The thing that I think annoys me the most about the whole xz thing is all the hand wringing about “software supply chain”. We are not your supply chain. If any other industry had a supply chain wherein every single link said “no warranty either express or implied” in big block caps they’d shit themselves. Yes I think folks maintaining critical parts of the system should be looked after but also maybe we should all just lower our expectations a bit?