crustymonkey/py-sonic — pull request #5 by ties (2014-10-16 10:16:18+00:00)
Title: use TLSv1 by default and fallback to SSLv3 when needed

The library used to fail to connect to a server which does not
permit SSLv3. I re-enabled SSLv3 in order to use this library.

With the disclosure of CVE-2014-3566 this is unwanted behaviour.

With this patch, by default, TLSv1 is tried. If it's not available
the library downgrades to SSLv3.

Even though this is unwanted behaviour, this patch should allows
the client to be used with a server that does not allow SSLv3
while not breaking backwards compatibility.

(Since it's hard to make the client make arbitrary requests, I think
this is reasonable behaviour).