OpenSSL, the security software which led to the Heartbleed flaw, has been forked – its code re-used to make a new piece of software – by developers angry at the lack of care given to the project.
Theo de Raadt, the founder of open-source operating system OpenBSD, has taken the code of OpenSSL and used it to create a new version of the security software called LibreSSL.
OpenSSL, like OpenBSD, is open-source, which means anyone can take the code behind it and use it to make their own versions of the software. Open-source software is also typically developed and maintained by a large base of volunteers, but in the case of OpenSSL, de Raadt says those volunteers didn't do a good enough job.
"The open-source model depends on people being able to read the code," he told technology new site Ars Technica. "It depends on clarity. That is not a clear code base, because their community does not appear to care about clarity."
LibreSSL has launched with a deliberately bare-bones website, written in comic sans and using blinking text for the "coming soon" sign. Philanthropists can donate "to stop the comic sans", which is "scientifically designed to annoy web hipsters".
"At the moment we are too busy deleting and rewriting code to make a decent web page," it adds. The group is making public many of the issues they find in the OpenSSL code, such as passing details of the user's private key to a random number generator.
The Heartbleed bug, which rendered hundreds of thousands of websites vulnerable to attacks that could steal passwords or security credentials, came about as a result of a single mistake made by a volunteer coder. The error stayed in the code base for more than two years, with no other coder noticing, until it was disclosed by private security researchers in early April.
OpenSSL has argued that the problems it faces are down to lack of funds. The organisation's president, Steve Marquess, wrote that it has been surviving on less than $1m annual gross revenue since it was formed five years ago, and has just one full-time member.
"There should be at least a half-dozen full-time OpenSSL team members, not just one, able to concentrate on the care and feeding of OpenSSL without having to hustle commercial work," Marquess said.