RetroSearch Browse

Mon Sep 1 15:34:30 CEST 2014 · http://mail.python.org/pipermail/python-dev/2014-September/136139.html

On Mon, 1 Sep 2014 23:24:39 +1000
Chris Angelico <rosuav at gmail.com> wrote:
> On Mon, Sep 1, 2014 at 10:41 PM, Antoine Pitrou <antoine at python.org> wrote:
> > Not sure why. Just put another module named "ssl" in sys.modules directly.
> > You can also monkeypatch the genuine ssl module.
> 
> That has to be done inside the same process. But imagine this
> scenario: You have a program that gets invoked as root (or some other
> user than yourself), and you're trying to fiddle with what it sees.
> You don't have root access, but you can manipulate the file system, to
> the extent that your userid has access. What can you do to affect this
> other program?

If you're root you shouldn't run untrusted code. See
https://docs.python.org/3/using/cmdline.html#cmdoption-I

Regards

Antoine.

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from http://mail.python.org/pipermail/python-dev/2014-September/136139.html below:

Enabling certificate validation by default!