The Heartbleed bug was a C buffer overflow. Entirely unrelated to the heartbeat feature, its spec, or the functionality of SSL as a whole. It had serious impact

The Heartbleed bug was a C buffer overflow. Entirely unrelated to the heartbeat feature, its spec, or the functionality of SSL as a whole. It had serious impact because was in a popular network-accessible library - something similar could also happen in the Linux TCP stack, in a popular web or database server, or any other network-accessible C program. But something that seems just wrong is the expectation that "someone else" (the small all-volunteer OpenSSL team) should have taken more time away from their day jobs and family to: have different people writing specs and implementation, writing more tests, running static analysis tools, have code more reviews, and refactored code to be more readable. But if OpenSSL is so critical to your privacy, security and business, where were your contributions to writing those tests and code reviews? I don't mean that every developer must contribute code to be allowed to have an opinion - but most of the lamentation at "what the OpenSSL team should have done" never considers who exactly should be spending time or money on this extra effort.