Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by smarx007 on Wednesday February 01, 2017 @05:27AM (#13539666)

I like better security but let's be honest it's a smokescreen. Python can migrate to a non-PCI CDN if _really_ needed. It is more an excuse (and a good one, I like how it sounds if I will have to tell it to my boss – we use Python 3 anyway, so it's unlikely).

I was also surprised not to find this on the page. As I understand, it will vary not only across Python versions but also on systems where it's installed. A lot of fun is about to come, I think (especially from RHEL 6 where people are stuck with Python 2.6).

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by philh on Wednesday February 01, 2017 @08:10AM (#13540409)

I have no particular knowledge about this, but I just tried with a python2.6 (from one of Amazon's EC2 images) and it seemed to work:

    $ /usr/bin/python26
    Python 2.6.9 (unknown, Dec 17 2015, 01:08:55)
    [GCC 4.8.3 20140911 (Red Hat 4.8.3-9)] on linux2
    Type "help", "copyright", "credits" or "license" for more information.
    >>> import json, urllib2
    >>> json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version']
    u'TLS 1.2'

Uh, but it does have a "bad" rating for other reasons (looks like it supports some insecure cypher suites).

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by smarx007 on Wednesday February 01, 2017 @08:45AM (#13540625)

Actually, you are right (but should have been tested on CentOS 6&7):

    Linux localhost.localdomain 2.6.32-642.11.1.el6.x86_64 #1 SMP Fri Nov 18 19:25:05 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
    Python 2.6.6
    TLS 1.2

    Linux localhost.localdomain 3.10.0-514.2.2.el7.x86_64 #1 SMP Tue Dec 6 23:06:41 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
    Python 2.7.5
    TLS 1.2

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by amyjess on Wednesday February 01, 2017 @10:14AM (#13541276)

Tested on RHEL 7 (actual RHEL, not CentOS), got TLS 1.2 for both:

    $ python2 --version
    Python 2.7.5
    $ python2 -c "import json, urllib2; print json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version']"
    TLS 1.2

    $ python3 --version
    Python 3.4.5
    $ python3 -c "import json, urllib.request; print(json.loads(urllib.request.urlopen('https://www.howsmyssl.com/a/check').read().decode('UTF-8'))['tls_version'])"
    TLS 1.2

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by jayfk on Wednesday February 01, 2017 @08:28AM (#13540524)

fastly is offering their services to the python community for free.

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by a_b_c_d_e_f_g_h on Wednesday February 01, 2017 @11:02AM (#13541705)

And large parts of the Python community are offering their software for free. Without that software, there would be no need for a CDN or the PSF with all its "directors".

The software on the other hand would do quite well without a lot of organizations that do peripheral work and take the credit.

[ Parent | on HN ]

Re:Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory by snug on Thursday February 02, 2017 @12:42AM (#13548394)

I don't understand why fastly would have to turn off TLS 1.1 and older for everyone. The other CDNs out there are PCI compliant and still offer TLS 1.0 and even SSLv3 about a year ago.

[ Parent | on HN ]