If we're making claims of bad faith, lets go with a much less conspiratorial thought: Some blogger oversold a bug they found because they wanted the self promot

If we're making claims of bad faith, lets go with a much less conspiratorial thought: Some blogger oversold a bug they found because they wanted the self promotion of finding a security-related bug in the thing seen as OpennSSL done right built the guys that take security seriously. Probably true, though that's of the "live by the sword" variety. It's like being a grammar critic: one had better exercise perfect grammar or expect to hear about it. One of the major talking points of the LibreSSL initiative is a 4 year old bug in OpenSSL if you use a non-standard, non-default mode and multithread access. There are zero demonstrated exploits of it, it is by most analysis at most responsible for dropped connections, so it is far less concerning than even this "oversold" bug. That is the bug that the LibreSSL team always talks about, railing about a "critical security vulnerability that sat unfixed for 4 years". It has been referenced multiple times throughout this discussion. So again, what goes around comes around. Someone criticized a product that claims to be version 2.0, and which is based on long-proven, long-existing code, and found a pretty extraordinary fault that looped back to the LibreSSL team simply removing functionality they didn't think was relevant. Alright, in reality it just isn't a big deal, but it is what a team sets themselves up for when they criticize others with seeming impunity.