Mediaboss Marketing

The Heartbleed bug revealed limitations with the software protecting banks and other key websites.

NEW YORK (CNNMoney)

They're all volunteers. And only one does it as a full-time job.

Their labor of love is OpenSSL, a free program that secures a lot of online communication. And it was a tiny coding slip-up two years ago that caused the Heartbleed bug, a hole that allows attackers to peer into computers. The bug forced emergency changes last week at major websites like Facebook (FB, Fortune 500), Google (GOOG, Fortune 500) and Yahoo (YHOO, Fortune 500).

But security experts say OpenSSL is severely underfunded, understaffed and largely ignored.

The bug wasn't caught until recently, because the OpenSSL Software Foundation doesn't have the resources to properly check every change to the software, which is now nearly half a million lines of code long. And yet that program guards a vast portion of our commerce and government -- including weapon systems and smartphones, the foundation claims.

Related story: Heartbleed Bug explained

"The mystery is not that a few overworked volunteers missed this bug; the mystery is why it hasn't happened more often," Steve Marquess, the foundation's president, said in an open letter.

When weighed against its critical importance to Internet security, OpenSSL has a shoestring budget. It has never received more than $1 million a year, Marquess said. The only federal support listed online was a single $20,000 renewal contract from the Department of Defense.

While the foundation receives money from the Department of Homeland Security, Citrix (CTXS) and others, the vast majority of its funding is from specific work-for-hire contracts. A company wants a certain feature added here, a specific function there. It keeps developers busy. But Marquess said there's no money going toward reviewing the code or performing audits.

Go here to read the rest:
Your Internet security relies on volunteers