The bigger moral associated with the heartbleed thing was that you need hardass gatekeepers for important software. If you allow people to dump crap into your p

The bigger moral associated with the heartbleed thing was that you need hardass gatekeepers for important software. If you allow people to dump crap into your project then you shouldn't expect anyone to pay attention to it. There is no way in heck that a cryptography library needed a heatbeat function. The LibreSSL project isn't about diversity, it's about removing the crap. Code that doesn't exist can't cause security issues and as a result doesn't need bug bounties. The same idea works for standards. If you don't have a way of resisting the inclusion of requirements in standards then your standard will end up unusable ... and then you have to include all the extra code. In general money makes it harder to do proper gatekeeping. It is hard to resist the commercial needs of the people that are paying the bills. These needs often involve poorly thought out crap.