Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 1 Feb 2024 22:52:54 -0500 (EST)
From: Stuart D Gathman <>
Subject: Re: Python standard library defaults to insecure TLS
 for mail protocols

On Thu, 1 Feb 2024, Alex Gaynor wrote:

> I'm the original author of PEP 476, which made certificate
> verification on by default for TLS. In 2014 I scoped it to HTTPS-only

>> By default, the mail protocol functions in Python's standard library do
>> not validate certificates for TLS connections. The API is surprising
>> and unintuitive. This is not a new issue, but I was surprised to learn
>> about it. Therefore, I'm sharing it here so more people know.

The API is the key issue for me.  Cabal CAs can forge certs anytime
they want anyway.  Ideally, the API would support PKCS#11, but more
importantly, IMO, there should be a simplified API where it defaults
to "trust the CABAL", but there is a callback to "veto" certs. E.g.
"only trust CA-X for these domains" would be something easy to
understand and implement in a callback.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.