3 ms·

I like better security but let's be honest it's a smokescreen. Python can migrate to a non-PCI CDN if _really_ needed. It is more an excuse (and a good one, I l

I like better security but let's be honest it's a smokescreen. Python can migrate to a non-PCI CDN if _really_ needed. It is more an excuse (and a good one, I like how it sounds if I will have to tell it to my boss – we use Python 3 anyway, so it's unlikely). I was also surprised not to find this on the page. As I understand, it will vary not only across Python versions but also on systems where it's installed. A lot of fun is about to come, I think (especially from RHEL 6 where people are stuck with Python 2.6).

philh 10y ago
I have no particular knowledge about this, but I just tried with a python2.6 (from one of Amazon's EC2 images) and it seemed to work: $ /usr/bin/python26 Python 2.6.9 (unknown, Dec 17 2015, 01:08:55) [GCC 4.8.3 20140911 (Red Hat 4.8.3-9)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import json, urllib2 >>> json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version'] u'TLS 1.2' Uh, but it does have a "bad" rating for other reasons (looks like it supports some insecure cypher suites).
- smarx007 10y ago
  Actually, you are right (but should have been tested on CentOS 6&7): Linux localhost.localdomain 2.6.32-642.11.1.el6.x86_64 #1 SMP Fri Nov 18 19:25:05 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux Python 2.6.6 TLS 1.2 Linux localhost.localdomain 3.10.0-514.2.2.el7.x86_64 #1 SMP Tue Dec 6 23:06:41 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux Python 2.7.5 TLS 1.2
  - amyjess 10y ago
    Tested on RHEL 7 (actual RHEL, not CentOS), got TLS 1.2 for both: $ python2 --version Python 2.7.5 $ python2 -c "import json, urllib2; print json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version']" TLS 1.2 $ python3 --version Python 3.4.5 $ python3 -c "import json, urllib.request; print(json.loads(urllib.request.urlopen('https://www.howsmyssl.com/a/check').read().decode('UTF-8'))['tls_version'])" TLS 1.2
jayfk 10y ago
fastly is offering their services to the python community for free.
- a_b_c_d_e_f_g_h 10y ago
  And large parts of the Python community are offering their software for free. Without that software, there would be no need for a CDN or the PSF with all its "directors". The software on the other hand would do quite well without a lot of organizations that do peripheral work and take the credit.
snug 10y ago
I don't understand why fastly would have to turn off TLS 1.1 and older for everyone. The other CDNs out there are PCI compliant and still offer TLS 1.0 and even SSLv3 about a year ago.

philh 10y ago

I have no particular knowledge about this, but I just tried with a python2.6 (from one of Amazon's EC2 images) and it seemed to work: $ /usr/bin/python26 Python 2.6.9 (unknown, Dec 17 2015, 01:08:55) [GCC 4.8.3 20140911 (Red Hat 4.8.3-9)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import json, urllib2 >>> json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version'] u'TLS 1.2' Uh, but it does have a "bad" rating for other reasons (looks like it supports some insecure cypher suites).

smarx007 10y ago
Actually, you are right (but should have been tested on CentOS 6&7): Linux localhost.localdomain 2.6.32-642.11.1.el6.x86_64 #1 SMP Fri Nov 18 19:25:05 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux Python 2.6.6 TLS 1.2 Linux localhost.localdomain 3.10.0-514.2.2.el7.x86_64 #1 SMP Tue Dec 6 23:06:41 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux Python 2.7.5 TLS 1.2
- amyjess 10y ago
  Tested on RHEL 7 (actual RHEL, not CentOS), got TLS 1.2 for both: $ python2 --version Python 2.7.5 $ python2 -c "import json, urllib2; print json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version']" TLS 1.2 $ python3 --version Python 3.4.5 $ python3 -c "import json, urllib.request; print(json.loads(urllib.request.urlopen('https://www.howsmyssl.com/a/check').read().decode('UTF-8'))['tls_version'])" TLS 1.2

jayfk 10y ago

fastly is offering their services to the python community for free.

a_b_c_d_e_f_g_h 10y ago
And large parts of the Python community are offering their software for free. Without that software, there would be no need for a CDN or the PSF with all its "directors". The software on the other hand would do quite well without a lot of organizations that do peripheral work and take the credit.

snug 10y ago

I don't understand why fastly would have to turn off TLS 1.1 and older for everyone. The other CDNs out there are PCI compliant and still offer TLS 1.0 and even SSLv3 about a year ago.