[Python-Dev] Enable Hostname and Certificate Chain Validation

Stephen J. Turnbull stephen at xemacs.org
Thu Jan 23 10:05:27 CET 2014


Donald Stufft writes:

 > As an additional side note, anecdotal evidence and what not, but
 > *every* time I bring this up somewhere I get at least one reply
 > that looks similar to
 > https://twitter.com/ojiidotch/status/425986619879866368

Hey, wait a cotton-picking minute!

Are you telling me that Perl, PHP, and Ruby *do* verify certs by
default in their "batteries included" stdlibs, and developers using
those languages have been turning that feature off in their code for,
like, you know, well, for-EVER man!?  (They surely don't leave it on,
or my employer would have fixed their broken cert chain and hostnames
by now.)

If so, that's evidence for the practicality of the proposal, and maybe
even for fast-tracking it to catch up.  My employer and the Ministry
of Education, Culture, Science, and Technology be damned (and they
will be).

But if it's only the already security-conscious developers and
managers who go WTF?, and other environments don't do this by default,
I'd consider that a "dangerous curve, slow down" sign.



More information about the Python-Dev mailing list