> If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensivel

> If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? Your argument hinges on the word "legitimate." I don't do security, but "it looks good to me" is not a legitimate reason to believe that the exploit does not affect you (for any value of "me"). OTOH "I've never used the versions of OpenSSL that have this bug" is a legitimate reason to believe that you're not affected, e.g. Tarsnap's explanation [1]. I'd also recommend that post for another take on what defensive programming looks like in this context. [1] http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartb... on HN: https://news.ycombinator.com/item?id=7562125 https://news.ycombinator.com/item?id=7562125