James Golick, a prolific Canadian Rubyist, has declared war on Net:HTTP’s default of not checking the validity of the certificate sent by an HTTP server when making HTTPS requests. His new always_verify_ssl_certificates gem forces Net::HTTP to verify SSL certificates and doesn’t allow other libraries to override this setting.

Despite being a known issue for years, James explains why Net::HTTP’s default setting could be leaving you open to security problems:

While there’s a potential for man-in-the-middle attacks when using Net::HTTP to connect to HTTPS sites, the chances are low, and if you’re not doing anything that needs to be airtight (say, local development work), you might not need to use James’ solution (or if you’re using open_uri). Read More

Significant and serious improvements to the core Ruby language come along as infrequently as TextMate updates. Given that TextMate has had an update recently, an important new Ruby feature was sure to be just around the corner and it is: refinements! Shugo Maeda (who works with Matz and developer of mod_ruby) presented the idea at RubyConf 2010 last month.

In a nutshell, refinements clear up the messiness of Ruby’s monkey patching abilities by letting you override methods within a specific context only. Magnus Holm has done a great write up of the concepts involved, and presents a good example:

module TimeExtensions
refine Fixnum do
def minutes; self * 60; end
end
end

class MyApp
using TimeExtensions

def initialize
p 2.minutes
end
end

MyApp.new # =120
p 2.minutes # =NoMethodError

In this example, rather than adding the minutes method to the Fixnum class in the typical way, it’s been added as a “refinement” within a module which is then used elsewhere to spread the context of the change. Read More

In The Ruby Stdlib is a Ghetto, Mike Perham argues that Ruby’s “standard library” (all the libraries that come by default with Ruby installs) is old and crufty and suggests some parts that should be removed.

The Problem

In case you’re unfamiliar with the term, the ever authoritative Urban Dictionary lists ghetto as, among other things:

an impoverished, neglected, or otherwise disadvantaged residential area of a city, usually troubled by a disproportionately large amount of crime

Anyone’s who recently looked up documentation for stdlib-dwelling libraries has probably been a little frustrated. I see rants and raves from time to time on IRC and Twitter and I’m often surprised at how much isn’t documented. Read More