I do about a monthly update of my Debian machines. Today I did the usual monthly update and noticed loads of packages uploading from the “security” branch. I’ve had the impression (just an impression) that more and more packages are being updated from security over the past many months. Trixie has been out for a while now and I would have thought that less and less updates should be coming from security. Has anyone had this sensation and if so has anyone linked this to AI finding more holes in OSS that would have normally been found by human scrutiny? Has there been any official research into this? And if this is true, does it mean that we have been running insecure software all along? Or is there is there a risk that AI start filing patches that actually make it less secure because software maintainers are not being rigorous in verifying who is submitting the patch? AI must be changing the paradigm of software development more than any other area of our lives and I can’t still work out if in a better way or not.
What really caught my attention was that in the update of today, the rsync package maintainer had to announce that he/she was jumping to version 3.5 because of “33 CVEs” … how can a software like rsync that has been around for so long have 33 CVEs shipped in just one update. I’m not a software developer but that sounds like a lot of CVEs?



btw, thanks for those that made some good suggestions. I found farmOS and OpenFarm in the meantime which are not exactly for a garden. but my garden is big :-) almost 1 hectare … includes olive tree plantation (70), vegetable garden, dogs, chickens and and soon, when I retire, goats. so maybe not far from a little farm.