More personal observations:

8. Consumers are naive, yes. But the software industry itself is naive about the security threat.

9. The social exploit is part of the code exploit.

10. The FOSS axiom "More Eyes On The Code" works, but only if the "eyes" are educated. FOSS needs material support from industry. A MSFT engineer caught this exploit, but it still was released to G.A. in Fedora 41, openSUSE, and Kali.

11. The dev toolchain and testing process were never conceived to test for security. (edit: Also see Solarwinds [1] )

= = =

[1] _ https://www.wired.com/story/the-untold-story-of-solarwinds-t...