➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author christian.heimes
Recipients christian.heimes, docs@python, giampaolo.rodola, janssen, pitrou
Date 2013-11-05.22:52:07
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1383691927.99.0.022250098505.issue19508@psf.upfronthosting.co.za>
In-reply-to
Content 
Developers are still surprised that Python's ssl library doesn't validate SSL certs by default. We should add a *big* warning to the SSL module as well as to all consumers (http, ftp, imap, pop, smtp, nntp ...) that neither the CA cert chain nor the hostname are validated by default. (AFAIK only http.client does match_hostname()).
History
Date User Action Args
2013-11-05 22:52:08christian.heimessetrecipients: + christian.heimes, janssen, pitrou, giampaolo.rodola, docs@python
2013-11-05 22:52:07christian.heimessetmessageid: <1383691927.99.0.022250098505.issue19508@psf.upfronthosting.co.za>
2013-11-05 22:52:07christian.heimeslinkissue19508 messages
2013-11-05 22:52:07christian.heimescreate