Similarly, the one cryptographic complaint I have about OpenSSL (as opposed to non-cryptographic security bugs) is their lack of attention to side channels, and the same applies here -- we KNOW that side channels are bad. The fact that the OpenSSL developers haven't made any systematic attempt to prevent them doesn't mean that cryptography is hard; it just means that the OpenSSL developers are careless.

By default, OpenSSL has: RSA blinding, constant time montgomery multiplication, careful review and correction of the conditional branches which were attacked in that amazing series of branch prediction papers.

Doesn't seem to me that OpenSSL developers are careless and indifferent about side-channel attacks.

No, I don't know of any better cryptographic library. (This is why I said a few days ago that writing a better cryptographic library was something I'd like to do if I was rich.)

Doesn't seem to me that OpenSSL developers are careless and indifferent about side-channel attacks.

They're playing whack-a-mole. There are over a thousand conditional branches in the large integer arithmetic code alone. The fact that nobody has pointed out how to exploit them yet doesn't mean that they're not exploitable.

Inviting crypto to the party invites a whole host of new security bugs that you simply cannot have if you don't go down that road in the first place.