Tridgell: rsync and outrage
Andrew Tridgell has written a blogpost responding to complaints that he has begun using LLM tools inhis work maintaining rsync:
Like many developers of open source packages I've been hit by aflood of security reports lately in my role as the rsyncmaintainer. Many of those reports are AI generated (not all though,there are some notable ones with very careful and high quality manualanalysis).
As this flood started to get more intense I realised I needed toraise the defences on rsync a lot - we needed much more thorough testsuites, code coverage analysis, CI testing on a lot more platforms,deliberate and thorough scanning for possible security issues (so Ifind at least some of them before other people!) and the addition of awhole lot of defence-in-depth hardening techniques.
[...] Now to the future, because we're not done yet by a longshot. The security reports keep rolling in. I'm working on a bunch ofCVEs right now. Luckily I've been joined by some other very gooddevelopers with great systems development skills and securityknowledge. Some of these people came to my attention partly because ofall the rage happening at the moment, so I get some rage storm cloudshave silver linings. Watch out for some credits for some great newrsync developers in the next release.