On Jun 3, 2013, at 12:36 PM, Barry Warsaw <barry@python.org> wrote:

On Jun 03, 2013, at 01:20 AM, Donald Stufft wrote:

So I would like to propose that CPython adopt the Mozilla SSL certificate
list and include it in core, and switch over the API's so that they verify
HTTPS by default. This is what most people are going to expect when using a
https url (Especially after learning that Python 2.x doesn't verify TLS, but
Python 3.x "does").

For the "verify HTTPS by default", do you mean specifically changing the
cadefault argument to urllib.request.urlopen() to True?  Note that I recently
closed a bug related to this:


+1 for changing the default to True.

Python-Dev mailing list
Unsubscribe: http://mail.python.org/mailman/options/python-dev/donald%40stufft.io

If that's all it takes to make sure that people have to opt out of an invalid certificate throwing
an error than yes :)

My goal here is to make it that when someone accesses a TLS secured network resource (I said HTTP, but if there are other things, xmlrpclib, or what not where people can reasonably expect valid TLS certificates those too) they are protected by a MITM attack by default. I worry with the current situation people will just use TLS connections without realizing it's not being verified and thinking they are "safe".

As with most things security the outcome of "failing" to do it right when the default is insecure is well nothing until someone attacks you. So Hopefully we make things secure by default for folks :)

Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA