[juitpykyk]

You're talking as if securing a backdoor with public cryptography is some unimaginable feat of technology.

It's literally a couple hours work.

[parl_match]

Inserting a change like this as a one off would cause lots of scrutiny, which would probably get it detected. Instead, the bad actor spent years contributing to the project before dropping this.

So, while writing the exploit might be a couple of hours work, actually pulling it off is quite a bit more difficult.

[londons_explore]

Plenty of open source maintainers spend only a few hours a month on their projects.

For many projects, that is enough to become the main contributor.

[kbenson]

I don't think they were using complexity as the reason for that assumption, but instead goals. Adding security doesn't require a nation state's level of resources, but it is a more attractive feature for a nation state that wants to preserve it over time and prevent adversaries from making use of it.

[heavyset_go]

This makes sense in closed source products where you'll never get to audit the source for such exploits, but little sense in open source projects where anyone can audit it.

That's to say an enterprise router or switch would likely have secured exploits put there by corporate and national security agencies, whereas open source exploits would benefit from the probable deniability.

[neodymiumphish]

And on the contrary, creating a vulnerability that’s not identifiable to a limited attack group provides for a bit more deniability and anonymity. It’s hard to say which is more favorable by a nation-state actor.

[justinclift]

It'll be kind of tragic if this backdoor turns out to be the developer's pet "enable remote debugging" code, and they didn't mean for it to get out into a release. ;)

[unkulunkulu]

I would be scared to work near a person who writes his debugging tools this way :D