> easier for a malicious software engineer to embed a backdoor than the NSA, > and involving Amazon would likely rouse the suspicion of many engineers and they

> easier for a malicious software engineer to embed a backdoor than the NSA, > and involving Amazon would likely rouse the suspicion of many engineers and they're not known to keep their mouths shut pretend I'm NSA. I show up to head counsel at AMZN with an NSL saying "all your code are belong to me". He says "yessa massa" and bows. I say, "ok, not all your code, but give me full disk images of the build server that signs code for the echo, and full disk images of the git server housing the current echo build. One "yessa massa" later, and he briefs CTO of DevOps to do the pull, which happens at 2:30am on a sunday morning (when those chatty-cathy engineers are fast asleep in their neckbeard nests). `cp disk1 disk2 /nsa_folder/` wait 20 minutes, done. NSA is doing full signed echo builds by EOD Monday. what is actually precluding that from happening. Now NSA can build "updates" for the echo, sign their builds, "deploy" them using their rooted telco infrastructure. what would actually keep this hypothetical scenario from happening ?