Re: [Python-Dev] PEP 493: HTTPS verification migration tools for Python 2.7

2016-02-24 Thread M.-A. Lemburg
On 24.02.2016 21:39, Cory Benfield wrote: > >> On 24 Feb 2016, at 12:19, M.-A. Lemburg wrote: >> >> On 24.02.2016 12:28, Cory Benfield wrote: >>> On 24 Feb 2016, at 10:32, Nick Coghlan wrote: Security Considerations --- Relative to the behaviour

Re: [Python-Dev] PEP 493: HTTPS verification migration tools for Python 2.7

2016-02-24 Thread Cory Benfield
> On 24 Feb 2016, at 12:19, M.-A. Lemburg wrote: > > On 24.02.2016 12:28, Cory Benfield wrote: >> >>> On 24 Feb 2016, at 10:32, Nick Coghlan wrote: >>> >>> Security Considerations >>> --- >>> >>> Relative to the behaviour in Python 3.4.3+ and Python 2.7.9->2.7.11, this >>

Re: [Python-Dev] PEP 493: HTTPS verification migration tools for Python 2.7

2016-02-24 Thread M.-A. Lemburg
On 24.02.2016 12:28, Cory Benfield wrote: > >> On 24 Feb 2016, at 10:32, Nick Coghlan wrote: >> >> Security Considerations >> --- >> >> Relative to the behaviour in Python 3.4.3+ and Python 2.7.9->2.7.11, this >> approach does introduce a new downgrade attack against the defau

Re: [Python-Dev] PEP 493: HTTPS verification migration tools for Python 2.7

2016-02-24 Thread Nick Coghlan
On 24 February 2016 at 21:28, Cory Benfield wrote: > > > On 24 Feb 2016, at 10:32, Nick Coghlan wrote: > > > > Security Considerations > > --- > > > > Relative to the behaviour in Python 3.4.3+ and Python 2.7.9->2.7.11, this > > approach does introduce a new downgrade attack

Re: [Python-Dev] PEP 493: HTTPS verification migration tools for Python 2.7

2016-02-24 Thread Cory Benfield
> On 24 Feb 2016, at 10:32, Nick Coghlan wrote: > > Security Considerations > --- > > Relative to the behaviour in Python 3.4.3+ and Python 2.7.9->2.7.11, this > approach does introduce a new downgrade attack against the default security > settings that potentially allows a

[Python-Dev] PEP 493: HTTPS verification migration tools for Python 2.7

2016-02-24 Thread Nick Coghlan
Hi folks, Since the last discussion back in November (just after the RHEL 7.2 release), I've rewritten PEP 493 to be a standards track PEP targeting Python 2.7.12. Barry also kindly volunteered to serve as BDFL-Delegate, so we have a clear path to pronouncement if nobody notices any new problems o