Tarsnap: No heartbleed here
I'm no security expert, so this is an honest question.<p>Why was Tarsnap running a version of OpenSSL that's at least two years old^1 ? My understanding is that, while you might not want to upgrade immediately upon release (because there may be new bugs), neither should you never upgrade (because releases fix old bugs).<p>Is it because the website itself doesn't do much -- it's not the business; backup is -- so not much time is put into it?<p>[1] OpenSSL 1.0.1, the first version of OpenSSL with the bug, was released in March 2012: <a href="http://heartbleed.com/" rel="nofollow">http://heartbleed.com/</a>