The audit process assumes the upstream maintainers aren't malicious actors attempting to actively bypass the process: > After upgrading chromium to 43, I notic

The audit process assumes the upstream maintainers aren't malicious actors attempting to actively bypass the process: > After upgrading chromium to 43, I noticed that when it is running and immediately after the machine is on-line it silently starts downloading "Chrome Hotword Shared Module" extension, which contains a binary without source code. There seems no opt-out config. They don't have the resources to do a full audit on all the packages: https://www.debian.org/security/audit/ https://www.debian.org/security/audit/ > Due to the sheer size of the current Debian release it is infeasible for a small team to be able to audit all the packages, so there is a system of prioritizing packages which are more security sensitive.