Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-04-19 Thread Antoine Pitrou
On Mon, 24 Mar 2014 10:10:18 +0100 "M.-A. Lemburg" wrote: > > The OpenSSL version used for 2.7.6 is 0.9.8y. > > Upgrading to 1.0.0 or 1.0.1 will likely need a few minor tweaks, but > not cause general breakage - at least that's my experience with > the egenix-pyopenssl distribution. For the rec

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-25 Thread Barry Warsaw
On Mar 25, 2014, at 06:11 PM, Nick Coghlan wrote: >I actually agree with this (hence why I wrote the PEP in the first >place), I just became really, really, really, annoyed with certain >organisations over the course of writing the PEP drafts and that is >reflected in the tone of the latest draft.

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-25 Thread Nick Coghlan
On 25 March 2014 09:04, Donald Stufft wrote: > On Mar 24, 2014, at 5:38 PM, Nick Coghlan wrote: > While I totally agree that it would be incredibly awesome if more companies > put > dedicated time into developing and maintaining CPython I don't think pushing > all the blame on to them is accurate

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Terry Reedy
On 3/24/2014 7:04 PM, Donald Stufft wrote: On Mar 24, 2014, at 5:38 PM, Nick Coghlan mailto:ncogh...@gmail.com>> wrote: Beyond that, PEP 462 covers another way for corporate users to give back - if they want to build massive commercial enterprises on our software, they can help maintain and u

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Donald Stufft
On Mar 24, 2014, at 5:38 PM, Nick Coghlan wrote: > > On 25 Mar 2014 04:00, "Nikolaus Rath" wrote: > > > > Nick Coghlan writes: > > > Maintainability > > > --- > > > > > > This policy does NOT represent a commitment by volunteer contributors to > > > actually backport network secur

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Nick Coghlan
On 25 Mar 2014 04:00, "Nikolaus Rath" wrote: > > Nick Coghlan writes: > > Maintainability > > --- > > > > This policy does NOT represent a commitment by volunteer contributors to > > actually backport network security related changes from the Python 3 series > > to the Python 2 series

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Nikolaus Rath
Nick Coghlan writes: > Maintainability > --- > > This policy does NOT represent a commitment by volunteer contributors to > actually backport network security related changes from the Python 3 series > to the Python 2 series. Rather, it is intended to send a clear signal to > potential

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread M.-A. Lemburg
On 24.03.2014 18:23, Ned Deily wrote: > In article > , > Nick Coghlan wrote: >> You also reminded me that I need to dig around for and reference Ned's >> email about the status of OS X and reference that (OpenSSL upgrades >> were a casualty of Apple's anti-GPL crusade, so the OS X installers >>

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Ned Deily
In article , Nick Coghlan wrote: > You also reminded me that I need to dig around for and reference Ned's > email about the status of OS X and reference that (OpenSSL upgrades > were a casualty of Apple's anti-GPL crusade, so the OS X installers > were switched to static linking somewhere along

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Nick Coghlan
On 24 March 2014 22:39, M.-A. Lemburg wrote: > On 24.03.2014 13:33, Antoine Pitrou wrote: >> Under Linux (and probably OS X too), the _ssl module is linked >> dynamically with OpenSSL: >> >> $ ldd build/lib.linux-x86_64-2.7-pydebug/_ssl.so >> linux-vdso.so.1 => (0x7fff3f1de000) >> lib

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread M.-A. Lemburg
On 24.03.2014 13:33, Antoine Pitrou wrote: > Le 24/03/2014 10:10, M.-A. Lemburg a écrit : >> On 23.03.2014 08:07, Nick Coghlan wrote: >>> Open Questions >>> == >>> >>> * What are the risks associated with allowing OpenSSL to be updated to >>>new feature versions in the Windows and M

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread Antoine Pitrou
Le 24/03/2014 10:10, M.-A. Lemburg a écrit : On 23.03.2014 08:07, Nick Coghlan wrote: Open Questions == * What are the risks associated with allowing OpenSSL to be updated to new feature versions in the Windows and Mac OS X binary installers for maintenance releases? Currently

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-24 Thread M.-A. Lemburg
On 23.03.2014 08:07, Nick Coghlan wrote: > Open Questions > == > > * What are the risks associated with allowing OpenSSL to be updated to > new feature versions in the Windows and Mac OS X binary installers for > maintenance releases? Currently we just upgrade to the appropriate >

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Donald Stufft
On Mar 23, 2014, at 9:13 AM, Antoine Pitrou wrote: > On Sun, 23 Mar 2014 17:07:24 +1000 > Nick Coghlan wrote: >> Another more critical example is the lack of SSL hostname matching in the >> Python 2 standard library - it is currently necessary to rely on a third >> party library, such as ``requ

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Paul Moore
On 23 March 2014 07:07, Nick Coghlan wrote: > Advance warning: while I was able to get this revision turned around > pretty quickly, future revisions are likely to take a fair bit longer. > It was already a rather busy month before I decided to start this > discussion on top of everything else :)

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Antoine Pitrou
On Sun, 23 Mar 2014 17:07:24 +1000 Nick Coghlan wrote: > Another more critical example is the lack of SSL hostname matching in the > Python 2 standard library - it is currently necessary to rely on a third > party library, such as ``requests`` or ``backports.ssl_match_hostname`` to > obtain that f

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Nick Coghlan
On 23 Mar 2014 18:42, Martin v. Löwis wrote: > > Am 23.03.14 08:07, schrieb Nick Coghlan: > > Several significant changes in this revision: > > > > - scope narrowed to just Python 2.7 plus permission for commercial > > redistributors to use the same strategy in their long term support > > releases

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Martin v. Löwis
Am 23.03.14 08:07, schrieb Nick Coghlan: > Several significant changes in this revision: > > - scope narrowed to just Python 2.7 plus permission for commercial > redistributors to use the same strategy in their long term support > releases Thanks; the rationale is now much clearer, and also indic

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Chris Angelico
On Sun, Mar 23, 2014 at 6:07 PM, Nick Coghlan wrote: > And that's just three of the highest profile open source projects that > make heavy use of Python. Given the likely existence of large amounts of > legacy code that lacks the kind of automated regression test suite needed > to help support a m

Re: [Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Donald Stufft
On Mar 23, 2014, at 3:07 AM, Nick Coghlan wrote: > Several significant changes in this revision: > > - scope narrowed to just Python 2.7 plus permission for commercial > redistributors to use the same strategy in their long term support > releases > - far more explicit that this is about inviti

[Python-Dev] PEP 466 (round 2): Network security enhancements for Python 2.7

2014-03-23 Thread Nick Coghlan
Several significant changes in this revision: - scope narrowed to just Python 2.7 plus permission for commercial redistributors to use the same strategy in their long term support releases - far more explicit that this is about inviting potential corporate contributors to address the situation for