Comment by olliej

Yeah, they’re entirely different classes of failure (from a security pov, not personal failing, esp nothing the old xz maintainer did).

Also the only reason the xz attack isn’t overwhelmingly worse than the MS attack is because it was caught (by an MS person as well I think?) before it was deployed.