@joeyh I think this is going to push me even further into the "no generated content in #git" camp. Got a weird binary bit of test data? Write down the steps you use to make it, write down the code that automates those steps, and include that instead, so you can generate the binaries on the fly as a part of the build/test cycle.
@atrus @joeyh@hachyderm.io I think a more useful and realistic takeaway from the #xz #backdoor is that build systems should be clean, direct, simple, and easily readable. A key part was the m4 code in the build system that read the payload from the obfuscated test file. If the build system was easy to read, then it would have been a lot harder to do that.
@eighthave @joeyh My usual (slightly glib) response is that is to remind people how time-consuming dealing with the consequences of that generated content in the long term could be. 😛