I think we need to take a serious look at the "many eyes" theory because of this. Apparently, there were no eyes on the part of parties that did not wish to exploit the bug for close to two years. And wasn't there just a professional audit by Red Hat that caught another bug, but not this one?

I have to say I'm even less confident in the plan to couple it to DNSSEC.

Sure. We're better. But we need to be even better than that.

I'd say more than just the "community". We have a great many companies that incorporate this software and generate billions from the sales of applications or services incorporating it, without returning anything to its maintenance.I think it's a sensible thing to ask Intuit, for example: "What did you pay to help maintain OpenSSL?". And then go down the list of companies.

OK guys. We've promoted Open Source for decades. We have to own up to our own problems.

This was a failure in the Open Source process. It is just as likely to happen to closed source software, and more likely to go unrevealed if it does, which is why we aren't already having our heads handed to us.

But we need to look at whether Open Source projects should be providing the world's security without any significant funding to do so.

Jeff, I'm sorry that you're paying more. I'm envious that your state is implementing single-payer, though! California considers and rejects the bill every session, so far.

MVP itself is not-for-profit. Interesting that they think the pool in the two states they focus on is now that much more expensive. I can't imagine why.

Thanks

Bruce

To pick a nit, if you require medical attention after an auto accident, typically the at-fault driver's auto policy would need to cover that.

If they are so kind to stick around and your expenses do not exceed the limits.

Certainly such scams existed, but 30 seconds of googling can typically separate the good from the fraud.

The web helps. At the time, I was not able to see the plan until the salesman was present.

I think you are confusing laissez-faire capitalism with freedom. In this particular case the insurers had the task of operating a risk pool, but no incentive to allow any but the lowest risk customer into the pool. Freedom was harmed overall, as a significant number of people had no viable path to medical care.

There are a good number of people who, like you, would feel less encumbered if they were able to live on an island without any civil services and thus without any burden to pay for their fellow man rather than themselves. My surmise is that few of them would survive very long. However, I would encourage you to try if you are able to find such a place. Go ahead, prove me wrong.

I am hardly surprised that insurance companies do not like the situation of having any additional regulation imposed upon them and will raise fees or do anything else they can do to protest and to discredit it.

If you've even hung around the emergency department of a hospital, you will have seen where the real cost of uninsured patients was going. Suddenly this cost is transferred from the hospital to subsidized plans. Ultimately, it should result in better management of the expense.

If you have so few choices in that state, I'll bet the problem is government-based cronyism.

I think it's called laissez-faire capitalism. Too little regulation means that the market will concentrate on the most profitable customers and not necessarily provide any service at all to others.

The point of insurance is that it's a risk pool that lowers the cost of saving to pay for a catastrophe for every participant, based on the probability that most folks won't need it. But it doesn't work for the folks who aren't allowed in the pool. And the reality is that everyone will need it sometime, and that it is normal for a society for some proportion of its people to be sick.

We have actually had some good insurance regulators in California. I don't know much about the current one but he seems to have achieved a pro-citizen rather than pro-company record.

I did not check with the state before I rejected the trash plan, perhaps it wasn't legal.

Valerie has insurance which covers the three of us, but it's her insurance. If she lost her job or if other things happened that I decline to contemplate, we would not have been able to obtain that sort of insurance or indeed anything that wasn't a fraud or a rip-off.

Given that some of the other 50 states implemented exchanges and that the Federal one exists, a total of 7 Million sounds reasonable with 1.2 Million coming from California.

Are you able to show us the terms of your plan? The reason I ask is that I was offered what turned out to be a "trash plan", and the sort of things that aren't being grandfathered are rejected because they don't meet a minimum standard of care. In my case, a catastrophic injury such as in an auto wreck would not have been covered significantly.

The lady who famously confronted Obama on this issue had a plan that limited its payout to a few hundred dollars.

There were two sorts of plans available: There was a company that sold a "trash plan" and sent a sales person to my home. This plan was not written to provide useful medical coverage for a catastrophic condition such as an auto accident with severe injury. Basically, it was a "feel good about being insured until you try to use it" plan which had the main purpose of producing income for a fraudster. I am very glad that such things are being prohibited now because I know there are lots of people who are not as careful readers of terms as I am.

The second was priced so prohibitively high that it seemed to be intended to deter the customer from purchase.