I teach security, and that story (about EAY using OpenSSL as a project to learn C, because what could go wrong?) comes up every time. For those who don't know

I teach security, and that story (about EAY using OpenSSL as a project to learn C, because what could go wrong?) comes up every time. For those who don't know the backstory (many here will) -- crypto is hard to implement correctly; protocols are hard to implement correctly; and C isn't the easiest language to use. [Disclaimer: I've used C "since forever", love it, and am pretty decent with it, but I've made my goofs. I've also implemented crypto & protocols myself, neither probably very well...] Apparently in ~1995, Eric A. Young ("EAY") decided to implement his own SSL stack (called "SSLeay"), at least partially with the goal of learning the C programming language. At some point, SSLeay became OpenSSL, EAY moved off the project, and OpenSSL went on to become a staple of network computer security (and insecurity). I can't find a reference to back this up right now, but I know I've seen it in the past somewhere credible enough that I'm here repeating the folklore.