Hacker News Reader

As long as you are willing to spend some of that budget continuously patching and maintaining the old 2.x interpreter to address security vulns as they are discovered (IF they are discovered), sure. No need to upgrade!

"We can either do this now, slowly and carefully, or do it quickly and haphazardly when some dependency has a cve only patched in 3.x"

> What else could we be doing with that budget than patching code from 2.7 to 3.8. How do you justify that to your budget director?

Can't speak for smaller businesses, but in larger companies, there is so much "waste" that the cost in $$$ to do this is insignificant in comparison. And if you choose to spread this effort out over, say, 5 years the annual cost is miniscule.

If you haven't had the resources to port a codebase to a new language version over the course of twelve years, you clearly haven't had the resources to maintain it.