Comment by noir_lord

> The OpenSSL group do not tell the LibreSSL group about vulnerabilities that they are fixing in upcoming releases.

> Why? Well, they just don't. That's the whole story.

Then the story sucks, security of core components underlying the internet is bigger than any one group.

Respect for end users would indicate that a simple heads up of a high severity bug to someone on the LibreSSL team would be the way to go.