Imo this is the missing puzzle piece (and the more important one for me personally) for software supply chain security, the other ones being deterministic build

Imo this is the missing puzzle piece (and the more important one for me personally) for software supply chain security, the other ones being deterministic builds and signed binaries. And the real problem aren't even people trying to steal your bitcoins [1], you notice that and hopefully had not all your eggs in one basket, it's a (sometimes expensive) lesson in IT security. The much more serious threat are state level actors trying to backdoor secure communication channels, the breach will happen without your knowledge. One shouldn't expect that every nation will take the obvious and public route like the Australian government [2], simply demanding access. With enough resources it seems totally viable to backdoor just one deep dependency of some UI framework and circumvent all end to end encryption used by affected apps. I hope distributed code review will get some traction not only in the Rust world, but in the whole open source universe. [1] https://news.ycombinator.com/item?id=18534392 https://news.ycombinator.com/item?id=18534392 [2] https://arstechnica.com/tech-policy/2018/12/signal-to-australia-good-luck-with-that-crypto-ban/ https://arstechnica.com/tech-policy/2018/12/signal-to-austra...