Code quality and hygiene mean absolutely nothing if you have a large number of academic types who use OpenSSL as the dumping ground for their pet research projects, that are enabled by default, of course.<p>Also, OpenSSL supports all kinds of ancient esoteric platforms that are essentially unused, yet were kept in the code base for sentimental reasons.<p>The real metric they should be looking at is the number of features/platforms/LOC removed from the project. Less code = less surface areas for exploits.