> From some of them perhaps, but plenty hide for -years- undetected.
Which ones? Not even xz-utils was years (it was weeks), and it’s the poster child for a attacker doing everything right until the very end.
Which ones? Not even xz-utils was years (it was weeks), and it’s the poster child for a attacker doing everything right until the very end.
I am aware of at least one evil firm that finds bugs like these months and sometimes years before they are public and sells the knowledge to spooks until someone else independently spots them and tells the public.
Only a matter of time before these types of firms introduce the bugs themselves given the incentives, if they are not already.
(This is also different from what the GP argues.)
Not every malicious actor is a financially driven crypto-miner or credential stealer. It seems likely that some exploits are going to be sat on or used in a highly targeted manner such that we may never know they exist.
But again: it’s impossible to argue against a “silent majority” claim. The argument passes the sniff test for drug smuggling because we have separate evidence that most drugs are not interdicted. We have no such separate evidence for open source supply chain compromises.