Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-04-19 Thread Antoine Pitrou
On Mon, 24 Mar 2014 10:10:18 +0100 M.-A. Lemburg m...@egenix.com wrote: The OpenSSL version used for 2.7.6 is 0.9.8y. Upgrading to 1.0.0 or 1.0.1 will likely need a few minor tweaks, but not cause general breakage - at least that's my experience with the egenix-pyopenssl distribution. For

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-25 Thread Nick Coghlan
On 25 March 2014 09:04, Donald Stufft don...@stufft.io wrote: On Mar 24, 2014, at 5:38 PM, Nick Coghlan ncogh...@gmail.com wrote: While I totally agree that it would be incredibly awesome if more companies put dedicated time into developing and maintaining CPython I don't think pushing all

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-25 Thread Barry Warsaw
On Mar 25, 2014, at 06:11 PM, Nick Coghlan wrote: I actually agree with this (hence why I wrote the PEP in the first place), I just became really, really, really, annoyed with certain organisations over the course of writing the PEP drafts and that is reflected in the tone of the latest draft.

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread M.-A. Lemburg
On 23.03.2014 08:07, Nick Coghlan wrote: Open Questions == * What are the risks associated with allowing OpenSSL to be updated to new feature versions in the Windows and Mac OS X binary installers for maintenance releases? Currently we just upgrade to the appropriate

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Antoine Pitrou
Le 24/03/2014 10:10, M.-A. Lemburg a écrit : On 23.03.2014 08:07, Nick Coghlan wrote: Open Questions == * What are the risks associated with allowing OpenSSL to be updated to new feature versions in the Windows and Mac OS X binary installers for maintenance releases?

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread M.-A. Lemburg
On 24.03.2014 13:33, Antoine Pitrou wrote: Le 24/03/2014 10:10, M.-A. Lemburg a écrit : On 23.03.2014 08:07, Nick Coghlan wrote: Open Questions == * What are the risks associated with allowing OpenSSL to be updated to new feature versions in the Windows and Mac OS X binary

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Nick Coghlan
On 24 March 2014 22:39, M.-A. Lemburg m...@egenix.com wrote: On 24.03.2014 13:33, Antoine Pitrou wrote: Under Linux (and probably OS X too), the _ssl module is linked dynamically with OpenSSL: $ ldd build/lib.linux-x86_64-2.7-pydebug/_ssl.so linux-vdso.so.1 = (0x7fff3f1de000)

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Ned Deily
In article cadisq7f0cnzrfm4i8xj13j+slq63uynqkdo12czm5yeq3bf...@mail.gmail.com, Nick Coghlan ncogh...@gmail.com wrote: You also reminded me that I need to dig around for and reference Ned's email about the status of OS X and reference that (OpenSSL upgrades were a casualty of Apple's anti-GPL

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread M.-A. Lemburg
On 24.03.2014 18:23, Ned Deily wrote: In article cadisq7f0cnzrfm4i8xj13j+slq63uynqkdo12czm5yeq3bf...@mail.gmail.com, Nick Coghlan ncogh...@gmail.com wrote: You also reminded me that I need to dig around for and reference Ned's email about the status of OS X and reference that (OpenSSL

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Nikolaus Rath
Nick Coghlan ncogh...@gmail.com writes: Maintainability --- This policy does NOT represent a commitment by volunteer contributors to actually backport network security related changes from the Python 3 series to the Python 2 series. Rather, it is intended to send a clear signal

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Nick Coghlan
On 25 Mar 2014 04:00, Nikolaus Rath nikol...@rath.org wrote: Nick Coghlan ncogh...@gmail.com writes: Maintainability --- This policy does NOT represent a commitment by volunteer contributors to actually backport network security related changes from the Python 3 series to

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Donald Stufft
On Mar 24, 2014, at 5:38 PM, Nick Coghlan ncogh...@gmail.com wrote: On 25 Mar 2014 04:00, Nikolaus Rath nikol...@rath.org wrote: Nick Coghlan ncogh...@gmail.com writes: Maintainability --- This policy does NOT represent a commitment by volunteer contributors to

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Terry Reedy
On 3/24/2014 7:04 PM, Donald Stufft wrote: On Mar 24, 2014, at 5:38 PM, Nick Coghlan ncogh...@gmail.com mailto:ncogh...@gmail.com wrote: Beyond that, PEP 462 covers another way for corporate users to give back - if they want to build massive commercial enterprises on our software, they can

[Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Nick Coghlan
Several significant changes in this revision: - scope narrowed to just Python 2.7 plus permission for commercial redistributors to use the same strategy in their long term support releases - far more explicit that this is about inviting potential corporate contributors to address the situation

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Donald Stufft
On Mar 23, 2014, at 3:07 AM, Nick Coghlan ncogh...@gmail.com wrote: Several significant changes in this revision: - scope narrowed to just Python 2.7 plus permission for commercial redistributors to use the same strategy in their long term support releases - far more explicit that this is

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Chris Angelico
On Sun, Mar 23, 2014 at 6:07 PM, Nick Coghlan ncogh...@gmail.com wrote: And that's just three of the highest profile open source projects that make heavy use of Python. Given the likely existence of large amounts of legacy code that lacks the kind of automated regression test suite needed to

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Martin v. Löwis
Am 23.03.14 08:07, schrieb Nick Coghlan: Several significant changes in this revision: - scope narrowed to just Python 2.7 plus permission for commercial redistributors to use the same strategy in their long term support releases Thanks; the rationale is now much clearer, and also indicates

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Nick Coghlan
On 23 Mar 2014 18:42, Martin v. Löwis mar...@v.loewis.de wrote: Am 23.03.14 08:07, schrieb Nick Coghlan: Several significant changes in this revision: - scope narrowed to just Python 2.7 plus permission for commercial redistributors to use the same strategy in their long term support

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Antoine Pitrou
On Sun, 23 Mar 2014 17:07:24 +1000 Nick Coghlan ncogh...@gmail.com wrote: Another more critical example is the lack of SSL hostname matching in the Python 2 standard library - it is currently necessary to rely on a third party library, such as ``requests`` or ``backports.ssl_match_hostname`` to

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Paul Moore
On 23 March 2014 07:07, Nick Coghlan ncogh...@gmail.com wrote: Advance warning: while I was able to get this revision turned around pretty quickly, future revisions are likely to take a fair bit longer. It was already a rather busy month before I decided to start this discussion on top of

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Donald Stufft
On Mar 23, 2014, at 9:13 AM, Antoine Pitrou solip...@pitrou.net wrote: On Sun, 23 Mar 2014 17:07:24 +1000 Nick Coghlan ncogh...@gmail.com wrote: Another more critical example is the lack of SSL hostname matching in the Python 2 standard library - it is currently necessary to rely on a third