#xz hacker's time zone more likely near Eastern Europe than China via analysis of mistakes, implied travel times, holidays schedule and daylight work hours
Time zone's are always messing with developers, even reducing their anonymity.
https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and
If #xz is a nation state project, then you don't just try to infect one opensource project, you attempt to infect dozens. You want to be the bureaucrat that spent 5 man years on a infecting a single open source project and that one failed?
I mean, if you want your project cancelled, that is how you get your funding cancelled.