8 ms·

Time to Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory

155 points by trurl42 10y ago

mauntz 10y ago
I am running a Python 2.7.13 installed with official Python installer on macOS Sierra (10.12.3). Besides the built-in openssl (0.9.8zh) which came along with the macOS (/usr/bin/openssl), I have a newer version (1.0.2j) installed with macports (/opt/local/bin/openssl). However, even though I have configured my path variables that it will use the macports openssl-files, the Python installer seems to link by default to the /usr/... openssl-files. I've tried quite a bit re-installing Python (with the installer and building it from source; the latter failed with some obscure error I wasn't able to resolve), so I was wondering whether there are any better options. Upgrading via homebrew seems simple enough, but due to using macports, I'd rather not use homebrew. Furthermore, I am a bit reluctant to use the macports-python, but might do that if you were to suggest me that this is the only viable solution. I'd be happy to hear your suggestions on this!
- Lukasa 10y ago
  The python.org official installers are all linked against the system OpenSSL. You need to build from source to avoid that. I recommend getting Python from macports in this case, as they should allow you to link against their provided OpenSSL.
  - pvg 10y ago
    The 3.6 macOS installer is bundled with its own, recent version of OpenSSL and supports TLS 1.2.
    - mauntz 10y ago
      Thanks for your replies! It's as I feared then. The switch to macports luckily isn't all that painful.
- pvg 10y ago
  The macports Python works fine, if you are able to use Python 3 you can also just use the official installer instead.
esseti 10y ago
the article points to http://docs.python-guide.org/en/latest/starting/install/osx/ http://docs.python-guide.org/en/latest/starting/install/osx/ which tells you to "You do not need to install or configure anything else to use Python." However, it suggest to install python via homebrew. Just for reference, if you install it with `brew install python` then you may also need to do a `brew link --overwrite python` then it works.
JoshTriplett 10y ago
The most interesting bit about this is the mention that PCI compliance now requires this. As much as PCI seems like security theater, that change in particular may help move people forward.
godzillabrennus 10y ago
There is so much legacy code written in Python 2 that I can't imagine someone isn't going to have a large enough need that they will backport TLS support. Am I missing something on why that wouldn't work?
- Macha 10y ago
  The value proposition might be there if the alternative was a python 3 port, but if you're installing packages of pypi these days it's unlikely you're running python <2.6 and I'm not sure a Python 2.6 -> 2.7.9 upgrade is of comparable difficulty to adding TLS 1.2 support to python < 2.7.9. I mean, I know there's some old versions of Red Hat and co knocking about with 2.4 but you're probably better off to use your system package manager for those these days.
  - smarx007 10y ago
    In RHEL those old Python interpreters are available precisely via the system package manager. And they won't support you if you install Python from a 3rd party RPM as I understand.
    - srssays 10y ago
      And people pay money for that?
      - lmm 10y ago
        Yes. There are people who value support for a fixed version for 10 or more years much more than they'd value "rolling" support for a "latest" version that they have to keep updating their apps for.
        srssays 10y ago
        But none of the packages they use will be up-to-date. e.g. Django dropped support for 2.6 years ago and will drop support for 2.7 soon.
therealmarv 10y ago
what is the minimum version then? 2.7.x <- what x?
- Macha 10y ago
  Likely 9, the Python 3 SSL improvements were backported to that version
  - Lukasa 10y ago
    No, the OpenSSL version is the only relevant factor here.
- jwilk 10y ago
  It's OpenSSL version that matters.
smarx007 10y ago
I like better security but let's be honest it's a smokescreen. Python can migrate to a non-PCI CDN if _really_ needed. It is more an excuse (and a good one, I like how it sounds if I will have to tell it to my boss – we use Python 3 anyway, so it's unlikely). I was also surprised not to find this on the page. As I understand, it will vary not only across Python versions but also on systems where it's installed. A lot of fun is about to come, I think (especially from RHEL 6 where people are stuck with Python 2.6).
- philh 10y ago
  I have no particular knowledge about this, but I just tried with a python2.6 (from one of Amazon's EC2 images) and it seemed to work: $ /usr/bin/python26 Python 2.6.9 (unknown, Dec 17 2015, 01:08:55) [GCC 4.8.3 20140911 (Red Hat 4.8.3-9)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import json, urllib2 >>> json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version'] u'TLS 1.2' Uh, but it does have a "bad" rating for other reasons (looks like it supports some insecure cypher suites).
