On: FAQ on the xz-utils backdoor

[jethro_tell]

To be fair, so could closed source code.

The difference in this case is that a guy was running perf tests against postgres and noticed his ssh was slow, so he dove into that and found the backdoor a couple days after it was pushed.

If you had to submit 'my ssh daemon is slow' to a third party it would get put on the pile with the rest of them

[bee_rider → jethro_tell]

Hmm, well they never find these kinds of attacks in closed source code. OTOH they never find these kinds of attacks in closed source code!

[wolverine876 → jethro_tell]

Closed source is a little tougher: Often you need to get a job somewhere in their organization or supply chain.

[bashtoni → wolverine876]

Or find a security vulnerability in their network, say a poorly secured FTP server as per SolarWinds.

[shrimp_emoji → bashtoni]

And then you wouldn't have random people discovering it! It could even be covered up indefinitely.