The whole heartbleed story has gone way beyond sanity, for sure.
The bug is real and can be a serious threat to any server. However, the bug is no more serious than all other "buffer overrun" attacks, and arguably less serious than write overflows, which can more easily lead to hostile server hijack. You can have a list of reported security issues for OpenSSL on this page. None of them triggered such a panic as the one we are currently witnessing; yet some were of the "remote code execution" kind, technically much scarier than this heartbleed canard (but without the nifty logo).
The IT industry, as a whole, has come up with a strategy with handling that kind of bugs. It is called "apply the damn security patches from the OS vendor". This strategy is not ultimately elegant, but it works. There is no reason to single out this bug and award it a special treatment, as if it was a new kind of thing (it is not) or exposed to especially dire circumstances (it does not -- its consequences are within the normal range of security holes).
The only benefit of this pandemonium is that it shows who does his job properly. When a panicked sysadmin asks whether he should apply the fix right away and/or reset all his passwords and/or kill his dog (just to be sure), he implicitly admits that he does not usually apply security patches, or at least not promptly -- and that is the problem.