Impact of the Debian OpenSSL vulnerability

I agree there is plenty of blame to go around: the Debian maintainer needs to accept some (if
you're maintaining a software package that is used by virtually the entire (F/OSS) world to
secure its computers, it behooves you to proceed with the most extreme caution and
circumspection possible), and the OpenSSL folks do too (a secret cabal mailing list is the
only reliable way to contact developers?!?!  Come on, that's lame.)

But to me the fundamental mistake here is EXACTLY the same as the recent OpenSSH 4.9->5.0
issue: the lack of upstream forwarding of patches.  To my mind it's an intrinsic
responsibility of every single downstream maintainer to forward upstream every patch they make
and every bug they receive, unless they are provably ONLY applicable to the distro and not the
base software.  I don't care if the developers are grumpy or mean or never accept patches
anyway or whatever: you still have to forward every single one and work with them as best you
can.  That also includes identifying yourself as the package maintainer for a given distro in
EVERY correspondence with upstream and making it clear when proposed changes are intended to
go into the distro proper.

IMO, if you can't sign up for that amount of work then you're not the right person to be
maintaining the package.  Especially not one like OpenSSL!

So, although I'm sure he's a great guy and I don't blame him for introducing the bug (everyone
makes mistakes!), in this case I do personally feel forced lay the bulk of the responsibility
for the debacle at the Debian maintainer's feet---for not forwarding the patch or working
effectively with upstream developers.  That's not to say I don't understand what happened or
I'm not sympathetic, because I do and I am.

I just hope everyone who maintains a package can learn from these recent problems and make a
renewed commitment to upstream developers--maybe we can make an adjustment to the distro
maintainer responsibilities documentation for each distro.  It would be great if something
positive was achieved as a result of this.