Thoughts on xz backdoor. 1) Lack of a robust identity system on github (except when there is a tie-in to an organization which is slightly better). Anyone can create as many sock puppets accounts to do code reviews, nudge maintainers to add someone malicious as co-maintainers, etc. This is same for both most critical projects in critical infrastructure or a hobby experimental project. 2) Lack of tie-in of source to release artifacts. In xz, a malicious developer was able to modify release tarballs without anyone noticing (except test binaries). This could be solved if we have Sigstore-signed SLSA provenance everywhere, but realistically what can we do now ? Maybe OSS-Fuzz and other test frameworks need to independently test release binaries, without any developer intervention (e.g. there was some tripping on valgrind and sanitizer in this case, might not apply in other cases). Maybe, we need capability analysis (e.g. with Capslock) that looks at capability differences between versions and trips on suspicious things.