{"action":"opened","issue":{"url":"https://api.github.com/repos/micropython/micropython-lib/issues/69","repository_url":"https://api.github.com/repos/micropython/micropython-lib","labels_url":"https://api.github.com/repos/micropython/micropython-lib/issues/69/labels{/name}","comments_url":"https://api.github.com/repos/micropython/micropython-lib/issues/69/comments","events_url":"https://api.github.com/repos/micropython/micropython-lib/issues/69/events","html_url":"https://github.com/micropython/micropython-lib/issues/69","id":137016784,"number":69,"title":"upip doesn't appear to validate HTTPS connections","user":{"login":"ncoghlan","id":1026649,"avatar_url":"https://avatars.githubusercontent.com/u/1026649?v=3","gravatar_id":"","url":"https://api.github.com/users/ncoghlan","html_url":"https://github.com/ncoghlan","followers_url":"https://api.github.com/users/ncoghlan/followers","following_url":"https://api.github.com/users/ncoghlan/following{/other_user}","gists_url":"https://api.github.com/users/ncoghlan/gists{/gist_id}","starred_url":"https://api.github.com/users/ncoghlan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ncoghlan/subscriptions","organizations_url":"https://api.github.com/users/ncoghlan/orgs","repos_url":"https://api.github.com/users/ncoghlan/repos","events_url":"https://api.github.com/users/ncoghlan/events{/privacy}","received_events_url":"https://api.github.com/users/ncoghlan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-28T06:47:35Z","updated_at":"2016-02-28T06:47:35Z","closed_at":null,"body":"If I've understood the way ussl works correctly, the default behaviour is to skip certificate verification, as used to be the case with CPython prior to PEP 476.\r\n\r\nThis is a problem not only for ussl, but also for upip specifically, as this means any use of the \"download\" option remains subject to man-in-the-middle attacks, even when using HTTPS rather than HTTP.\r\n\r\nRather than silently creating a security failure, it would be desirable to fail to download over HTTPS if the ability to verify certificates hasn't been configured correctly (if the protocol is HTTP, it's at least obvious the connection isn't secure - the \"https\" in the URL means an unvalidated HTTPS connection *claims* to be secure, but in fact is not)."}}