On: Backdoor in upstream xz/liblzma leading to SSH server compromise

[rst]

Which helps with some kinds of threats, but not all. It keeps someone from pretending to be the maintainer -- but if an actual maintainer is compromised, coerced, or just bad from the start and biding their time, they can still do whatever they want with full access rights.

[the8472 → rst]

You probably should have replied that to the GP, not me. I only clarified that what they were suggesting already is the case.