Curl’s backdoor threat
Backdoors in software is one of those nightmarish scenarios that disturbs you until you just think about something else and kind of temporarily forget it (like nuclear war, killer bees, climate change or asteroid impact). Open Source just raises the bar but in no way solves these problems (for example OpenSSH's roaming feature/bug, OpenSSL and Heartbleed). In computing one can quickly become paranoid: software buttons for switching smartphones off (are they 'really' off?), always-on microphones, webcams (granted, you can cover it), blobs in your smartphone and home router, downloads from <a href="http://download.cnet.com" rel="nofollow">http://download.cnet.com</a> (note the lack of https), winscp, putty from www.putty.org (again, no https, which is not even the actual site, but nevertheless the first result from Google). In Linux the landscape is slightly better, but do you really trust all those packagers? Do you <i>really</i> understand each line of code when you "git clone foo; cd foo; ./configure; make; sudo make install"?, and in X11 you can easily make a key-logger without even being root! [1]. And not even full disk encryption can protect us (Evil Maid [2]).<p>That's one of the reasons I'm skeptical of the Ethereum smart-contract concept. In theory it works, but in practice I'm not sure at all. The DAO heist was one early example of security bugs in smart contracts, but I fear they will become more common when malware developers turn to "contract-engineering".<p>[1] <a href="https://superuser.com/questions/301646/linux-keylogger-without-root-or-sudo-is-it-real" rel="nofollow">https://superuser.com/questions/301646/linux-keylogger-witho...</a><p>[2] <a href="https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html" rel="nofollow">https://www.schneier.com/blog/archives/2009/10/evil_maid_att...</a>