[jasonjayr]

How can a commercial solution prevent backdoors?

A sensitive product like this would have to defend against well funded, patient, well resourced threats, including but not limited to infiltrating an organzation in order to plant code that only a few people may even be able to notice.

[2OEH8eoCRo0]

Well for one they need to show up in person. They can't be some anon anime character who hides their identity for totally legitimate reasons.

[toast0]

As an employee, I've typically needed to show up in person, but I've worked with contractors who never showed up in person. I've even been such a contractor at times.

Lots of commercial products use contractors and licensed code in the final product.

At least with most open source projects, a lot of the contribution process is in the open, so you could watch it you wanted to. As DonHopkins writes elsewhere, few people do, but it's possible. Not a lot of commercial projects offer that level of transparency into changes.

[dijit]

It's extremely easy for a three-letter agency or similar to plant a new employee.

Corporate espionage may not be talked about very much, but it is still very fashionable. Even without state sponsored attackers.

[kstrauser]

I worked at my current job for 3 months before I met a coworker in person. That might slightly help at a legacy butts-in-seats factory, but doesn't do a lot for remote jobs. I could be proxying in from Romania for all they'd know.