Hacker News Reader

Comment by smarx007 | Hacker News Reader

I like better security but let's be honest it's a smokescreen. Python can migrate to a non-PCI CDN if _really_ needed. It is more an excuse (and a good one, I like how it sounds if I will have to tell it to my boss – we use Python 3 anyway, so it's unlikely).

I was also surprised not to find this on the page. As I understand, it will vary not only across Python versions but also on systems where it's installed. A lot of fun is about to come, I think (especially from RHEL 6 where people are stuck with Python 2.6).

View on HN

I have no particular knowledge about this, but I just tried with a python2.6 (from one of Amazon's EC2 images) and it seemed to work:

    $ /usr/bin/python26
    Python 2.6.9 (unknown, Dec 17 2015, 01:08:55)
    [GCC 4.8.3 20140911 (Red Hat 4.8.3-9)] on linux2
    Type "help", "copyright", "credits" or "license" for more information.
    >>> import json, urllib2
    >>> json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version']
    u'TLS 1.2'

Uh, but it does have a "bad" rating for other reasons (looks like it supports some insecure cypher suites).

Actually, you are right (but should have been tested on CentOS 6&7):

    Linux localhost.localdomain 2.6.32-642.11.1.el6.x86_64 #1 SMP Fri Nov 18 19:25:05 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
    Python 2.6.6
    TLS 1.2

    Linux localhost.localdomain 3.10.0-514.2.2.el7.x86_64 #1 SMP Tue Dec 6 23:06:41 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
    Python 2.7.5
    TLS 1.2

Tested on RHEL 7 (actual RHEL, not CentOS), got TLS 1.2 for both:

    $ python2 --version
    Python 2.7.5
    $ python2 -c "import json, urllib2; print json.load(urllib2.urlopen('https://www.howsmyssl.com/a/check'))['tls_version']"
    TLS 1.2

    $ python3 --version
    Python 3.4.5
    $ python3 -c "import json, urllib.request; print(json.loads(urllib.request.urlopen('https://www.howsmyssl.com/a/check').read().decode('UTF-8'))['tls_version'])"
    TLS 1.2

fastly is offering their services to the python community for free.

And large parts of the Python community are offering their software for free. Without that software, there would be no need for a CDN or the PSF with all its "directors".

The software on the other hand would do quite well without a lot of organizations that do peripheral work and take the credit.

I don't understand why fastly would have to turn off TLS 1.1 and older for everyone. The other CDNs out there are PCI compliant and still offer TLS 1.0 and even SSLv3 about a year ago.

Reply on news.ycombinator.com