I noticed this the other day in Rails. ActiveResource::Connection in 3.2.8 is affected in that the default OpenSSL verification mode is "OpenSSL::SSL::VERIFY_NO

I noticed this the other day in Rails. ActiveResource::Connection in 3.2.8 is affected in that the default OpenSSL verification mode is "OpenSSL::SSL::VERIFY_NONE". A developer has to explicitly set it for SSL validation. You can see it here: https://github.com/rails/rails/blob/3-2-stable/activeresource/lib/active_resource/connection.rb https://github.com/rails/rails/blob/3-2-stable/activeresourc... I'm pointing it out as it was not mentioned in the paper. Edit: It looks like it has been that way since SSL was first implemented in Connection.