> I’m convinced the most likely backdoor code in curl is a deliberate but hard-to-detect security vulnerability Evil organisations and/or big government agenci

> I’m convinced the most likely backdoor code in curl is a deliberate but hard-to-detect security vulnerability Evil organisations and/or big government agencies are probably working on finding vulnerabilities and using them without reporting them. That sounds more efficient and impossible to spot or prove, than trying to implement backdoors directly.