I have two conflicting moods here. First, companies using OpenSSL for free were completely living up to their end of the bargain, which was "you can use this f

I have two conflicting moods here. First, companies using OpenSSL for free were completely living up to their end of the bargain, which was "you can use this for free." Second, there was absolutely nothing stopping a few banks and/or giant web companies from getting together to raise a million dollars to have this code professionally audited. Banks do spend lots of resources auditing the code they write themselves, so how come nothing was spent here? (Related to second point: There was also absolutely nothing was stopping people from doing what the OpenBSD team is doing now and deciding to tear it apart to clean it up. There was also absolutely nothing forcing people to use OpenSSL. )