I finally read through a couple breakdowns of that XZ hack that almost compromised SSH in several distros (Ars has a good summary) and it’s absolutely bonkers. Andres’ perseverance is heroic. I guess state actors will now get trained on coding for performance?