Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disabled SSL context #79

Open
agajdosi opened this issue Feb 7, 2022 · 2 comments
Open

Disabled SSL context #79

agajdosi opened this issue Feb 7, 2022 · 2 comments

Comments

@agajdosi
Copy link

agajdosi commented Feb 7, 2022

Updater disables SSL, for example here: https://github.com/CGCookie/blender-addon-updater/blob/master/addon_updater.py#L672

Wouldn't it be safer to set the context?

context = ssl.create_default_context(purpose=ssl.Purpose.CLIENT_AUTH)
context.load_verify_locations(certifi.where())

Is there any reason why it is disabled? Is it good idea to enable it in our project, if we want security?

@TheDuckCow
Copy link
Collaborator

This was a change integrated after proposed by someone else using the repository, citing issues with it working in a studio setting where it was disabled. It was a bit of a niche case, but we opted for the change to increase the usability. I'm happy to revisit the point though, just need to weigh in the consequences and implications.

If you use this modified line yourself, have you found things working still as you expect generally?

@TheDuckCow
Copy link
Collaborator

Edit to add more context, this is where the issue arose: #35 (comment)

I could also be recalling a separate email chain that wasn't on github, but probably makes the most sense to go off of the situation described here. Let me know if you have any thoughts on that, otherwise I'll try to get back to this to read some more and see what the right thing to do is.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants