[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 1 Feb 2024 22:52:54 -0500 (EST)
From: Stuart D Gathman <stuart@...hman.org>
To: oss-security@...ts.openwall.com
Subject: Re: Python standard library defaults to insecure TLS
for mail protocols
On Thu, 1 Feb 2024, Alex Gaynor wrote:
> I'm the original author of PEP 476, which made certificate
> verification on by default for TLS. In 2014 I scoped it to HTTPS-only
>> By default, the mail protocol functions in Python's standard library do
>> not validate certificates for TLS connections. The API is surprising
>> and unintuitive. This is not a new issue, but I was surprised to learn
>> about it. Therefore, I'm sharing it here so more people know.
The API is the key issue for me. Cabal CAs can forge certs anytime
they want anyway. Ideally, the API would support PKCS#11, but more
importantly, IMO, there should be a simplified API where it defaults
to "trust the CABAL", but there is a callback to "veto" certs. E.g.
"only trust CA-X for these domains" would be something easy to
understand and implement in a callback.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
