[suddenclarity]

Which is a can of worms by itself which we saw this year with xz-utils.

[kragen]

yes, and we are going to see a lot more of that, unfortunately. heartbleed was another somewhat similar case, and though the debian openssl hole was probably accidental, nobody will ever be able to prove that conclusively