Re: SSL support in Pyro4?

On 12-3-2013 0:21, mike pedeupe wrote:
> Hello.  I know that Pyro4 doesn't support SSL and it is still listed in the TODO list. 
> I'm wondering if you have any near term plans for implementing SSL?  I read a very old
> post that said you hadn't had many requests to include SSL.  I would at least like to
> add my voice to those requesting the feature.
>  
> I am using the monitoring tool Shinken.  It uses pyro and currently supports both 3 and
> 4.  I believe the developer is planning on focusing on Pyro4 and eventually deprecating
> Pyro3 support.  It is very important to my implementation to have the traffic secure. 
> I'm hoping that you will consider implementing that security in Pyro4. 
>  
> It makes a lot of sense to me that a library intended to facilitate communication over a
> network would provide some sort of built-in encryption to secure the traffic.  But, if
> you aren't getting a lot of requests for the feature, maybe developers aren't using your
> library in this way, or they are still using Pyro3?

To be honest, I'm not sure. I suspect they either use the (sketchy) SSL-support in
Pyro3, or simply use Pyro4 on an internal network where no SSL based security is
necessary. Or maybe they use Pyro4 over a secure connection provided by third party
tools such as SSH-tunnels or a VPN.

It's hard to add truly secure SSL support and I've got very little experience with doing
so. That is why I've not yet implemented it, and am very hesitant to actually try to add
it to Pyro4. I foresee great risks: simplistic SSL support could convey a false sense of
security. I would very much like to be corrected on this though :-)

(also, plain SSL is a PITA is it not? Wouldn't it be better if the security was provided
by SSH and their infrastructure of public/private keys or pass-phrases instead of
SSL-certificates?)

>  
> Thanks for the work you have done.

You're welcome and I'm happy to hear you've been using Shinken+Pyro in your projects.
I've registered your voice for SSL support in Pyro4 but my arguments above still stand.
Finishing the IPV6 support and non-pickle serializer support are both still higher on
the priority list than implementing SSL/SSH support.


Any idea when Shinken is phasing out Pyro3 support?

Irmen de Jong


------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar