[Python-Dev] PEP 466: Proposed policy change for handling network security enhancements

[Paul Moore]

On 22 March 2014 23:49, Donald Stufft <donald at stufft.io> wrote:
> In the case of requests they already have an optional dependency on
> pyopenssl. It's just many people either don't know they should use it, are
> unable to use it, or unwilling to use the python packaging tool chain
> because of its current flaws.

Do they use the new features in the Python 3.x ssl module when it's
available to give the same level of security as having pyopenssl
would, or do they use a "lowest common denominator" (i.e., 2.x
compatible) level of security when using the stdlib? If the latter,
that would be very, very sad.

Paul