<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jun 3, 2013, at 12:36 PM, Barry Warsaw <<a href="mailto:barry@python.org">barry@python.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On Jun 03, 2013, at 01:20 AM, Donald Stufft wrote:<br><br><blockquote type="cite">So I would like to propose that CPython adopt the Mozilla SSL certificate<br>list and include it in core, and switch over the API's so that they verify<br>HTTPS by default. This is what most people are going to expect when using a<br>https url (Especially after learning that Python 2.x doesn't verify TLS, but<br>Python 3.x "does").<br></blockquote><br>For the "verify HTTPS by default", do you mean specifically changing the<br>cadefault argument to urllib.request.urlopen() to True? Note that I recently<br>closed a bug related to this:<br><br><a href="http://bugs.python.org/issue17977">http://bugs.python.org/issue17977</a><br><br>+1 for changing the default to True.<br><br>-Barry<br>_______________________________________________<br>Python-Dev mailing list<br>Python-Dev@python.org<br>http://mail.python.org/mailman/listinfo/python-dev<br>Unsubscribe: http://mail.python.org/mailman/options/python-dev/donald%40stufft.io<br></blockquote></div><br><div>If that's all it takes to make sure that people have to opt out of an invalid certificate throwing</div><div>an error than yes :)</div><div><br></div><div>My goal here is to make it that when someone accesses a TLS secured network resource (I said HTTP, but if there are other things, xmlrpclib, or what not where people can reasonably expect valid TLS certificates those too) they are protected by a MITM attack by default. I worry with the current situation people will just use TLS connections without realizing it's not being verified and thinking they are "safe".</div><div><br></div><div>As with most things security the outcome of "failing" to do it right when the default is insecure is well nothing until someone attacks you. So Hopefully we make things secure by default for folks :)</div><div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><br class="Apple-interchange-newline">-----------------</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">Donald Stufft</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA</div>
</div>
<br></body></html>