---
title: "Ruby 2.6.0p0 has a sneaky HTTP related bug"
publication: "Ruby Weekly"
issue: 432
published_at: "2019-01-10"
canonical_url: "https://rubyweekly.com/issues/432"
---

This week's Ruby news, issue 432       

#432 — January 10, 2019 

[Read on the Web](https://rubyweekly.com/issues/432)   

Ruby Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/ga6j5jyas5pkwktw6thh.jpg%0A)](https://mensfeld.pl/2019/01/exploring-a-critical-netprotocol-issue-in-ruby-2-6-0p0-and-how-it-can-lead-to-a-security-problem/)  

[Exploring a Critical `Net::Protocol` Issue in Ruby 2.6.0p0](https://mensfeld.pl/2019/01/exploring-a-critical-netprotocol-issue-in-ruby-2-6-0p0-and-how-it-can-lead-to-a-security-problem/) — It seems Ruby 2.6.0p0 introduced a serious bug if you do any HTTP communication from Ruby (using libraries like `Net::HTTP`, say) where certain payloads are getting corrupted. Luckily, a [fix is in](https://github.com/ruby/ruby/commit/1680a13a926b17661329beec1ded6b32aad16c1b) but we await a new official release so you may want to put off your production upgrades just for now. 

Maciej Mensfeld   

[You Can Use Bundler Without a `Gemfile`](https://victorafanasev.info/tech/you-can-use-bundler-without-gemfile) — Did you know that it’s possible to use Bundler within a single Ruby script and without an external `Gemfile`? For some reason this had never occurred to me and it’ll be a game changer for my many single file scripts. 

Victor Afanasev   [![\](https://copm.s3.amazonaws.com/c3fbf8ee.png)](https://semaphoreci.com/?utm_source=rubyweekly&utm_medium=cpc&utm_campaign=rubyweekly-semaphore-2-0-20190110) 

[Run Your Tests 2.1x Faster on Semaphore 2.0. Pay as You Go](https://semaphoreci.com/?utm_source=rubyweekly&utm_medium=cpc&utm_campaign=rubyweekly-semaphore-2-0-20190110) — Sign up with GitHub, get $200 of free credit, and give it a spin. 

Semaphore 2.0 sponsor   

[Creating Ruby Bindings and Extensions](https://medium.com/stuart-engineering/ruby-bindings-and-extensions-91c794eb9acd) — A practical guide to going native with C. In this case, looking at how a developer built a way for Rubyists to use Uber’s [H3](https://github.com/uber/h3) hexagonal geospatial indexing system. 

Sean Handley   

[The Ruby Reference](https://rubyreferences.github.io/rubyref/) — An attempt to bring together and extend core Ruby documentation for Ruby 2.6 in one place. 

zverok   

[An Update on the Bundler 2 Release](https://bundler.io/blog/2019/01/04/an-update-on-the-bundler-2-release.html) — [Last week](https://rubyweekly.com/issues/431), we announced the release of Bundler 2 which depended upon RubyGems 3.0 - this requirement caused some issues so Bundler 2.0.1 (out now) relaxes the requirement to RubyGems 2.5. 

Colby Swandale   

[How Fast is the Released Ruby 2.6.0?](http://engineering.appfolio.com/appfolio-engineering/2019/1/4/how-fast-is-the-released-ruby-260) — Ruby and Rails benchmarking enthusiast Noah Gibbs is back with some initial results from his process where rather than testing just Ruby itself, he tests a basic Rails app running on Ruby. 

Noah Gibbs  

💻 Jobs  

[Love to Pair Program?](https://jobs.lever.co/backerkit/488b7d87-8ead-4ac4-91cb-59a3d1c0f168?lever-source=ruby-weekly) — BackerKit is hiring developers who LOVE pairing to join our agile team. Join us! Learn more about our team values [here](https://www.keyvalues.com/backerkit). 

