3 ms·

It was found in a few weeks so why is it more likely it wouldn't have been noticed for months/years with more people running the backdoored version of the code?

• ufo 3y ago
  We were lucky that the backdoor called attention to itself, because it impacted the performance off ssh and introduced valgrind warnings.
  • TheBlight 3y ago
    Doesn't that further suggest non-state actor(s)?
    • ufo 3y ago
      I've heard that it was only detected because the developer that found it was using different compiler flags than the default. Under default settings, the backdoor was stealthier.