stripe/stripe-ruby — pull request #107 by ebroder (2014-01-25 15:03:59+00:00)
Title: Manually override Ruby's SSL defaults when making Stripe requests

The Ruby maintainers are in the middle of a bit of a kerfluffle about the SSL defaults (which are...fine as long as you're running a recent Linux release or Mavericks and...aren't being man-in-the-middle'd)

As long as Ruby upstream is failing to take action, we're really in a position where we should be protecting our users ourselves.

This overrides Ruby's default parameters for new SSL_CTX objects for the duration of a Stripe API request. Specifically, it constrains the cipher suite list and disables SSLv2, on the off chance it's available.

Thanks to @jmhodges for making us aware of these specific issues, and more generally for his noble crusade for better SSL configurations.

@ab Could you take a look at this? I'm pretty unhappy about having to do this, but I'm not sure I see a better option.