> On session establishment, by default, no peer credentials verification is done. This must be explicitly requested, typically using SSL_CTX_set_verify(3).
Aside: According to those docs, SSLv23_client_method() is deprecated.
This is a really nice part 1. I think a series building from this up to what would be considered "secure" in modern day, with the other topics already mentioned in comments here and on the article, would be awesome. I could easily see it becoming a very popular resource among students or new devs who are solving these problems for the first time themselves. The writing is very clear and concise.
