2 things:<p>1) 11 years.  The code in question was 11 years old.  Another example not to rely on &quot;given enough eyeballs, all bugs are shallow&quot;.  11 freakin years.<p>2) Security off by default is yet another example indicating how security receives lower priority - in a library whose main aim is to secure data transport no less!<p>It all adds up to security debt - at some point it will be paid.