Just saying, just because something is open source doesn’t mean it has no vulnerability or backdoor in it’s code.
There is plenty of example of vulnerabilities that existed for years in major open source projects. And there is definitely people that discover some zero day and straight up sell them and stay quiet.
If you look at some of the businesses in the market of zero day vulns you can see what they offer for good vulns.
Who cares if the NSA uses it. Or if they say they use it. They gain nothing in saying they use a specific product. But that’s a good way to encourage others to use it. I certainly wouldn’t trust the NSA on anything they say publicly.
You can backdoor a product just for you and still release it so other people you might be interested in will give you cool data. In cryptography this is not really an issue to have backdoors that only some people can use.
If I remember correctly the F-Droid team on Android had a lot of trouble getting reproductible builds. I can’t imagine how difficult this would be for a whole system.
Remember that AI answer that said that adding -f option was to get a confirmation before deletion ?
I’m a bit concerned that this kind of meme will get a lot more real when people will blindly trust AI for commands.
Unfortunately I couldn’t find the post in question but if I recall it was GitHub AI telling boldly that you can add -f to your RM command to get a confirmation…