4 ms·

My spidey sense has been acting all funny around requests since I realized it has its own vendored certificate bundle...

• mercer 7y ago
  could you elaborate?
  • ris 7y ago
    Maintaining a certificate bundle is not something to be taken lightly - it's a central root of trust, and is something that should generally be deferred to the system or user and easily configurable globally. As a system administrator if there is an advisory over a certain set of root certificates, I want to be able to address that and remove that from one or maybe two places on a system. Not wonder about every last package that thought to award itself that authority. Especially the way a lot of python packages are used - as deeply nested and possibly pinned dependencies that maybe never get updated.
• lozenge 7y ago
  "Requests uses certificates from the package certifi. This allows for users to update their trusted certificates without changing the version of Requests. Before version 2.16, Requests bundled a set of root CAs that it trusted, sourced from the Mozilla trust store. The certificates were only updated once for each Requests version. When certifi was not installed, this led to extremely out-of-date certificate bundles when using significantly older versions of Requests. For the sake of security we recommend upgrading certifi frequently!" It isn't completely clear but it sounds like they (used to) copy the Mozilla Trust Store wholesale, which isn't a particularly controversial policy. They might be one of the more open stores.