Trust in the original authors' code is only half of the attack surface. The other half is trust that no future contributors are malicious. Is the project more c

Trust in the original authors' code is only half of the attack surface. The other half is trust that no future contributors are malicious. Is the project more capable than Google in ensuring that malicious code can't land in the code base? I think the answer is clearly no.