|
Message-ID: <916012b9-ff3-c1fe-6456-0f6fccdd234@gathman.org> Date: Thu, 1 Feb 2024 22:52:54 -0500 (EST) From: Stuart D Gathman <stuart@...hman.org> To: oss-security@...ts.openwall.com Subject: Re: Python standard library defaults to insecure TLS for mail protocols On Thu, 1 Feb 2024, Alex Gaynor wrote: > I'm the original author of PEP 476, which made certificate > verification on by default for TLS. In 2014 I scoped it to HTTPS-only >> By default, the mail protocol functions in Python's standard library do >> not validate certificates for TLS connections. The API is surprising >> and unintuitive. This is not a new issue, but I was surprised to learn >> about it. Therefore, I'm sharing it here so more people know. The API is the key issue for me. Cabal CAs can forge certs anytime they want anyway. Ideally, the API would support PKCS#11, but more importantly, IMO, there should be a simplified API where it defaults to "trust the CABAL", but there is a callback to "veto" certs. E.g. "only trust CA-X for these domains" would be something easy to understand and implement in a callback.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.