On Sat, Mar 13, 2010 at 7:18 PM, Adam Thompson <athom...@athompso.net> wrote: > Chris Travers wrote: >> On Sat, Mar 13, 2010 at 5:21 PM, Luke<account...@lists.tacticus.com> wrote: >>> I am assuming SSL. Correct me if I am wrong, but my recollection is that >>> the query string (I.E. get) is in the clear with SSL, whereas post data is >>> not. >>> Do I have a fundimental misunderstanding or massive brain fart here? >> >> The SSL negotiation occurs as part of the socket establishment (hence >> the name). This is why you can't supply different certificates based >> on, say, the HOST header. SSL protects the whole socket, not just the >> payload. > > Translation: yes, you have a fundamental misunderstanding. The second > most common one, in my experience, so I won't accuse you of a "massive > brain fart", as amusing as that might be :-). > > Since understanding of how SSL works is still quite rare in practice, > and *many* people arrive at erroneous conclusions based on incorrect or > incomplete knowledge, I'd like to expand a bit on Chris' statements: > Great explanation. Also one more reference is the Wikipedia page on "Transport Layer Security" (which is basically a later version of SSL).
Best Wishes, Chris Travers ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Ledger-smb-devel mailing list Ledger-smb-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/ledger-smb-devel
