> No, I am not asking for a hard number, I specifically asked for a ballpark. Yes, and it's a fake law that doesn't exist. How would I possibly answer this? O

> No, I am not asking for a hard number, I specifically asked for a ballpark. Yes, and it's a fake law that doesn't exist. How would I possibly answer this? Off handedly, I'd say that the fine could really range depending on a lot of things. Was this an outdated version of OpenSSL that they just didn't patch? Was it a programmer error using the library? A 0day? All of these things would probably make a big different - charging companies for 0days in 3rd party code, in at least many cases, would not make sense. > I agree, but slapping fines of developers for using openssl to enhance security makes it a bit hard for anyone to afford putting any extra money towards security At some point if companies can't afford to keep users safe maybe they just shouldn't be companies. And if we're talking about router companies, they have the cash. > why you and every other serious developer would be sued out of existence unless you propose obscenely small fines I would imagine instead that companies would have insurance around these issues to cover developers, but again, the legal components of this are not something I'd want to get into since I'm not qualified to.