Well, yes. It's still better to start doing the right thing late than never? > Instead NIH solutions are now popping up after having exploited OpenSSL for more

Well, yes. It's still better to start doing the right thing late than never? > Instead NIH solutions are now popping up after having exploited OpenSSL for more than two decades. Building new crypto libraries to replace OpenSSL is not caused by NIH, it's caused by rationally examining the existing codebase and coming to the conclusion that sometimes starting from scratch is the sane choice. Google is doing the incremental fixing approach (in BoringSSL) too, but it's very clearly a stopgap.