Python Software Foundation Blog

"What will happen if I do not upgrade by January 1st, 2020?"
"You will lose chances to use good tools because they will only run on Python 3, you will slow down people who depend on you and work with you."

The tone in this document is excessive and over-the-top. If the author spent half the document demonstrating (with examples) why Python3 is so great, it might actually be useful and get people upgrading like right now as they're reading it. But instead, it seems the author simply wanted to convey how sick they are of Python 2. The author does not appear to understand their users; that's their real frustration.

In life outside of Python... The transition in C/C++ from C++98 to C++11 and then C++20 (and beyond) has been quite clean and professional. There were some glaring issues with C++11 that later got patched up (e.g. rvalues but no optional, no filesystem, make_unique, etc). Most importantly, compiler support and standard distributions improved a lot. There were often clear incentives to upgrade, and it was relatively easy to stick to an old standard where necessary.

In contrast, Python has become a bit fractured, with a number of notable well-discussed but unaddressed loose ends in Python3: http://pyfound.blogspot.com/2019/05/amber-brown-batteries-included-but.html

I think the Python community has failed to present strong enough incentives for upgrading to Python3, and that's why users are sticking to Python2 and 'slowing everybody down'. The jump to C++11…

Please explain how it looks shady, because I don't understand it.

If I start a blog - completely independent of PyPy - which promotes PyPy and describes the development efforts, and I want to encourage people to support the PyPy project, then I might link to the PyPy donation page, yes?

Yet, because I'm not affiliated with the project, I can't put the blog under pypy.org.

Would my blog also be shady? If so, doesn't that mean that no one should promote donating to a project unless that promotion is done under the project's domain?

You write "Not many read the blog post, then go to Google, search for pypy and then click the link and then donate."

That would be true even if the blog post were hosted under pypy.org. That is, why would anyone donate after reading one blog post?

I would think that more people would donate after they download PyPy, try it out, and see that it's worthwhile enough to fund.

In that case, they've already found out how to get PyPy, so there's no need to "Google, search for pypy" because they've already done that.

Nor is PyPy unusual in this respect. It's hard to find projects which have both a blog and a donate page. Of the 50 so projects I looked at, the following are "shady" according to your definition:

- the PSF blog (hosted on blogspot) links to the python.org page for donations, eg, https://pyfound.blogspot.com/search?q=donate .

- The Thunderbird blog has a posting like…

> Making them use a name other than python is hardly any great hardship.

It wasn't. (And Tauthon is arguably a really cool name.)

But it does indicate that they want Python 2 dead.

> Van Rossum argued instead that if the Twisted team wants the ecosystem to evolve, they should stop supporting older Python versions and force users to upgrade. Brown acknowledged this point, but said half of Twisted users are still on Python 2 and it is difficult to abandon them.

http://pyfound.blogspot.com/2019/05/amber-brown-batteries-included-but.html

Like I said, if people were just fading out of Python 2 that wouldn't make me call them arrogant, it's when they insist that other people have to ditch Python 2 that I start to feel like there's some arrogance there.

Like I said in a another comment, the only thing you get from switching to Python 3 is Python 3 compatibility. If Python 2 remains viable (which it will) there's much less incentive to use 3.

Python 2 isn't broken or bad or anything, it's just not Python 3. We aren't being urged to switch because 2 is (so much) worse than 3 but because it's a viable competitor to it.

TL;DR The EU is working on the Cyber Resilience Act (CRA) which will be voted on the 19th of July. The current wording makes it look like it will affect open source projects that receice donations; which have contribution from corporate developers; and might break coordinated vulnerability disclousure.

If you live in the EC area, there's a link on the blog to contact to MEP.

The blog also links to other posts from OSS organisations sharing the same concer.

* https://blogs.eclipse.org/post/mike-milinkovich/european-cyber-resilience-act-potential-impact-eclipse-foundation

* https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-law-may-have.html

* https://blog.opensource.org/the-ultimate-list-of-reactions-to-the-cyber-resilience-act/

Unless something has drastically changed, PyCon covers itself and earns the PSF quite some money on top. Here are numbers from 2020:

https://thefortunate.blog/diversification-is-the-future-for-the-psf.html

> Out of USD4.5MM of revenue for the PSF in 2019, around 63% of it came from PyCon. USD1.9MM was the costs of having PyCon, which means that for every dollar spent on PyCon, the PSF gets back 1.50 dollars.

https://pyfound.blogspot.com/2020/03/psfs-projected-2020-financial-outcome.html

Obviously, the revenue has sharply dropped for a time because of COVID, but I'd be surprised if PyCon is run at a loss nowadays.

So you can assume none of your sponsorship money goes to running PyCon.

The Python Software Foundation Security Developer-in-Residence, Seth Larson, published a new white paper with Alpha-Omega titled "Slippery ZIPs and Sticky tar-pits: Security & Archives" about work to remediate 10 vulnerabilities affecting common archive format implementations such as ZIP and tar for critical Python projects.

PDF link: https://alpha-omega.dev/wp-content/uploads/sites/22/2025/10/ao_wp_102725a.pdf

PSF Blog: https://pyfound.blogspot.com/2025/10/slippery-zips-and-sticky-tar-pits-security-and-archives-white-paper.html

Alpha-Omega.dev: https://alpha-omega.dev/blog/slippery-zips-and-sticky-tar-pits-security-and-archives-white-paper-by-seth-larson-python-software-foundation/