[ic] [interchange] Fix potential "use of uninitialized value" if called during startup

Josh Lavin jlavin at endpoint.com
Mon Jun 26 22:52:09 UTC 2017


Quoting Jon Jensen (jon at endpoint.com):
> On Fri, 23 Jun 2017, Mike Heins wrote:
> 
> > > David makes a good point: Because TLS 1.2 is required for PCI DSS,
> > > and because older Perl systems are built on older OS/distros with
> > > old OpenSSL, and because almost all Interchange usage is for
> > > ecommerce, it is probably a good time for us to consider raising the
> > > minimum Perl version. We have not done this for many years, so it's
> > > a good time anyway. We should increase the Interchange release to
> > > 5.12 to indicate the break in backward compatibility.
> > > 
> > > RHEL/CentOS 6 is the oldest supported in that family, and include
> > > TLS 1.2 and Perl 5.14.1. RHEL/CentOS 7 comes with Perl 5.16.3.
> > > 
> > > Debian 7 is the oldest supported in its family, in its LTS phase. It
> > > came with Perl 5.14.2. Debian 8 comes with Perl 5.20.2, and 9 with
> > > 5.24.1.
> > > 
> > > Ubuntu 14.04 is the oldest supported, with Perl 5.18.2. Ubuntu 16.04
> > > has 5.22.1.
> > > 
> > > Based on the lowest common denominator of the above, I propose we
> > > increase the minimum Perl version to 5.14.1. That's still 6 years
> > > old, from 2011!
> > 
> > I am against this unless there is significant feature content added by
> > increasing the minimum version. Allowing // in one or two places doesn't
> > meet that bar to me.

Seeing as very little active development happens on the IC core these
days, we aren't going to gain much by using newer Perl features. If you
wish to use newer features in your custom development, then that can be
done, of course.

Further, I don't see why we would want to limit our user base by
requiring a more-recent Perl version.

There are plenty of CPAN module that still provide backwards-
compatibility for very old versions of Perl. It's not a matter of
creating that compatibility -- we already have it. So I see no reason to
abadon that now.

If you can't get the current version of IC to run on older Perls that we
claim to support, then that's another matter.

-1

-- 
Josh Lavin
End Point Corporation



More information about the interchange-users mailing list