{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":21885184,"defaultBranch":"main","name":"needtoknow","ownerLogin":"Smattr","currentUserCanPush":false,"isFork":false,"isEmpty":false,"createdAt":"2014-07-16T03:29:00.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/203893?v=4","public":true,"private":false,"isOrgOwned":false},"refInfo":{"name":"","listCacheKey":"v0:1651427116.5503302","currentOid":""},"activityList":{"items":[{"before":"2fcef19f9a4522567b079a0d7065cec757344292","after":"62d39a4ed561dd77a89674ad875312d3b4bc8c64","ref":"refs/heads/main","pushedAt":"2024-06-08T02:07:37.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"Smattr","name":"Matthew Fernandez","path":"/Smattr","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/203893?s=80&v=4"},"commit":{"message":"fix: save received 'ETag' and 'Last-Modified'\n\nIn attempting to use these, we were passing them to the server and looking at\nthe result we received but never actually saving this result for next time. This\nbug undermined the entire utility of this logic. Thanks to rachelbythebay for\ndebugging this with me.","shortMessageHtmlLink":"fix: save received 'ETag' and 'Last-Modified'"}},{"before":"3aeadfd9fd7c80151a63f847a7ec79546c875f9d","after":"2fcef19f9a4522567b079a0d7065cec757344292","ref":"refs/heads/main","pushedAt":"2024-06-02T21:20:33.000Z","pushType":"push","commitsCount":5,"pusher":{"login":"Smattr","name":"Matthew Fernandez","path":"/Smattr","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/203893?s=80&v=4"},"commit":{"message":"also anticipate IMAP4 errors","shortMessageHtmlLink":"also anticipate IMAP4 errors"}},{"before":"c6a957c345338d463b0e9b2e6676070f7a6051e7","after":"3aeadfd9fd7c80151a63f847a7ec79546c875f9d","ref":"refs/heads/main","pushedAt":"2024-02-02T06:28:47.000Z","pushType":"push","commitsCount":3,"pusher":{"login":"Smattr","name":"Matthew Fernandez","path":"/Smattr","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/203893?s=80&v=4"},"commit":{"message":"fix: validate SSL certificates for IMAP connections\n\nThe Python docs say:¹\n\n  _ssl_context_ is a `ssl.SSLContext` object which allows bundling SSL\n  configuration options, certificates and private keys into a single\n  (potentially long-lived) structure. Please read Security considerations\n  for best practices.\n  …\n  For client use, if you don’t have any special requirements for your security\n  policy, it is highly recommended that you use the `create_default_context()`\n  function to create your SSL context. It will load the system’s trusted CA\n  certificates, enable certificate validation and hostname checking, and try to\n  choose reasonably secure protocol and cipher settings.\n  …\n  By contrast, if you create the SSL context by calling the `SSLContext`\n  constructor yourself, it will not have certificate validation nor hostname\n  checking enabled by default.\n\nWhile this is clear, it is counter-intuitive behaviour of which I was unaware.\nI only learned of this through an oss-sec posting.² This issue seems to have a\nlong history and we are not the only software affected by it.³\n\n¹ https://docs.python.org/3/library/imaplib.html#imaplib.IMAP4_SSL\n² https://www.openwall.com/lists/oss-security/2024/02/01/4\n³ https://github.com/python/cpython/issues/91826,\n  https://peps.python.org/pep-0476/,\n  https://github.com/python/cpython/pull/91875,\n  https://www.pentagrid.ch/en/blog/python-mail-libraries-certificate-verification/,\n  https://github.com/python/peps/pull/3537","shortMessageHtmlLink":"fix: validate SSL certificates for IMAP connections"}},{"before":"09dde5e1fb823f57efd00f6b97152c04488d1776","after":"c6a957c345338d463b0e9b2e6676070f7a6051e7","ref":"refs/heads/main","pushedAt":"2023-08-24T09:24:06.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"Smattr","name":"Matthew Fernandez","path":"/Smattr","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/203893?s=80&v=4"},"commit":{"message":"use a temp file then rename when writing resources\n\nThis avoids a problem where needtoknow can be interrupted while writing\nresources and exit abruptly, leaving a resource file corrupted.","shortMessageHtmlLink":"use a temp file then rename when writing resources"}}],"hasNextPage":false,"hasPreviousPage":false,"activityType":"all","actor":null,"timePeriod":"all","sort":"DESC","perPage":30,"startCursor":"Y3Vyc29yOnYyOpK7MjAyNC0wNi0wOFQwMjowNzozNy4wMDAwMDBazwAAAARftuO-","endCursor":"Y3Vyc29yOnYyOpK7MjAyMy0wOC0yNFQwOToyNDowNi4wMDAwMDBazwAAAANxgiLt"}},"title":"Activity · Smattr/needtoknow"}