rails/rails — pull request #7068 by saizai (2012-07-16 12:05:12+00:00)
Title: Do not enforce SSL for Tor Hidden Service .onion URLs

Do not enforce SSL on Tor hidden services (e.g. if this server hosts content both over SSL and Tor).

CAs cannot verify .onion ownership for SSL (so it provides no auth),and SSL introduces leaks that actually degrade Tor security/privacy.

Cf. https://trac.torproject.org/projects/tor/wiki/doc/TorFAQ?version=1390#WhyisitbettertoprovideahiddenserviceWebsitewithHTTPratherthanHTTPSaccess