This is hilarious:

http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/ssl/Makefile?rev=1.29;content-type=text%2Fx-cvsweb-markup

The CFLAGS in the commit contain: -DOPENSSL_NO_HEARTBEAT

The actual setting to disable the SSL heartbeat is -DOPENSSL_NO_HEARTBEATS (note the S at the end).

This commit was apparently OKed by two other people.

This right here tells you why code is hard. Hubris anyone? Is there a coding equivalent to Muphry’s law?