I found this Veratasium documentary on the xz Jia Tan backdoor adventure quite good and surprisingly detailed:

https://www.youtube.com/watch?v=aoag03mSuXQ

The Internet Was Weeks Away From Disaster and No One Knew

YouTube

@bagder I'm confused to as why binary blobs are allowed to be stored in public source code repositories anyways.

I mean, I understand if you want to include assets for a game, but wouldn't it then be safer to store them in readable format before compression? As a simplified example, png's could be stored as xpm in source and then converted into the better format using provided tools, also in the repo.

Tldr being: If blobs are to be used in tests, write a tool that generates the blob for them.

@thanius @bagder it is weird but it was done to test compression /decompression with known blobs (I think) and since it was always like this, no one thought twice. I'd guess this kind of thing is being much more heavily scrutinized now.