On: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

[fredamaral]

case closed. you are right... could of course make the things a bit more difficult for someone not backed by a state sponsor. but if that's the case, you are right.

[tw04 → fredamaral]

Sadly the only way to even have a chance of fighting this is to insist on new contributors being vetted in person, and even that won’t be fool-proof.

It’s also not scalable and likely won’t ever happen, but it’s the only solution I can come up with.