Re: [PATCH v2 0/5] drop support for ancient curl

> [[PGP Signed Part:Undecided]]
> On 2021-07-22 at 07:09:59, Ævar Arnfjörð Bjarmason wrote:
>> I'll clarify this along with other fixes in a re-roll, but I think our
>> policy shouldn't have anything to do with upstream promises of support,
>> but merely the trade-off of how easy it is for us to support old
>> software & how likely it is that people use it in practice along with
>> git.
>
> I don't think I agree.  We should try to support major operating systems
> well provided we can adequately be expected to test on them, and that
> means that they should have publicly available security support.  In
> other words, a developer on the relevant operating system should be able
> to test on that OS without paying ongoing money for the privilege of doing
> so securely.

> Once an operating system is no longer supported security-wise, we should
> no longer support it, either, since we can't be expected to test or
> develop on it securely.  Nobody could responsibly run such an image on
> a CI system or test with it on an Internet-connected computer, so we
> should no longer consider it worthy of our support.

>> So as an example we still say we support Perl 5.8, which is ridiculously
>> ancient as far as any notion of upstream security support goes (and as
>> an aside, does have real DoS issues exposed by e.g. the gitweb we ship).
>> 
>> But while we could probably bump that to something more modern nowadays
>> in practice we're not a mostly-Perl project, so I haven't found it to be
>> worth it to bump it when working on the relevant code.
>
> I've actually argued in favor of bumping the version to 5.14 a long time
> ago.  I can send a patch for that.  It has a bunch of nice new features
> we could take advantage of.

>> I'm only using RHEL 5 as a shorthand for a system that's usually the
>> most ancient thing people want to build new gits with in practice.
>> 
>> It's just not the case that you can't run RHEL 5 or even RHEL 4 "safely"
>> even today. Upstream has just abandoned it, but that doesn't mean users
>> in the wild have. There's also CentOS, not everyone cares about IBM
>> corporate support policies.
>
> Yes, and CentOS has dropped support earlier than Red Hat has.
>
> Just because users want to run new versions of Git on systems that
> should long ago have been abandoned[0] does not mean we should take the
> burden of maintaining that code for them.  Since they have the source
> code, they can build and maintain Git on those old systems and apply
> any necessary patches.  If this becomes burdensome, then perhaps the
> cost of maintaining the system will be an incentive to replace it with a
> secure system.
>
> I am unconvinced that we should make it easier for people to run
> insecure operating systems because they pose a hazard to the Internet
> when connected to it.  Just because it is behind some firewall doesn't
> mean that it cannot be compromised, and once it is, it can then become
> a source of spam and abuse.  This is not an idle thought experiment; it
> does practically happen with great frequency on the Internet today.  An
> unsupported system might be acceptable if it has no network connectivity
> at all, but then it would not need a newer version of Git.