  - smarx007 10y ago
    Actually, you are right (but should have been tested on CentOS 6&7): Linux localhost.localdomain 2.6.32-642.11.1.el6.x86_64 #1 SMP Fri Nov 18 19:25:05 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux Python 2.6.6 TLS 1.2 Linux localhost.localdomain 3.10.0-514.2.2.el7.x86_64 #1 SMP Tue Dec 6 23:06:41 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux Python 2.7.5 TLS 1.2
    - amyjess 10y ago
      Tested on RHEL 7 (actual RHEL, not CentOS), got TLS 1.2 for both: $ python2 --version Python 2.7.5 $ python2 -c "import json, urllib2; print json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version']" TLS 1.2 $ python3 --version Python 3.4.5 $ python3 -c "import json, urllib.request; print(json.loads(urllib.request.urlopen('https://www.howsmyssl.com/a/check').read().decode('UTF-8'))['tls_version'])" TLS 1.2
jwilk 10y ago
Test procedure that doesn't require 3rd-party libs: * For Python 2: $ python -c "import json, urllib2; print json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version']" * For Python 3: $ python3 -c "import json, urllib.request; print(json.loads(urllib.request.urlopen('https://www.howsmyssl.com/a/check').read().decode('UTF-8'))['tls_version'])"
- xyproto 10y ago
  I get TLS 1.2 for both Python2 and Python3. Latest Arch Linux.
  - deleted 10y ago
    [deleted]
  - dotancohen 10y ago
    Same on CentOS 7.3.
    - jimmaswell 10y ago
      Same on Windows 8.1 with python 2.
- 3pt14159 10y ago
  I don't know if it matters to anyone, but stock OS X (I develop on an Ubuntu partition) shows TLS 1.0.
  - skykooler 10y ago
    As it says in the article, Apple has not updated their system Python in a long time, so soon you will not be able to Pip install packages using system python.
    - larkost 10y ago
      The real issue is not that Apple has not updated Python, but rather that about 4 years ago Apple depreciated OpenSSL. So the OpenSSL library included on MacOS has not seen a major update since then (only back-ported fixes). The article does an o.k. job of explaining this in note 2, but fails to mention that this has been a known problem for over 4 years, and little has been done in the mean time. Only now that there is a looming deadline does there seem to be any motion on it, and it is obvious that they are going to miss the deadline. I do think that they are missing a fairly simple solution for the majority of use cases: move things like `urllib2` to use `libcurl` underneath rather than OpenSSL. The CURL project has already solved this problem by being portable to things like Apple's CommonCrypto library and Window's security libraries. I should also note that the article's suggested workarounds are less then ideal as both use versions of OpenSSL that do not consult the system keychain for root certificates, and so create strange problems that most people will not understand.
wbond 10y ago
Over the past two years I've been working on a cross-platform crypto library for Python. One of the aspects of it is that it doesn't require a compiler (it uses ctypes or cffi), and works with the cryptography libraries shipped via your OS. Part of this library is a TLS implementation that uses SecureTransport on OS X. If someone is inclined to get requests (and pip, etc) running on the system Python on OS X, it should be possible with the guidance outlined at https://github.com/wbond/oscrypto/issues/10 https://github.com/wbond/oscrypto/issues/10. Unfortunately, it isn't something I have time to work on right now.
nul_byte 10y ago
Be nice if pypi stopped using MD5 for integrity checking as well.
deleted 10y ago
[deleted]
teilo 10y ago
On macOS, Homebrew's Python links against it's own openssl which is currently @1.1, so that is the easiest way to avoid this problem (unless one is a homebrew hater).
davidf18 10y ago
I'm getting TLS 1.2 using anaconda on the latest update of Mac Sierra (10.12.3). The openssl is one installed by the conda command of anaconda, openssl version: 1.0.2j-0 I also have homebrew on the system, but not used in this case. Is there any reason not to use anaconda on Mac?
- kalefranz 10y ago
  FYI conda update openssl will give you the latest 1.0.2k. Continuum does a good job at getting OpenSSL updates out within hours of their upstream release.
- bixmix 10y ago
  There's no explicit reason not to use anaconda if you're okay with being vendor locked to anaconda's interpreter/environment. Anaconda is primarily developed with the data scientist in mind over the software developer. And the ecosystem Continuum Analytics has built with Anaconda reflects that design/vision.

