<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jun 3, 2013, at 5:41 PM, Antoine Pitrou <<a href="mailto:solipsis@pitrou.net">solipsis@pitrou.net</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On Mon, 3 Jun 2013 22:31:40 +0100<br>Paul Moore <<a href="mailto:p.f.moore@gmail.com">p.f.moore@gmail.com</a>> wrote:<br><blockquote type="cite"><br><blockquote type="cite">Some legit sites with proper<br>certificates still manage to muck something up administratively<br>(<a href="http://developer.quicksales.com.au">developer.quicksales.com.au</a> has a cert from RapidSSL but doesn't<br>bundle the intermediates, and I've told their devs about it, but all I<br>can do is disable cert checking). This will break code in ways that<br>will surprise people greatly. But I'd still rather the default be<br>True.<br><br></blockquote><br>I'm happy if the "will cease to work" clause only says "some sites with<br>broken security configurations may stop working" with a clear explanation<br>that it is *their* fault, not Python's. I'd also expect that the same sites<br>would fail in browsers - if not, we should also be able to make them work<br>(or face cries of "well, Internet Explorer/Firefox doesn't have a problem<br>with my site, why does Python?").<br></blockquote><br>Keep in mind that not every HTTPS service is a Web site that is meant<br>to be readable with a browser. Some are Web services, possibly internal,<br>possibly without a domain name (and, therefore, probably a non-matching<br>certificate subject name).<br></blockquote><div><br></div><div>They should need to explicitly opt in to disabling the checks that allow that to work.</div><br><blockquote type="cite"><br>Regards<br><br>Antoine.<br><br><br>_______________________________________________<br>Python-Dev mailing list<br><a href="mailto:Python-Dev@python.org">Python-Dev@python.org</a><br>http://mail.python.org/mailman/listinfo/python-dev<br>Unsubscribe: http://mail.python.org/mailman/options/python-dev/donald%40stufft.io<br></blockquote></div><br><div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><br class="Apple-interchange-newline">-----------------</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">Donald Stufft</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA</div>
</div>
<br></body></html>