I was at a lunch years ago where some former Microsoft executive was present. Really wealthy guy and now doing some sort of policy advocacy or something. This w

I was at a lunch years ago where some former Microsoft executive was present. Really wealthy guy and now doing some sort of policy advocacy or something. This was around the time of the Heartbleed bug in OpenSSL and he was talking about the need to improve software security by creating some committees or something[0]. I suggested to him that since OpenSSL was already widely used and operating with very few employees on a tiny budget it would be a better investment of time and money to just give OpenSSL a couple million dollars to audit their code and clean it up. He was sort-of flustered by this suggestion and talked about how that doesn't solve the problem because there is just so much software that is insecure. Now, obviously that is true, but I don't see how his proposal to solve the problem by having meetings was any better. I think really wealthy people have two problems when it comes to this: (1) there are a lot of people out there who want money but can't deliver. (2) many of these wealthy people, like the guy I mentioned above, want to be actively involved in solving problems. He didn't want to give money to OpenSSL because his only role there would be giving them money. Instead, he wanted to create some organization with his name on it so that he could be seen to be doing something. [0]: I don't remember exactly what his proposal was, but I remember thinking it sounded really bureaucratic and unlikely to have any real benefits in practice.