Corporate VPNs aren't OpenSSL, they're usually IPSec implementations and not susceptible to heartbleed. >It's probably not going to get popped by non-state act

Corporate VPNs aren't OpenSSL, they're usually IPSec implementations and not susceptible to heartbleed. >It's probably not going to get popped by non-state actors. Not too long ago people were making this argument but including both OpenSSL and OpenSSH. Now its just OpenSSH. Funny how that works. The reality is that layered security is a best practice and just expecting something to be perfect forever because of past performance is a very questionable premise.