{"action":"created","issue":{"url":"https://api.github.com/repos/rollbar/rollbar-gem/issues/316","labels_url":"https://api.github.com/repos/rollbar/rollbar-gem/issues/316/labels{/name}","comments_url":"https://api.github.com/repos/rollbar/rollbar-gem/issues/316/comments","events_url":"https://api.github.com/repos/rollbar/rollbar-gem/issues/316/events","html_url":"https://github.com/rollbar/rollbar-gem/pull/316","id":110140382,"number":316,"title":"Verify peer when connecting to Rollbar over HTTPS","user":{"login":"mcmillan","id":1315466,"avatar_url":"https://avatars.githubusercontent.com/u/1315466?v=3","gravatar_id":"","url":"https://api.github.com/users/mcmillan","html_url":"https://github.com/mcmillan","followers_url":"https://api.github.com/users/mcmillan/followers","following_url":"https://api.github.com/users/mcmillan/following{/other_user}","gists_url":"https://api.github.com/users/mcmillan/gists{/gist_id}","starred_url":"https://api.github.com/users/mcmillan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mcmillan/subscriptions","organizations_url":"https://api.github.com/users/mcmillan/orgs","repos_url":"https://api.github.com/users/mcmillan/repos","events_url":"https://api.github.com/users/mcmillan/events{/privacy}","received_events_url":"https://api.github.com/users/mcmillan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-10-07T02:22:57Z","updated_at":"2015-10-07T10:42:00Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rollbar/rollbar-gem/pulls/316","html_url":"https://github.com/rollbar/rollbar-gem/pull/316","diff_url":"https://github.com/rollbar/rollbar-gem/pull/316.diff","patch_url":"https://github.com/rollbar/rollbar-gem/pull/316.patch"},"body":"At the moment, when connecting over HTTPS to Rollbar (which is the default, rightly so) and `use_eventmachine` is set to `false` (the default), `Net::HTTP`'s `verify_mode` is set to `OpenSSL::SSL::VERIFY_NONE`. This effectively means that the Rollbar gem doesn't validate whether or not the Rollbar endpoint it's talking to has a valid SSL certificate. This makes the Rollbar gem susceptible to MITM attacks.\r\n\r\nThe implications of this are obviously significant; sensitive data is often (intentionally or otherwise) transmitted as part of exception data which could be intercepted by a malicious third-party and tampered with. If a developer has Rollbar notifications switched on in their development environment and they're building a sweet new application in a coffee shop with insecure wifi, it's perfectly possible for an attacker to steal their exception data and do something nasty.\r\n\r\nThis changes the `verify_mode` to be `OpenSSL::SSL::VERIFY_PEER`, which will verify that the Rollbar endpoint that data is being sent to has a valid SSL certificate before transmitting data across."},"comment":{"url":"https://api.github.com/repos/rollbar/rollbar-gem/issues/comments/146150763","html_url":"https://github.com/rollbar/rollbar-gem/pull/316#issuecomment-146150763","issue_url":"https://api.github.com/repos/rollbar/rollbar-gem/issues/316","id":146150763,"user":{"login":"mcmillan","id":1315466,"avatar_url":"https://avatars.githubusercontent.com/u/1315466?v=3","gravatar_id":"","url":"https://api.github.com/users/mcmillan","html_url":"https://github.com/mcmillan","followers_url":"https://api.github.com/users/mcmillan/followers","following_url":"https://api.github.com/users/mcmillan/following{/other_user}","gists_url":"https://api.github.com/users/mcmillan/gists{/gist_id}","starred_url":"https://api.github.com/users/mcmillan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mcmillan/subscriptions","organizations_url":"https://api.github.com/users/mcmillan/orgs","repos_url":"https://api.github.com/users/mcmillan/repos","events_url":"https://api.github.com/users/mcmillan/events{/privacy}","received_events_url":"https://api.github.com/users/mcmillan/received_events","type":"User","site_admin":false},"created_at":"2015-10-07T10:42:00Z","updated_at":"2015-10-07T10:42:00Z","body":"@brianr As @jondeandres mentions I suspect the errored builds are caused by a version of `rack-cache` somewhere that isn't properly pinned. `rack-cache` 1.3.0 [was released](https://github.com/rtomayko/rack-cache/releases/tag/v1.3.0) a few days ago and requires Ruby > 2.0.0, hence the erroring builds.\r\n\r\nAs for the failing build – I have no idea what's going on there, to be honest. Can you guys advise?"}}