[rigid]

> it enabled it in the first place

it took roughly two years including social engineering.

I'd say the same approach is much easier in a big software company.

[lazyasciiart]

How do you mean?

[rigid]

I bet in the majority of cases, there's no need to pressure for merging.

In a big company it's much easier to slip it in. Code seemingly less relevant for security is often not reviewed by a lot of people. Also, often people don't really care and just sign it off without a closer look.

And when it's merged, no one will ever look at it again, other than with FOSS.

[lodovic]

I've read about workplaces that were compromised with multiple people - they would hire a compromised manager, who would then install one or two developers, and shape the environment for them to prevent discovery, which would make these kind of exploits trivial.