If nvk or another high-level CoinKite employee had wanted to execute a rug-pull, they'd have far stealthier and more effective ways of accomplishing it than committing their malicious code directly to github in a signed commit.
For example, just distribute malicious firmware builds but keep the git tree "clean". 99.9% of people, even experienced devs, aren't going to build their own firmware from source or reproduce the firmware's hash - they just install whatever binaries the devs ship. A backdoor inserted through a malicious build is undetectable without some serious reverse-engineering skills. If anyone does call you out on the build being impossible to reproduce, you can just blame some unknown "bug" in the dev's local build system, change the tooling a bit, and call it "fixed" before anyone catches on.
And if you were going to introduce a vulnerability into a git tree, you wouldn't do it in the main firmware repo. You'd place the vulnerability deep in the dependency graph, so that when the rug is pulled, you can blame some anonymous 3rd party library as a scapegoat and maybe recover a semblance of your reputation.
Absolutely agreed.
If nvk or another high-level CoinKite employee had wanted to execute a rug-pull, they'd have far stealthier and more effective ways of accomplishing it than committing their malicious code directly to github in a signed commit.
For example, just distribute malicious firmware builds but keep the git tree "clean". 99.9% of people, even experienced devs, aren't going to build their own firmware from source or reproduce the firmware's hash - they just install whatever binaries the devs ship. A backdoor inserted through a malicious build is undetectable without some serious reverse-engineering skills. If anyone does call you out on the build being impossible to reproduce, you can just blame some unknown "bug" in the dev's local build system, change the tooling a bit, and call it "fixed" before anyone catches on.
And if you were going to introduce a vulnerability into a git tree, you wouldn't do it in the main firmware repo. You'd place the vulnerability deep in the dependency graph, so that when the rug is pulled, you can blame some anonymous 3rd party library as a scapegoat and maybe recover a semblance of your reputation.
Hanlon's Razor applies here.