[Python-Dev] Validating SSL By Default (aka Including a Cert Bundle in CPython)

[Donald Stufft]

On Jun 3, 2013, at 12:36 PM, Barry Warsaw <barry at python.org> wrote:

> On Jun 03, 2013, at 01:20 AM, Donald Stufft wrote:
> 
>> So I would like to propose that CPython adopt the Mozilla SSL certificate
>> list and include it in core, and switch over the API's so that they verify
>> HTTPS by default. This is what most people are going to expect when using a
>> https url (Especially after learning that Python 2.x doesn't verify TLS, but
>> Python 3.x "does").
> 
> For the "verify HTTPS by default", do you mean specifically changing the
> cadefault argument to urllib.request.urlopen() to True?  Note that I recently
> closed a bug related to this:
> 
> http://bugs.python.org/issue17977
> 
> +1 for changing the default to True.
> 
> -Barry
> _______________________________________________
> Python-Dev mailing list
> Python-Dev at python.org
> http://mail.python.org/mailman/listinfo/python-dev
> Unsubscribe: http://mail.python.org/mailman/options/python-dev/donald%40stufft.io

If that's all it takes to make sure that people have to opt out of an invalid certificate throwing
an error than yes :)

My goal here is to make it that when someone accesses a TLS secured network resource (I said HTTP, but if there are other things, xmlrpclib, or what not where people can reasonably expect valid TLS certificates those too) they are protected by a MITM attack by default. I worry with the current situation people will just use TLS connections without realizing it's not being verified and thinking they are "safe".

As with most things security the outcome of "failing" to do it right when the default is insecure is well nothing until someone attacks you. So Hopefully we make things secure by default for folks :)

-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/python-dev/attachments/20130603/39ff8f6a/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 841 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://mail.python.org/pipermail/python-dev/attachments/20130603/39ff8f6a/attachment-0001.pgp>