My point is this, if the OSS remuneration situation were better would we have seen HeartBleed or other CVE's? There are a lot of falsehoods in the OSS domain, l

My point is this, if the OSS remuneration situation were better would we have seen HeartBleed or other CVE's? There are a lot of falsehoods in the OSS domain, like its better for security. https://www.cvedetails.com/top-50-product-cvssscore-distribution.php https://www.cvedetails.com/top-50-product-cvssscore-distribu... Just looking at paid out Bug Bounties gives you an idea of how hard it is to get appropriate levels of remuneration as a vendors own bug bounty is outbid. https://www.theregister.com/2016/08/11/exodus_intelligence_500k_bounty/ https://www.theregister.com/2016/08/11/exodus_intelligence_5... So whilst the call to arms to get paid for OSS submissions is noble, its still a flawed business model for most "professional" maintainers. I know there is a culture at Uni's to maintain OSS but they dont have the experience which we see in the quality of the code output.