Hi, I'd say the larger problem is the OpenSSL bug, (patched in 0.9.6e) and it's attendent version of Mod-SSL for apache. that's why I've been updating web servers at work. If you're using an old version of the opensourse SSL, then you're already insecure. "All hail slashdot/Bugtraq" :) later jb