>As Steve Marquess, the former CEO of the OpenSSL Foundation noted in a blog post after the fact, the cause of Heartbleed was attributable to developer burnout

>As Steve Marquess, the former CEO of the OpenSSL Foundation noted in a blog post after the fact, the cause of Heartbleed was attributable to developer burnout and lack of funding. I don't agree that you can directly draw a line between security exploits like Heartbleed and lack of funding. In fact, it's even possible that you have the counterintuitive scenario of providing more funding to OpenSSL will lead to more exploits -- because you now have more paid programmers making new exploits. As counterexamples to Steve Marquess reasoning: Apple funded Facetime with fulltime developers and yet they had a recent publicized audio security hole, and Intel with its billions funded x86 chip development and yet it still had Meltdown and Spectre holes. All the various CVEs constantly issued every day mentions commercially funded projects (e.g. Adobe Acrobat, Java runtimes, Windows zero-days, etc). It's seductive to to think that paying developers will naturally lead to "better security". It does seem logical that if we set funded OpenSSL with $250k/yr to pay a salaried programmer whose only job is to look for security holes, something like Heartbleed wouldn't have happened. The problem is that there would still be security holes found by a teenager in Russia; possibly Heartbleed or a different security hole. It's easier to directly connect cause & effect of adding programmers will lead to added features. E.g. if software widget doesn't have a PostgreSQL db adapter, add an additional programmer to code it. However, the effort of removing security exploits lives in a weird area of (un)measurable and (un)observable work. It's difficult to assess that the security holes were really removed. Maybe there's some game theory thinking about how to best fund security bug hunting. Is a fulltime security auditor the best use of money? Or is it bounties? I don't know. Does the industry have any empirical data connecting amount funding to number of security exploits?