@regehr How would an OS build team be able to detect whether this kind of approach has already infected a mainstream operating system ? Does this vulnerability detection requirement align with the work of those interested in reproducible builds ?