[borando]

Great news! Hopefully between LibreSSL and BoringSSL, OpenSSL will go away and never return. I think AGL and the LibreSSL team will be able to do some fantastic informal collaboration. I'm looking forward to a healthy TLS ecosystem.

[x1798DE]

That's pretty brutal. One reason why Heartbleed was such a potential problem was the monoculture that tends to come when FOSS software becomes reliable and popular. Having more options out there is good, but I don't see why OpenSSL needs to go away. It had one major zero-day, then when people started paying attention to it, it got 1. a lot of attention to its security and 2. a not insignificant increase in much-needed financial support. Hopefully, we'll see more stable and well-tested TLS libraries out there, and the fact that there are now a few forks of OpenSSL is a good start.

[currysausage]

Not that I necessarily disagree with you, but I do want to add two points for consideration:

1. a lot of attention to its security

That doesn't help if bug reports rot in the tracker for years. The developers' attitude might have changed under the current media attention, but for how long will that last? I have yet to read a public statement by the OpenSSL team on how they plan to improve code quality and processes in the long run.

2. a not insignificant increase in much-needed financial support

Even before Heartbleed, OpenSSL might not have been as poor as often reported: http://opensslfoundation.com/what.html http://www.openbsd.org/papers/bsdcan14-libressl/mgp00008.htm...

Again, I am too much of an outsider here to judge, I just want to add these points for consideration.