Title: While I admit that the recent Heartbleed security issue is a critical issue, I am getting perpetually flummoxed by the &#x27;I have the moral high ground&#x27; negative comments being thrown at the OpenSSL project &amp; developers. Innumerable blogs and HN threads are taking the stand of &#x27;how could they commit something like that&#x27;, &#x27;How idiotic was the committer&#x27;, &#x27;OpenSSL should not use a custom wrapper around malloc&#x27; and even taking personal shots at the two gentlemen who were referenced in the code.<p>Mistakes were made in code and processes, mistakes will continue to be made in code. What we need is:
* A formal code review tool. I don&#x27;t know whether there&#x27;s something like review-board for OpenSSL commits. 
* Donations to the OpenSSL foundation. C&#x27;mon folks, practically all your online security depends on OpenSSL (Cisco, Juniper, Extreme, Huawei, Google, Yahoo, Wikipedia: I am looking at you). A bit of money back to OpenSSL (and OpenSSH + friends) would go a long way. Personally, I think these tools ought to be getting way more than Wikimedia (Just my two cents)
* More eyes on the code. Whether it&#x27;s refactoring the code,  formal code audits or full time employees from the fortune 500 companies.
* You to commit. This is an open project. 20&#x2F;20 retrospective bashing does no one favours[1]. If you really feel strongly about something, get a patch out then start yammering about it.
* A security mailing list. Something similar to xen-security-announce. That way, major vendors, cloud providers, OS &amp; distributions can get fixes baked by the time the general alarm is sent.<p>1.http:&#x2F;&#x2F;www.tedunangst.com&#x2F;flak&#x2F;post&#x2F;analysis-of-openssl-freelist-reuse
Upvote: