Re: Python standard library defaults to insecure TLS for mail protocols

[Stuart D Gathman <stuart () gathman org>]

On Thu, 1 Feb 2024, Alex Gaynor wrote:

> I'm the original author of PEP 476, which made certificate
> verification on by default for TLS. In 2014 I scoped it to HTTPS-only

> > By default, the mail protocol functions in Python's standard library do
> > not validate certificates for TLS connections. The API is surprising
> > and unintuitive. This is not a new issue, but I was surprised to learn
> > about it. Therefore, I'm sharing it here so more people know.

The API is the key issue for me.  Cabal CAs can forge certs anytime
they want anyway.  Ideally, the API would support PKCS#11, but more
importantly, IMO, there should be a simplified API where it defaults
to "trust the CABAL", but there is a callback to "veto" certs. E.g.
"only trust CA-X for these domains" would be something easy to
understand and implement in a callback.