RetroSearch Browse

Mon Sep 1 08:07:46 CEST 2014 · https://mail.python.org/pipermail/python-dev/2014-September/136119.html

On 31 August 2014 23:10, Nick Coghlan <ncoghlan at gmail.com> wrote:
> Assuming sslcustomize was in site-packages rather than the standard library
> directories, you would also be able to use virtual environments with an
> appropriate sslcustomize module to disable cert checking even if the
> application you were running didn't support direct configuration.

Would this mean that a malicious package could install a custom
sslcustomize.py and so add unwanted certs to the system? I guess we
have to assume that installed packages are trusted, but I just wanted
to be explicit.

Paul

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://mail.python.org/pipermail/python-dev/2014-September/136119.html below:

Enabling certificate validation by default!