Tarsnap: No heartbleed here
I'm no security expert, so this is an honest question.Why was Tarsnap running a version of OpenSSL that's at least two years old^1 ? My understanding is that, while you might not want to upgrade immediately upon release (because there may be new bugs), neither should you never upgrade (because releases fix old bugs).Is it because the website itself doesn't do much -- it's not the business; backup is -- so not much time is put into it?[1] OpenSSL 1.0.1, the first version of OpenSSL with the bug, was released in March 2012: http://heartbleed.com/