I disagree. How are people expected to learn from the mistakes made in OpenSSL if we mustn't be negative? OpenSSL is, by any sensible code quality metrics, a

I disagree. How are people expected to learn from the mistakes made in OpenSSL if we mustn't be negative? OpenSSL is, by any sensible code quality metrics, a bloody mess. It is a miracle that this code has not caused more disastrous problems than it has. It is not only legitimate to criticize it: it is essential that we do and that we articulate what mistakes were made so that others may learn from it.