155 points by trurl42 10y ago

I am running a Python 2.7.13 installed with official Python installer on macOS Sierra (10.12.3). Besides the built-in openssl (0.9.8zh) which came along with the macOS (/usr/bin/openssl), I have a newer version (1.0.2j) installed with macports (/opt/local/bin/openssl). However, even though I have configured my path variables that it will use the macports openssl-files, the Python installer seems to link by default to the /usr/... openssl-files. I've tried quite a bit re-installing Python (with the installer and building it from source; the latter failed with some obscure error I wasn't able to resolve), so I was wondering whether there are any better options. Upgrading via homebrew seems simple enough, but due to using macports, I'd rather not use homebrew. Furthermore, I am a bit reluctant to use the macports-python, but might do that if you were to suggest me that this is the only viable solution. I'd be happy to hear your suggestions on this!

Lukasa 10y ago
The python.org official installers are all linked against the system OpenSSL. You need to build from source to avoid that. I recommend getting Python from macports in this case, as they should allow you to link against their provided OpenSSL.
- pvg 10y ago
  The 3.6 macOS installer is bundled with its own, recent version of OpenSSL and supports TLS 1.2.
  - mauntz 10y ago
    Thanks for your replies! It's as I feared then. The switch to macports luckily isn't all that painful.
pvg 10y ago
The macports Python works fine, if you are able to use Python 3 you can also just use the official installer instead.

esseti 10y ago

the article points to http://docs.python-guide.org/en/latest/starting/install/osx/ http://docs.python-guide.org/en/latest/starting/install/osx/ which tells you to "You do not need to install or configure anything else to use Python." However, it suggest to install python via homebrew. Just for reference, if you install it with `brew install python` then you may also need to do a `brew link --overwrite python` then it works.

JoshTriplett 10y ago

The most interesting bit about this is the mention that PCI compliance now requires this. As much as PCI seems like security theater, that change in particular may help move people forward.

godzillabrennus 10y ago

There is so much legacy code written in Python 2 that I can't imagine someone isn't going to have a large enough need that they will backport TLS support. Am I missing something on why that wouldn't work?

Macha 10y ago
The value proposition might be there if the alternative was a python 3 port, but if you're installing packages of pypi these days it's unlikely you're running python <2.6 and I'm not sure a Python 2.6 -> 2.7.9 upgrade is of comparable difficulty to adding TLS 1.2 support to python < 2.7.9. I mean, I know there's some old versions of Red Hat and co knocking about with 2.4 but you're probably better off to use your system package manager for those these days.
- smarx007 10y ago
  In RHEL those old Python interpreters are available precisely via the system package manager. And they won't support you if you install Python from a 3rd party RPM as I understand.
  - srssays 10y ago
    And people pay money for that?
    - lmm 10y ago
      Yes. There are people who value support for a fixed version for 10 or more years much more than they'd value "rolling" support for a "latest" version that they have to keep updating their apps for.
      - srssays 10y ago
        But none of the packages they use will be up-to-date. e.g. Django dropped support for 2.6 years ago and will drop support for 2.7 soon.

therealmarv 10y ago

what is the minimum version then? 2.7.x <- what x?

Macha 10y ago
Likely 9, the Python 3 SSL improvements were backported to that version
- Lukasa 10y ago
  No, the OpenSSL version is the only relevant factor here.
jwilk 10y ago
It's OpenSSL version that matters.

smarx007 10y ago

I like better security but let's be honest it's a smokescreen. Python can migrate to a non-PCI CDN if _really_ needed. It is more an excuse (and a good one, I like how it sounds if I will have to tell it to my boss – we use Python 3 anyway, so it's unlikely). I was also surprised not to find this on the page. As I understand, it will vary not only across Python versions but also on systems where it's installed. A lot of fun is about to come, I think (especially from RHEL 6 where people are stuck with Python 2.6).

