Yep. It could also be found by luck a bit later, or caught in a strict process sooner or later that we won’t know.
No process is perfect, but the fact this attack is super complex, with many levels of indirection on run time, detecting if it’s in debug mode, forcing maintainers to disable Oss fuzzer (a tool that scans source code for bugs and vulnerabilities) and also involved social engineering and took years to get close to widespread release is to show what it takes to plant a back door on 100% Foss systems.
As opposed to closed source, where all it takes is a conversation between govt and a CEO.
Yep. It could also be found by luck a bit later, or caught in a strict process sooner or later that we won’t know.
No process is perfect, but the fact this attack is super complex, with many levels of indirection on run time, detecting if it’s in debug mode, forcing maintainers to disable Oss fuzzer (a tool that scans source code for bugs and vulnerabilities) and also involved social engineering and took years to get close to widespread release is to show what it takes to plant a back door on 100% Foss systems.
As opposed to closed source, where all it takes is a conversation between govt and a CEO.