[Python-Dev] Enable Hostname and Certificate Chain Validation (original) (raw)

Chris Angelico rosuav at gmail.com
Wed Jan 22 15:16:14 CET 2014

On Thu, Jan 23, 2014 at 1:08 AM, Jesse Noller <jnoller at gmail.com> wrote:

Now, maybe it wouldn't be a problem if the fix is an environment variable, but imagine a thousand-computer deployment and you have to tweak the environment on all of them. Feel like doing that just because the newest Python needs it? Not so much.

What's the bet that that application will be ported to python 3.4/3.5 if this is the case? I'd say approaching 0, which is ok.

Define "ported to". (This particular application isn't Python, so the specifics don't apply, but in general.) Usually that means simply "run on". Something that was written for Python 3.2 will probably run on 3.3, and on 3.4, and on 3.5 as well. You certainly wouldn't expect one small corner of it to suddenly start doing different stuff, and if you do, you'll blame Python... which would mean that you're right, that program wouldn't be run on 3.4. Is that a good thing? I don't know, but I think not. In a big company with lots of seats, every option is looking like a sysadmin's nightmare.

That said, though, I agree in principle that secure-by-default is the way to go. It's just the backward-incompatibility of changing it. I like how requests is going.

ChrisA

More information about the Python-Dev mailing list