Heartbleed and the code everyone depends on

On 7 April 2014 the OpenSSL project published a short advisory titled “TLS heartbeat read overrun”, CVE-2014-0160. A missing bounds check meant that a connected client or server could be made to hand over up to 64 KB of its memory, and the request could be repeated as often as the attacker liked. The bug had been found by Neel Mehta of Google Security. It soon had a name and a logo: Heartbleed.

OpenSSL secured a huge share of the web's encrypted traffic. A week later, the president of the OpenSSL Software Foundation, Steve Marquess, explained who looked after it: one full-time staff member, a handful of part-timers and about US$2,000 a year in donations.