For example, Debian Jessie shipped with 1.0.1 even though 1.0.2 was already out, probably because not every app had been ported to 1.0.2 yet. But their &quot;megafreeze&quot; development model amplifies a 6-month scale problem into a many-year problem. If they had shipped both 1.0.1 and 1.0.2 then apps could have incrementally switched over at their own pace. Naturally, each app would only link against one version of OpenSSL so there&#x27;d be no need for apache-ssl101 and apache-ssl102.