Validate https://api.mixpanel.com/ x509 certificate

[graingert]

This library uses urllib2 which on most versions of python does not validate x509 certificates.

Consider using the requests library?

[joeatwork]

This is a great suggestion!

In general, we want to introduce as few hard dependencies as we can, and that includes the HTTP library. That said, we've been bitten by shortcomings of system HTTP libraries a lot, and would like to make sure that people have the option of using better tools where they're available and appropriate.

A workaround for this issue until it's fixed would be to write your own consumer that uses requests rather than urllib2. We would be happy to accept pull requests that make this easier to do (and I'm filing another issue for it now, #42)

Internally, we should consider attempting to import requests, and only using urllib2 if requests can't be found.

[graingert]

I think this is worth changing so it will work with either requests
installed or python 2.7.9 so the code crashes rather than revealing the
api_key.
On 16 Feb 2015 16:47, "Joe Bowers" [email protected] wrote:

This is a great suggestion!

In general, we want to introduce as few hard dependencies as we can, and
that includes the HTTP library. That said, we've been bitten by
shortcomings of system HTTP libraries a lot, and would like to make
sure that people have the option of using better tools where they're
available and appropriate.

A workaround for this issue until it's fixed would be to write your own
consumer that uses requests rather than urllib2. We would be happy to
accept pull requests that make this easier to do (and I'm filing another
issue for it now, #42
#42)

Internally, we should consider attempting to import requests, and only
using urllib2 if requests can't be found.

Reply to this email directly or view it on GitHub
#41 (comment)
.

[krya]

+1.
on python 2.7.9 mixpanel crashes with famous exception in ssl

[seizethedave]

We now use urllib3 which validates certs by default.