> So we've had what, two incidents (xz and eventstream) in how many years? This is specious reasoning. You're only complaining you only heard of two incidents

> So we've had what, two incidents (xz and eventstream) in how many years? This is specious reasoning. You're only complaining you only heard of two incidents. What you're really pointing out is that this attack vector works reliably well and is reproducible across projects. You're also pointing out that this attack vector will continue to work until something is done to mitigate it. I really do not understand what point you think you are making.