lobsters score: 3 · tags: security
rrsync in 3.5.0 was quite broken. 3.5.1 fixes it.
I would like to know why you feel this Debian Security News belongs on lobsters. Care to elaborate?
score 1 · canonical
rrsync in 3.5.0 was quite broken. 3.5.1 fixes it.
Note that all of the fixes from 3.5.1 were added in the Debian Trixie package 3.5.0+ds1-0+deb13u1.
I was very careful in timing the fix of the CVEs for a moment where all known regressions were fixed and the risk of new unknown ones was lower
score 1 · canonical
Topicality: Lobsters is focused pretty narrowly on computing; tags like art don’t imply every piece of art is on-topic. Some rules of thumb for great stories to submit: Will this improve the reader’s next program?
Yes, if your Debian system is considered a program.
Will it deepen their understanding of their last program?
If their last program used rsync and they have automatic upgrades, I suppose it might?
Will it be more interesting in five or ten years?
Definitely more interesting, I love retrocomputing and old news. Something voyeur about it, and so weird that people in the old days were so different from us, and yet so similar.
Some things that are off-topic here but popular on larger, similar sites: entrepreneurship,
Doesn’t apply
management,
Doesn’t apply
news about companies that employ a lot of programmers,
Doesn’t apply
investing,
Doesn’t apply
world events,
Doesn’t apply
anthropology,
Doesn’t apply
self-help,
Doesn’t apply
personal productivity systems,
Doesn’t apply
last-resort customer service requests via public shaming, “I wanted to see what this site’s amazing users think about this off-topic thing”,
Doesn’t apply
and defining the single morally correct economic and political system for the entire world when we can’t even settle tabs vs. spaces.
Doesn’t apply
score 1 · canonical
Its important news in the computing world. I’d rather read about this update than anything vibecoding related, but both still belong here.
score 1 · canonical
Yes, they are. Its unfortunate, but its also the reality of the world we live in at the moment. I’d also rather see LLM’s/“AI” be used to find CVE’s and help get things fixed than let the vulnerabilities sit and be abused.
I mostly draw the line at using LLM’s/“AI” to do all the coding from the start. I think as something like a ‘linter’ they’re mostly fine. It gets to be a bit problematic when you’re letting the bots write the code and you can’t really attribute copyright properly.
score 1 · canonical
It gets to be a bit problematic when you’re letting the bots write the code and you can’t really attribute copyright properly.
Anthropic offers an indemnification arrangement, which should mean it’s only going to be a problem for Anthropic!
This is covered in section K of the commercial terms.
score 1 · canonical
Yes, they are. Its unfortunate, but its also the reality of the world we live in at the moment. I’d also rather see LLM’s/“AI” be used to find CVE’s and help get things fixed than let the vulnerabilities sit and be abused.
Are any of these CVEs related to the vibecoded refactor of rsync?
(ETA: Only one of the high+ CVEs has an affected version range >= 3.4.1 (when, I think, vibecoding started getting added): CVE-2026-70455, with
= 3.4.2, <= 3.4.4; and, at first glance, it doesn’t look related to any vibecoding; it was a dragging PR from several years ago with only a single, relatively brief commit to the implementation.)I mostly draw the line at using LLM’s/“AI” to do all the coding from the start. I think as something like a ‘linter’ they’re mostly fine. It gets to be a bit problematic when you’re letting the bots write the code and you can’t really attribute copyright properly.
IIRC, rsync made a point of doing a large refactor via LLMs. If that vibecoded code is, itself, vulnerable, then… LLMs aren’t exactly helping on the abused vulnerabilities front.
score 1 · canonical
I don’t know, I don’t really use “rsync” these days as I mostly use OpenBSD (which includes its own version of rsync). But it has come out that the current maintainer of rsync has been using LLM’s to assist with maintenance so that they can spend more time on the beach (and yes I support OSS authors getting plenty of beach time).
I think only time will tell if LLM’s end up producing security churn. I suspect they will to an extent because they don’t really “know” anything and probably aren’t going to program with “secure programming practices”. But I don’t really use LLM’s for anything, so I can’t really speak to if they do that or not. If its code based on what its been trained on, and its prompted to look for specific vulnerabilities and then fix them its certainly possible for those fixes to include another issue. If the actual human pushing the fix for that vuln isn’t aware of secure coding practices then things could certainly slip under the rug.
score 1 · canonical
Debian’s “stable” distro usually doesn’t bump package versions so this is, at least, an unusual event. I think it’s reasonable to give lobsters a chance to discuss, although OP could/should have provided some context.
I’d expect Debian package version bumps to happen more often (at least for the near- to mid-term future) as the effort required to back-port our current flood of LLM-discovered fixes becomes greater than the maintainers can afford.
score 2 · canonical
This could have some serious effects on scripts that rely on consistent rsync behaviour.
score 1 · canonical
Yeah definitely interesting of how those bumps might break distro releases, and what this might mean moving forward (if it will be sustained, increase, or die down). And what mitigation folks might need to employ to avoid brokenness.
score 1 · canonical