Simple Nomad<p>Okay this isn't an unpopular opinion as much as it is a realistic one as far as I am concerned. It involves <a href="https://rigor-mortis.nmrc.org/tags/xz" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>xz</span></a> and the person/persons behind it. For simplicity's sake in explaining, assume just a person.</p><p>They have a really high skill level, they were not working on xz constantly, but sporadically. You know, like a contributor doing this in their spare time would, with a few bursts of activity. Someone at that level of skill certainly is not just doing this, I would strongly suspect they have other "projects" they are working. Some have probably been completed, some are probably still in progress. I cannot imagine this being an isolated incident.</p><p>I also cannot imagine this being a single "technique", as it were. Another project might include committing code that actually solved a problem but introduces a tiny conditional security flaw, just waiting for an additional tiny security flaw to make the whole thing "work".</p><p>I could also imagine this person could have a day job as a contractor or even a full remote employee writing their little "projects" for closed-source applications that may or may not involve something security or infrastructure related.</p><p>Or all of the above. Yes this is a mess of unknown unknowns, but this is the type of things I think about. I've been considering them for ages, the whole xz thing has simply given me a reason to publicly pontificate.</p><p><a href="https://rigor-mortis.nmrc.org/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://rigor-mortis.nmrc.org/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a> <a href="https://rigor-mortis.nmrc.org/tags/HackerLife" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HackerLife</span></a></p>