Willem Pinckaers on Akamai's flawed OpenSSL allocator patch
<i>A review by a security engineer would have prevented a false sense of security</i><p>Everyone involved in this, from the people who wrote the heartbeat code, the people who committed the code, the people at Akami who wrote this patch, this poster ... all would describe themselves as security engineers.  Is everyone but Willem Pinckars incompetent?<p>I think the one lesson to learn is to treat crypto just like you do cloud providers.  Make sure you have an exit strategy from day one; the ability to push a button to roll keys, switch algorithms, switch cert providers, etc.