I would say that if people on HN are saying the attack is too stupid to be government supported, then the government has succeeded at their primary goal of having plausible deniability with these issues.

If we take recent history, we now have hard evidence of all sorts of conspiracy theory type stuff being absolutely true. With that in mind, do we just keep defaulting to 'not government' every time there's a deliberate backdoor identified? Sounds like a great way to maintain the status quo and ensure that no action is ever taken to curb this.

> this is a textbook example of a sloppy developer who doesn't understand security

From TFA:

02 - Hard coded backdoor

02.1 - Vulnerable code analysis

02.2 - Remote exploitation