Russ Cox 28 August 2023 One of the key benefits of open-source software is that anyone can read the source code and inspect what it does. And yet most software, even open-source software, is downloaded in the form of compiled binaries, which are much more difficult to inspect. If an attacker wanted to run a supply chain attack on an open-source project, the least visible way would be to replace th
![Perfectly Reproducible, Verified Go Toolchains - The Go Programming Language](https://cdn-ak-scissors.b.st-hatena.com/image/square/61955b2029cca886435bd7bb93b949e8f18ae48d/height=288;version=1;width=512/https%3A%2F%2Fgo.dev%2Fdoc%2Fgopher%2Frunningsquare.jpg)