Yeah I would have hoped that tests involving skipped or out of order protocol flows would have been part of their normal functional testing. I remember reading

Yeah I would have hoped that tests involving skipped or out of order protocol flows would have been part of their normal functional testing. I remember reading a while back about NASA's testing procedures and they have a team who's sole job is finding bugs in the code produced by the other development teams. It seems like that structure should be adopted for these security critical projects. Ideally the open source community is supposed to help out with the reviews, but in reality it needs to be someone's whole job.