funny how the "free/open source software is more secure, because more people can look at it" argument proved valid with the xz thing. in the end somebody found it by poking around and later looking at the thing