Antoine Pitrou <[email protected]> added the comment:
As I said, I don't think maintaining an explicit list of ciphers ourselves is
reasonable, since there are no crypto experts (AFAICT) amongst the Python core
developers.
Also, maintaining an explicit list of ciphers means people wouldn't benefit
automatically from new ciphers unless Python itself is modified.
However, as I've proposed on issue13627, we could call set_ciphers("HIGH") by
default. This excludes legacy ciphers (such as RC4, DES) without having us
maintain an explicit list.
----------
nosy: +gregory.p.smith, pitrou
stage: -> needs patch
type: -> security
versions: -Python 2.6, Python 2.7, Python 3.1, Python 3.4
_______________________________________
Python tracker <[email protected]>
<http://bugs.python.org/issue13636>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
