Yes, it would me more notable if a client could somehow compromise the server, which may work theoretically as an internal attack vector in a software dev organ

Yes, it would me more notable if a client could somehow compromise the server, which may work theoretically as an internal attack vector in a software dev organization. I agree that compromising a distro server is unlikely, but I suppose a mitm attack could be plausible though, and this would give arbitrary code execution. EDIT: or is it ACE? The article seems to emphasize sending arbitrary _data_ to the client, so now I'm confused. If you can make the binary print something else, surely you have ACE? Or do you have to step through the code?