It's pretty dumb this continues to come up years later. You're the NSA delivering source code to the cyber security community. The exact community that: doesn't immediately trust NSA, knows how to find bugs, would love to find any sort of bug in their code (regardless if malicious), people you want to apply for your jobs, people you partner with (academia/other govt orgs/other country cyber security groups).
So your thinking is: yes, this is the crowd we'll attempt to insert backdoor java code.
Okay fine you still don't trust them? Run in a VM without network connection. What security risks/threat are you even talking about?
And yes people have heavily audited the source. You either trust the community catches thing or not. I'm the end of your still tin foil about it, don't use, nobody cares.
So your thinking is: yes, this is the crowd we'll attempt to insert backdoor java code.
Okay fine you still don't trust them? Run in a VM without network connection. What security risks/threat are you even talking about?
And yes people have heavily audited the source. You either trust the community catches thing or not. I'm the end of your still tin foil about it, don't use, nobody cares.