Re: Python ssl handling could be better...

[bk <chort0 () gmail com>]

On Mar 4, 2011, at 7:53 AM, Michael Krymson wrote:

> The problem with this discussion is simply one of definition of security. For some, security is entirely black and 
> white. 

I can't speak for others, but I don't see anything as black & white.  What I'm railing against is FALSE security.  If 
it can be trivially broken, it shouldn't be labeled as security.  Python has an incomplete implementation of SSL.  The 
protocol was not designed to be used w/o authentication.  It's lazy people who took it out.  One cannot implement a 
lock without pins.  If anyone can walk up and turn the plug, it has no value and if someone is selling that to you to 
make your house safe, they would be sued.

If we're talking about whether a certain key length would take 20 years vs. implementing more operations to make it 
last for 50 years, that's a discussion of acceptable levels of risk and it comes down to what's appropriate for the 
data you're protecting.  If you're talking about whether it takes 5 minutes to download a sniffing program vs. taking 
10 minutes to download and configure tools to MITM a connection, that's not shades of grey.  It's freakin broken.

>  
> These people probably tend to be those who've actually had jobs in general digital defense...

LOL, really?  Have you seen http://extendedsubset.com/?page_id=2 (Marsh Ray)?  What about 
http://www.sentinelchicken.com/advisories/ (Tim).  

I've worked in security roles since 2000 and I'm credited in http://support.apple.com/kb/HT2009 .

--
chort


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/