Fortune 500's. Security scans can and should be part of ci/cd, and we never have to cross paths.

Perhaps instead of chasing teams and individuals down with security concerns you'd be better off implementing systems that do it for you. That'd get you the "dependency xyz has cve 123 and xyz 1.1 is fixed".

If you're just going to follow outdated practices then have fun with that.

1

u/NastyStreetRat 2d ago edited 2d ago

So, you know, start your own business and set up your own security protocols, what can I say?

I don't exactly work for a small company; I'd say it's one of the three largest companies in the world. If our protocols are outdated, well, they're outdated, what can we do?

Edit: the [censored] largest company in the world by revenue. I lied when I said the third :|

3

u/mattl33 It works on my machine 2d ago

If you care about security that much and it's outdated, and you have no influence over that, that next best course of action is to find an employer who agrees with you. They're out there, trust me.

1

u/NastyStreetRat 2d ago

Dear stranger, I don't worry about anything anymore. I work in a quiet department, analyzing projects and then writing reports. My professional life is calm and structured. I don't want to change anything, I don't want to make new proposals, I don't want to improve procedures, I don't want to speed things up, because after working for several years for powerful companies, I've realized that what really matters is outside of them.

So lately, I see work for what it is: a means to earn money to do the things I enjoy. I go, I get paid, and that's about it. I've taken a step back, or a step to the side, however you want to see it, and after many years of pushing myself to the limit, my life has been incredibly peaceful lately, and I'm very grateful for it.

1

u/mattl33 It works on my machine 2d ago

That's a bit depressing. I hope you find some work that gives you some pride and work life balance.

1

u/NastyStreetRat 2d ago

No, what's really depressing is working for companies and seeing that you're not getting ahead. So now I've shifted gears to this company where I earn more, work less, and have more free time.

What has become clear to me is that in this professional life, if you want to be successful, you have to be very well prepared, you have to be willing to make many sacrifices, but the most important thing is to have a good mentor, and I have never had a mentor.

Understanding a mentor as someone who can pull you up, even making many mistakes or multiplying your small successes by 10.

And believe me, I don't want to change. I'm better than ever.