Technologist vs. spy: the xz backdoor debate (opens in new tab)

> The only major one hit by this was homebrew, but they have never understood security anyway.

Do you have any evidence that other distros wouldn't have done the same? What measures do other distros have in place that would've stopped the inclusion of the backdoor had they not been alerted at the right time?

> The only major one hit by this was homebrew, but they have never understood security anyway.

MacOS doesn't ship with sshd running out of the box, and vanishingly few people ever enable it.

would 5 eyes, 9 eyes and even 14 eyes be enough?

That's a likelihood it would seem.

I mean, getting an actual government agency with an appropriate mission specified by law _would_ help. Both from a recruiting point of view (you get sufficiently ideologically motivated people), but also from an accountability point of view. These agencies are ultimately responsible to someone. And the law has that nice property of knowing who and how to hurt those people. So yeah. Getting a (or the) government to maintain OSS infrastructure definitely would help. And probably also prevent this kind of thing as far, far too risky to attempt

We can't even support actual critical physical infrastructure anymore, like roads, bridges, and the power grid. And that stuff has very obvious immediate consequences when it breaks. Try explaining to your local octogenarian senator what xz is and why OpenSSH shouldn't just be funded by whatever spare change we find in the couch cushions.