Agreed, this is an issue with complexity more generally, but microcode seems like a particularly important case. As far as I can tell from the software world t

Agreed, this is an issue with complexity more generally, but microcode seems like a particularly important case. As far as I can tell from the software world though, it's pretty rare for anyone to try this kind of thing. When their software is Free and Open Source, some companies put telemetry in there (e.g. Visual Studio Code), but it's very rare for there to be anything this malicious hidden away in publicly viewable code. The Linux world has collectively agreed to trust SELinux, for instance, despite that it originates from the NSA.