Up until fairly recently, the Python standard library did not do any checking of HTTPS certificates, which allows man-in-the-middle attacks, but that all changed with PEP 476. The ssl module changed ...