tobyhede’s statuslog

My hot take is that the xz vulnerability was not sponsored by a state actor, but by a Big Tech vendor. If Open Source is poisoned, vendors can step in to the vaccum at high, high prices.