@yaxu@post.lurk.org I think I was extrapolating a bit... But the idea that the code would change differently for different communities via piecemeal distribution would mean that security issues found and fixed in one community would not necessarily make it to others. You could have a centralized, globally-accessible channel for security patches only, I suppose, but it feels like that goes against the spirit of things (and it would be at least one central, public place where anyone could get a copy). If different people working with different versions of the software do have different security patches applied, then an adversary can just get their hands on or reverse engineer a few versions, figure out which patches are missing, and then attack each community based on those. Thence "obscurity is not security" because one argument against that scenario is that an attacker from outside the communities-of-use wouldn't have access to the source code, making it harder for them, but that's just obscurity, not real security. Which led me to thinking: does this kind of slow code even need network access at all? Much of it probably doesn't, so you could mitigate the security risks a bit that way.