please add a large NOTE explaining that urllib does not perform any ssl validation

[asdfasdfasdfasdfasdfasdfasdf]

BPO	9983
Nosy	@loewis, @orsenthil, @pitrou, @giampaolo

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2010-09-29.11:42:32.017>
created_at = <Date 2010-09-29.11:11:40.792>
labels = ['docs']
title = 'please add a large NOTE explaining that urllib does not perform any ssl validation'
updated_at = <Date 2010-09-29.21:15:37.118>
user = 'https://bugs.python.org/asdfasdfasdfasdfasdfasdfasdf'

bugs.python.org fields:

activity = <Date 2010-09-29.21:15:37.118>
actor = 'loewis'
assignee = 'docs@python'
closed = True
closed_date = <Date 2010-09-29.11:42:32.017>
closer = 'pitrou'
components = ['Documentation']
creation = <Date 2010-09-29.11:11:40.792>
creator = 'asdfasdfasdfasdfasdfasdfasdf'
dependencies = []
files = []
hgrepos = []
issue_num = 9983
keywords = []
message_count = 15.0
messages = ['117596', '117597', '117598', '117599', '117600', '117602', '117603', '117604', '117608', '117609', '117611', '117649', '117650', '117651', '117657']
nosy_count = 6.0
nosy_names = ['loewis', 'orsenthil', 'pitrou', 'giampaolo.rodola', 'docs@python', 'asdfasdfasdfasdfasdfasdfasdf']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue9983'
versions = ['Python 3.1', 'Python 2.7', 'Python 3.2']

[asdfasdfasdfasdfasdfasdfasdf]

please add a large NOTE explaining that urllib does not perform any ssl validation.

[asdfasdfasdfasdfasdfasdfasdf]

--> (out of the box)

[pitrou]

Sounds reasonable to me.
(although I would like that to change, see bpo-1589)

[asdfasdfasdfasdfasdfasdfasdf]

This is issue is in respect to https connections :)

[asdfasdfasdfasdfasdfasdfasdf]

Hi pitrou, that bug you linked to is really long can state a summary of any changes made to python and their impact - alternatively the lack of (changes) and their impact.

[pitrou]

Hi pitrou, that bug you linked to is really long can state a summary
of any changes made to python and their impact - alternatively the
lack of (changes) and their impact.

No changes yet unfortunately. As for the impact, you already know it,
since you filed this very issue :/

[pitrou]

I've added warnings for httplib, urllib, urllib2 in r85101, r85102 and r85103. The changes can take a day or two to appear online.

[asdfasdfasdfasdfasdfasdfasdf]

thank you :)

[asdfasdfasdfasdfasdfasdfasdf]

@pitrou you should also put an example of how to ACTUALLY establish a connection that can't be MITMed. Because lots of people are getting this wrong....

[pitrou]

@pitrou you should also put an example of how to ACTUALLY establish a
connection that can't be MITMed. Because lots of people are getting
this wrong....

It would require writing the code for checking hostnames that the ssl
module currently lacks, so if I write that code I'd rather add it to the
ssl module rather than as an example in the docs :)

But, yes, I agree that the situation is quite unsatisfying right now.