HelloZeroNet / HelloZeroNet/ZeroNet
Disable insecure SSL cryptos
- 主要语言
- JavaScript
- 星标
- 18.8k
- 派生
- 2.3k
- PR 合并指标
- 30 天内没有已合并 PR
描述
The default settings of `ssl` module are not considered the most secure, so Python Software Foundation wrote some [security considerations](https://docs.python.org/2/library/ssl.html#security-considerations).
According to the security considerations, SSLv2 and SSLv3 "are considered insecure and are therefore dangerous to use." The documentation provides a code snippet to disable SSLv2 and SSLv3.
```python
context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
context.options |= ssl.OP_NO_SSLv2
context.options |= ssl.OP_NO_SSLv3
```
The current SSL patch in ZeroNet redirects `PROTOCOL_SSLv3` to `PROTOCOL_SSLv23` when SSLv3 is not available. Why not redirect `PROTOCOL_SSLv3` and `PROTOCOL_SSLv2` to `PROTOCOL_SSLv23` by default?
贡献指南
这个仓库没有索引到贡献指南
评估
这个 Issue 还没有评估数据。