"...for a flaw not related to crypto..." The thing about crypto is that almost any bug in a crypto library is related to crypto. It can't be easily isolated, a

"...for a flaw not related to crypto..." The thing about crypto is that almost any bug in a crypto library is related to crypto. It can't be easily isolated, and if you try, you have to actually analyze the isolation to make sure that it's really isolated. "...disruptive decisions..." Who is it disrupting? OpenBSD is trying to provide value to their users. If you want slow, steady, incremental, reactive improvements to OpenSSL, every other OS will give you that. OpenBSD apparently believes its users would benefit from a proactive approach to security.