[issue19508] Add warning that Python doesn't verify SSL certs by default

[Antoine Pitrou]

Antoine Pitrou added the comment:

There is already an entire section about this:
http://docs.python.org/dev/library/ssl.html#security-considerations

It's up to consumers of the API to choose their security policy, the ssl module merely provides building blocks to implement it. I think the ssl docs are sufficiently explicit about it right now, we're not going to add warnings every time we think something is important to read.

As for "developers [who] are still surprised", well, most of them shouldn't use the ssl module directly.

----------

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue19508>
_______________________________________