RetroSearch Browse

Mon Sep 1 09:13:33 CEST 2014 · http://mail.python.org/pipermail/python-dev/2014-September/136123.html

On 01.09.2014 08:44, Nick Coghlan wrote:
> Yes, it would have exactly the same security failure modes as 
> sitecustomize, except it would only fire if the application
> imported the ssl module.
> 
> The "-S" and "-I" switches would need to disable the implied 
> "sslcustomize", just as they disable "import site".

A malicious package can already play havoc with your installation with
a custom ssl module. If somebody is able to sneak in a ssl.py then you
are screwed anyway. sslcustomize is not going to make the situation worse.

Christian

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from http://mail.python.org/pipermail/python-dev/2014-September/136123.html below:

Enabling certificate validation by default!