Re: [Python-Dev] Sniffing passwords from PyPI using insecure connection

2011-06-03 Thread Tarek Ziadé
On Fri, Jun 3, 2011 at 11:40 PM, "Martin v. Löwis" wrote: >> I followed up on the tracker.  I'm +0 on adding this to 2.6, but not until >> after the 2.6.7 release on Friday. >> >> How well has this change been tested?  Are there people for whom this could >> break things? > > As others have pointe

Re: [Python-Dev] Sniffing passwords from PyPI using insecure connection

2011-06-03 Thread Martin v. Löwis
> I followed up on the tracker. I'm +0 on adding this to 2.6, but not until > after the 2.6.7 release on Friday. > > How well has this change been tested? Are there people for whom this could > break things? As others have pointed out: it would break systems that don't have the _ssl module buil

Re: [Python-Dev] Sniffing passwords from PyPI using insecure connection

2011-06-01 Thread Barry Warsaw
On Jun 01, 2011, at 02:33 AM, Terry Reedy wrote: >On 6/1/2011 1:37 AM, "Martin v. Löwis" wrote: >>> The requested one character change is >>> -DEFAULT_REPOSITORY = 'http://pypi.python.org/pypi' >>> +DEFAULT_REPOSITORY = 'https://pypi.python.org/pypi' >>> >>> If Tarek (or perhaps Eric) agre

Re: [Python-Dev] Sniffing passwords from PyPI using insecure connection

2011-05-31 Thread Terry Reedy
On 6/1/2011 1:37 AM, "Martin v. Löwis" wrote: The requested one character change is -DEFAULT_REPOSITORY = 'http://pypi.python.org/pypi' +DEFAULT_REPOSITORY = 'https://pypi.python.org/pypi' If Tarek (or perhaps Eric) agree that it is appropriate and otherwise innocuous, then Martin and Ba

Re: [Python-Dev] Sniffing passwords from PyPI using insecure connection

2011-05-31 Thread Martin v. Löwis
> The requested one character change is > -DEFAULT_REPOSITORY = 'http://pypi.python.org/pypi' > +DEFAULT_REPOSITORY = 'https://pypi.python.org/pypi' > > If Tarek (or perhaps Eric) agree that it is appropriate and otherwise > innocuous, then Martin and Barry can decide whether to include in

Re: [Python-Dev] Sniffing passwords from PyPI using insecure connection

2011-05-31 Thread Terry Reedy
On 5/31/2011 1:04 PM, anatoly techtonik wrote: Hi, I'd like to escalate http://bugs.python.org/issue12226 : 'use secured channel for uploading packages to pypi' to be shipped with next Python 2.6+ This will prevent pydotorg password sniffing when submitting packages through public networks (such

[Python-Dev] Sniffing passwords from PyPI using insecure connection

2011-05-31 Thread anatoly techtonik
Hi, I'd like to escalate http://bugs.python.org/issue12226 : 'use secured channel for uploading packages to pypi' to be shipped with next Python 2.6+ This will prevent pydotorg password sniffing when submitting packages through public networks (such as hotels). -- anatoly t. _