Your first statement negates your second. Shit keeps happening because people keep using the excuse that it's a large project. The OpenSSL team needs to take a

Your first statement negates your second. Shit keeps happening because people keep using the excuse that it's a large project. The OpenSSL team needs to take a step back, start proactively auditing their own code, adding unit tests, getting rid of stupidity like having their own caching malloc library. When a project shows a consistent lack of responsibility like the OpenSSL project has, then calling the maintainers irresponsible /is/ the responsible thing to do.