philh 10y ago
I have no particular knowledge about this, but I just tried with a python2.6 (from one of Amazon's EC2 images) and it seemed to work: $ /usr/bin/python26 Python 2.6.9 (unknown, Dec 17 2015, 01:08:55) [GCC 4.8.3 20140911 (Red Hat 4.8.3-9)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import json, urllib2 >>> json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version'] u'TLS 1.2' Uh, but it does have a "bad" rating for other reasons (looks like it supports some insecure cypher suites).
- smarx007 10y ago
  Actually, you are right (but should have been tested on CentOS 6&7): Linux localhost.localdomain 2.6.32-642.11.1.el6.x86_64 #1 SMP Fri Nov 18 19:25:05 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux Python 2.6.6 TLS 1.2 Linux localhost.localdomain 3.10.0-514.2.2.el7.x86_64 #1 SMP Tue Dec 6 23:06:41 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux Python 2.7.5 TLS 1.2
  - amyjess 10y ago
    Tested on RHEL 7 (actual RHEL, not CentOS), got TLS 1.2 for both: $ python2 --version Python 2.7.5 $ python2 -c "import json, urllib2; print json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version']" TLS 1.2 $ python3 --version Python 3.4.5 $ python3 -c "import json, urllib.request; print(json.loads(urllib.request.urlopen('https://www.howsmyssl.com/a/check').read().decode('UTF-8'))['tls_version'])" TLS 1.2

jwilk 10y ago

Test procedure that doesn't require 3rd-party libs: * For Python 2: $ python -c "import json, urllib2; print json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version']" * For Python 3: $ python3 -c "import json, urllib.request; print(json.loads(urllib.request.urlopen('https://www.howsmyssl.com/a/check').read().decode('UTF-8'))['tls_version'])"

xyproto 10y ago
I get TLS 1.2 for both Python2 and Python3. Latest Arch Linux.
- deleted 10y ago
  [deleted]
- dotancohen 10y ago
  Same on CentOS 7.3.
  - jimmaswell 10y ago
    Same on Windows 8.1 with python 2.
3pt14159 10y ago
I don't know if it matters to anyone, but stock OS X (I develop on an Ubuntu partition) shows TLS 1.0.
- skykooler 10y ago
  As it says in the article, Apple has not updated their system Python in a long time, so soon you will not be able to Pip install packages using system python.
  - larkost 10y ago
    The real issue is not that Apple has not updated Python, but rather that about 4 years ago Apple depreciated OpenSSL. So the OpenSSL library included on MacOS has not seen a major update since then (only back-ported fixes). The article does an o.k. job of explaining this in note 2, but fails to mention that this has been a known problem for over 4 years, and little has been done in the mean time. Only now that there is a looming deadline does there seem to be any motion on it, and it is obvious that they are going to miss the deadline. I do think that they are missing a fairly simple solution for the majority of use cases: move things like `urllib2` to use `libcurl` underneath rather than OpenSSL. The CURL project has already solved this problem by being portable to things like Apple's CommonCrypto library and Window's security libraries. I should also note that the article's suggested workarounds are less then ideal as both use versions of OpenSSL that do not consult the system keychain for root certificates, and so create strange problems that most people will not understand.

wbond 10y ago

Over the past two years I've been working on a cross-platform crypto library for Python. One of the aspects of it is that it doesn't require a compiler (it uses ctypes or cffi), and works with the cryptography libraries shipped via your OS. Part of this library is a TLS implementation that uses SecureTransport on OS X. If someone is inclined to get requests (and pip, etc) running on the system Python on OS X, it should be possible with the guidance outlined at https://github.com/wbond/oscrypto/issues/10 https://github.com/wbond/oscrypto/issues/10. Unfortunately, it isn't something I have time to work on right now.

nul_byte 10y ago

Be nice if pypi stopped using MD5 for integrity checking as well.

deleted 10y ago

[deleted]

teilo 10y ago

On macOS, Homebrew's Python links against it's own openssl which is currently @1.1, so that is the easiest way to avoid this problem (unless one is a homebrew hater).

davidf18 10y ago

I'm getting TLS 1.2 using anaconda on the latest update of Mac Sierra (10.12.3). The openssl is one installed by the conda command of anaconda, openssl version: 1.0.2j-0 I also have homebrew on the system, but not used in this case. Is there any reason not to use anaconda on Mac?

kalefranz 10y ago
FYI conda update openssl will give you the latest 1.0.2k. Continuum does a good job at getting OpenSSL updates out within hours of their upstream release.
bixmix 10y ago
There's no explicit reason not to use anaconda if you're okay with being vendor locked to anaconda's interpreter/environment. Anaconda is primarily developed with the data scientist in mind over the software developer. And the ecosystem Continuum Analytics has built with Anaconda reflects that design/vision.