&gt; It&#x27;s not as if there wasn&#x27;t a way for Apple to detect this<p>Assuming developers were statically linking the old OpenSSH versions, how would Apple detect this? Are developers forced to reveal source code before submitting to Apple? Does OSX executables have some format to specify what libraries it&#x27;s using?<p>I don&#x27;t develop for OSX so I&#x27;m genuinely curious.