Impact of the Debian OpenSSL vulnerability

Virtually all of the code that most people run comes from the distribution. If no one is
looking at the distribution-local patches, then it is a failure of the many eyes concept. If
the distributions aren't sending their patches upstream, or the upstream is actively hostile
to the distributions, then it's a failure of the many eyes concept. Not that this would have
got noticed in a proprietary system until many systems got hacked, but that's no excuse.