> Even with reproducible builds + open source, the source code can be written in a way which deliberately masks a vulnerability in subtle ways.
This is what happened Easter 2024 with zx library in ssh.
Plumeros ☮️
npub1c3…w4dgp
2025-12-02 21:06:55 UTC
in reply to nevent1q…y0v8
Author Public Key
npub1c3clte4szfeaxuerv87qr89prc0urdkme2d024ded28ess2g8fvqcw4dgpSeen on
wss://relay.momostr.pinkPublished at
2025-12-02 21:06:55 UTCEvent JSON
{
"id": "44b09c127ec498a85a4fc6e21f9d580be5a32ea7dcb79bde289c303da6d706c8",
"pubkey": "c471f5e6b01273d3732361fc019ca11e1fc1b6dbca9af555b96a8f9841483a58",
"created_at": 1764709615,
"kind": 1,
"tags": [
[
"p",
"f995c7860c3417593877b9206fa975c885a47ea4a5dff2fd90bde4b3ca364e9c"
],
[
"p",
"37f7dd46085d9468e3b773864cb25469d5ec3295e427b8f1d92b3bc6b6edb7bc"
],
[
"e",
"5624511a1eb893575a57c2dfbe7b7a004363a5da25f0adc9afe06e4d4fbbb639",
"",
"reply",
"b3ba3c5045fbaf99be9cb4daa9f1d7baeedaba0fc5b91596511e2fb7a70dd7f9"
],
[
"p",
"e42137f9d0366bbf3d951d78bd67cc4d22e1d8f228c0e65e2be2a397dac7701c"
],
[
"proxy",
"https://swiss.social/@plumeros/115652009335150329",
"web"
],
[
"e",
"6ed7b33bfea7cc2c549affe907142c472cc6c5974450535baabcb0207d5962cb",
"",
"root",
"37f7dd46085d9468e3b773864cb25469d5ec3295e427b8f1d92b3bc6b6edb7bc"
],
[
"p",
"c471f5e6b01273d3732361fc019ca11e1fc1b6dbca9af555b96a8f9841483a58"
],
[
"p",
"b3ba3c5045fbaf99be9cb4daa9f1d7baeedaba0fc5b91596511e2fb7a70dd7f9"
],
[
"proxy",
"https://swiss.social/users/plumeros/statuses/115652009335150329",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://swiss.social/users/plumeros/statuses/115652009335150329",
"pink.momostr"
],
[
"-"
]
],
"content": "\u003e Even with reproducible builds + open source, the source code can be written in a way which deliberately masks a vulnerability in subtle ways.\n\nThis is what happened Easter 2024 with zx library in ssh.",
"sig": "dd44fbc0cb08470844fcd369b860a4070f32028f3fbec3efe2d1ac20e6a3eaed6111f4291b7ebc422b31ae8db86ff1802ab6562939618b782e3d801b01bf0cf8"
}