BackerKit   

[Find A Job Through Vettery](https://www.vettery.com/tech?utm_source=newsletter&utm_medium=cooper-rubyweekly&utm_term=tech&utm_content=grouped&utm_campaign=ad-77582) — Vettery matches top tech talent with growing companies. Create your profile to get started. 

Vettery  

📘 Articles & Tutorials  

[Bindings and Lexical Scope in Ruby](https://blog.appsignal.com/2019/01/08/ruby-magic-bindings-and-lexical-scope.html) — A concise review of scope and bindings followed by how ERB templates leverage them. 

Jeff Kreeftmeijer   

▶[Using Action Text in a Rails 5.2 Application](https://www.driftingruby.com/episodes/using-action-text-in-a-rails-5-2-application) — I bet you thought you had to wait for Rails 6 to use [Action Text](https://weblog.rubyonrails.org/2018/10/3/introducing-action-text-for-rails-6/), didn’t you? 

Drifting Ruby   

[Common Mistakes That Cause Rails App Outages](https://frontdeveloper.pl/2019/01/common-mistakes-that-cause-ruby-on-rails-apps-outages/) — Threads, database connections, timeouts, oh my! 

Igor Springer   

[Active Admin Tips and Performance Optimizations](https://pawelurbanek.com/active-admin-tips-optimizations) — Active Admin gem is a popular tool for building admin interfaces in Rails apps. 

Paweł Urbanek   

[Debug Faster With Context Based Logging](https://timber.io?utm_campaign=platform_feelers&utm_source=cooperpress&utm_medium=ruby_weekly) — When done right, logs can be your most powerful debug tool. 

Timber.io sponsor   

▶[My Vim Setup for Rails](https://www.codewithjason.com/vim-setup-rails/) — _“using Vim I can edit circles around anyone using Atom, Visual Studio, Sublime Text or any other non-keyboard-based editor”_ 

Jason Swett   

[Rails Needs Active Deployment](https://medium.com/@wintermeyer/https-medium-com-wintermeyer-rails-needs-active-deployment-65c207858c3) — A call to standardize Rails deployments. _“I’m calling out for DHH or anybody else in the Rails community to think about Active Deployment.”_ 

Stefan Wintermeyer   

[How To Use Environment Variables in Ruby](https://www.rubyguides.com/2019/01/ruby-environment-variables/) 

Jesus Castello beginner  

🔧 Code & Tools  

[TensorStream: Bringing Machine Learning to Ruby](https://medium.com/@joseph.dayo/tensorstream-bringing-machine-learning-to-ruby-114582060e3d) — A pure Ruby machine learning framework that’s inspired by TensorFlow but doesn’t require you to get involved with Python at any stage. (Though if you want to use regular TensorFlow, there’s [tensorflow.rb](https://github.com/somaticio/tensorflow.rb) too.) 

Joseph Emmanuel Dayo   

[Spin Up a GoCD Continuous Delivery Server in Less Than 5 Minutes](https://www.gocd.org/test-drive-gocd/?utm_campaign=test_drive&utm_medium=newsletter_ad&utm_source=cooperpress_ruby&utm_content=test_drive&utm_term=) 

GoCD sponsor   

[Solargraph: A Ruby Language Server](https://github.com/castwide/solargraph) — A set of tools to integrate Ruby code completion and inline documentation into editors, such as [VS Code.](https://marketplace.visualstudio.com/items?itemName=castwide.solargraph) 

Fred Snyder   

[Ruby 2.6 Ubuntu Packages Now Available](https://www.brightbox.com/blog/2019/01/07/ruby-2-6-ubuntu-packages/) — If you’re on Ubuntu and want Ruby 2.6 packaged up nicely, you can thank the folks at Brightbox. 

John Leach   

[pipe_operator: Elixir/Unix Style Pipe Operations in Ruby](https://github.com/LendingHome/pipe_operator) — It’s just a proof of concept. 

LendingHome         

Curated by [Cooperpress](https://cooperpress.com/) 

[Change your email address](https://rubyweekly.com/edit_subscription/*|UID|*) or[Stop getting this newsletter](https://rubyweekly.com/leave/*|UID|*) 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom