RetroSearch Browse

Mon Sep 1 19:01:55 CEST 2014 · http://mail.python.org/pipermail/python-dev/2014-September/136152.html

On 01.09.2014 17:35, Nick Coghlan wrote:
> Oh, now I get what you mean - yes, sitecustomize already poses the same
> kind of problem as the proposed sslcustomize (hence the existence of the
> related command line options).

If an attacker is able to place a module like sitecustomize.py in an
import directory or any .pth file in a site-packages directory than this
Python installation is compromised. .pth files are insidious because
they are always loaded and their code is always executed. I don't see
how sslcustomize is going to make a difference here.

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from http://mail.python.org/pipermail/python-dev/2014-September/136152.html below:

Enabling certificate validation by default!