xzre

Worth a watch. There's also this GitHub where there's reverse engineering going on: https://github.com/smx-smx/xzre We now know the answer to the question of "who would win?" 1) A years-long nation-state-backed hacking effort to infiltrate a software project and compromise most servers in the Western world or 2) A German's obsession with efficiency and precision in engineering

> The performance regression is __not__ big. It's lucky Andres caught it at all. It's also not necessarily all that simple to remove it. It's not simply a bug in a loop or some such. If I was the xz team I'd have enough faith in all the work that was done to give it high odds that they'd get there before discovery. That they'd have time; months, even. True in the contents of sshd logins it isn't that big, but ~500ms to get from _start() to main() isn't small either, compared to the normal cost of that phase of library startup. Their problem was that the sshd daemon fork+exec's itself to handle a connection, so they had to redo a lot of the work for each connection. I suspect they started off with much smaller overhead and then it increased gradually, with every feature they added, just like it happens with many software projects. Here's