[Mashimo]

If xz would have been hosted another place, what could have been prevented?

[croes]

>The technical reason for not opting for such alternatives is that I will not be getting enough contributions there.

Yes.

Sudden interest from multiple people in certain pull request raise suspicions if you only have a contributions.

[Mashimo]

Sounds more like you get less eyes overall on your code. But the attacker will spend the same energy on it.

[croes]

But he can't hide in the masses

[Mashimo]

Yeah I don't buy it. He was more active than most even on github.

[xandrius]

That maybe fewer people would have even known about it and therefore decreased its importance as a target? /s