This is hilarious: http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/ssl/Makefile?rev=1.29;content-type=text%2Fx-cvsweb-markup The CFLAGS in the commit contain: -DOPENSSL_NO_HEARTBEAT The actual setting to disable the SSL heartbeat is -DOPENSSL_NO_HEARTBEATS (note the S at the end). This commit was apparently OKed by two other people. This right here tells you why code is hard. Hubris anyone? Is there a coding equivalent to Muphry’s law?