I'm pessimistic about the open-source part. The lesson I took from OpenSSL/Heartbleed is: even if something's very widely used and people could spend some colle

I'm pessimistic about the open-source part. The lesson I took from OpenSSL/Heartbleed is: even if something's very widely used and people could spend some collective effort on it (or just contribute some funding), that doesn't mean anyone will. The Linux Core Foundation funding after that, and google contributing its own expertise through BoringSSL, made OpenSSL a lot more secure but it took a wake-up call.