Lessons from the Debian/OpenSSL Fiasco
research.swtch.com