Theo de Raadt on OpenSSL vulnerabilities coming on the 19th
> The OpenSSL group do not tell the LibreSSL group about vulnerabilities
that they are fixing in upcoming releases.> Why?  Well, they just don't.  That's the whole story.Then the story sucks, security of core components underlying the internet is bigger than any one group.Respect for end users would indicate that a simple heads up of a high severity bug to someone on the LibreSSL team would be the way to go.