[Python-Dev] Enable Hostname and Certificate Chain Validation

[John Yeuk Hon Wong]

On 1/22/14 8:16 AM, Nick Coghlan wrote:
> Which is exactly the way most non-web-specialists working inside the 
> comfort of corporate and academic firewalls will react to a change 
> that breaks their access to internal applications, where self-signed 
> certs and improperly configured internal CAs are endemic (of course, 
> that's assuming they're using HTTPS at all, which I admit is an 
> optimistic assumption).
The number of people who are using 3.4+ in these environments is 
probably very very low to be honest. I don't have a number to prove, but 
in that environment people are more likely to still be using 2.6+. I 
think a deprecation in 2.7+ would be nice, but forward we should just 
enable it by default.

When requests changed property calls (e.g. requests.json) to callable 
instead of an attribute(from requests.json to requests.json()), I was 
shocked. I had to figure out by Googling it. I found out from github 
issue....

I think a hard fail is somehow necessary.

Also, a lot of people overlook at deprecation warnings. They either 
don't care or don't see it. I see a lot of deprecation warnings in the 
older applications I write, but I can careless until it breaks. So as we 
moving forward, we can break it. For those stuck behind, deprecation is 
the right approach.

John