Personally I've never donated for auditing, but in my free time I do look at code myself.

Today I had to install a proxy server, so I downloaded the source to Apache's traffic server. Within five minutes I'd decided that the code contained enough problems that I couldn't recommend using it.

Now I've reported those bugs, and made a contribution..

It seems appropriate to point out that auditing and fixing the details is just patching symptoms -- and that many think a longer-term solution is needed.

You say that, but it's not as though this is a fundamentally hard problem. How many servers are running nginx today vs. even a few years ago?

Moreover, the biggest problem sits with the biggest, and often most capable, internet companies. So having a reasonable path for them to a more secure TLS implementation, even if it meant hand rolling their own packages or building from source, is potentially a big win for the internet in general.

And, of course, eventually switching from openssl to libressl will become as easy as spending a couple minutes with a package manager.

The fact is that this industry has a track record of keeping up to date technologically. This isn't some corporate IT in the industry gulag saddled with bullshit LoB apps that depend on IE6 in perpetuity. We're talking about the most capable and savvy tech companies in the world. If there's a better option to be had, it'll see high adoption rates.