> "finding a bug" in source code implies there's a mistake there. This is a good point of course. Implementation, protocol and runtime bugs are indeed invisibl

> "finding a bug" in source code implies there's a mistake there. This is a good point of course. Implementation, protocol and runtime bugs are indeed invisible from the source POV. As are lower level Ken Thompson "trusting trust" [0,1] bugs in your tool chain. Most of all though, many "bugs" are just malicious functions the coders meant to put in there. [0] https://cybershow.uk/episodes.php?id=2 https://cybershow.uk/episodes.php?id=2 [1] www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf