Issue #10672 has been updated by Eric Mill.


This is really great, and addresses the hardest part of my request. Thank you to Fastly for supporting the open source Ruby project with TLS for cache.ruby-lang.org, and to the Ruby project for enabling it!

I'll move the latter part of my request -- to update ruby-lang.org to use the HTTPS links by default -- over to the GitHub repo for the website at https://github.com/ruby/www.ruby-lang.org/.

----------------------------------------
Feature #10672: Enable SSL on cache.ruby-lang.org
https://bugs.ruby-lang.org/issues/10672#change-53270

* Author: Eric Mill
* Status: Closed
* Priority: Normal
* Assignee: Hiroshi SHIBATA
----------------------------------------
(I apologize if this is not the best place for this -- I'm happy to move this to a different place if it's more appropriate.)

Ruby's official distribution server, cache.ruby-lang.org, is not served over HTTPS. When accessing the server over HTTPS, it presents a certificate from Fastly that is invalid for the domain.

I strongly believe that downloads of public builds of Ruby should be secure, private, and resistant to tampering. HTTPS provides all of those properties.

Some clients, like ruby-build and rvm, use client-side hashes to verify build integrity. Not all clients or users will do this verification, and so baking it into the cache.ruby-lang.org server will ensure that a broader set of Ruby users has a secure, verified download of Ruby.

Even when clients do perform client-side integrity checking, there is always a privacy implication to downloading information. Downloading Ruby without SSL leaks information about the client performing the download through request headers, and informs anyone watching the connection what version of Ruby is likely to be running on the downloading machine. In addition, traffic can be correlated in unpredictable ways: for example, a user agent sent to connect to a download of a Ruby build may appear later to download other information, providing a pattern of client behavior.

In any case, the web is, in general, moving to favor encrypted connections. SSL is faster, CAs like SSLMate and Let's Encrypt are emerging to make the process simpler, and web browsers are starting to encourage encrypted connections and discourage unencrypted ones. 

I request that the Ruby team:

* install a valid certificate on cache.ruby-lang.org.
* update any links to cache.ruby-lang.org controlled by the Ruby team to use the https:// version.
* notify the community of the SSL availability with a tiny announcement post.

Thank you for considering my request.



-- 
https://bugs.ruby-lang.org/