08 Dec 2025
Planet Debian
Thorsten Alteholz: My Debian Activities in November 2025
Debian LTS/ELTS
This was my hundred-thirty-seventh month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian and my eighty-eighth ELTS month. As the LTS- and ELTS-teams have been merged now, there is only one paragraph left for both activities.
During my allocated time I uploaded or worked on:
- [DLA 4381-1] net-snmp security update to fix two CVEs related to denial of service.
- [DLA 4382-1] libsdl2 security update to fix one CVE related to a memory leak and a denial of service.
- [DLA 4380-1] cups-filters security update to fix three CVEs related to out of bounds read or writes or a heap buffer overflow.
- [ELA-1586-1] cups-filters security update to fix three CVEs in Buster and Stretch, related to out of bounds read or writes or a heap buffer overflow.
- [libcupsfilters] upload to unstable to fix two CVEs
- [cups-filters] upload to unstable to fix three CVEs
- [cups] upload to unstable to fix two CVEs
- [rlottie] upload to unstable to finally fix three CVEs
- [rplay] upload to unstable to finally fix one CVE
- [#1121342] trixie-pu bug for libcupsfilters to fix two CVEs in Trixie.
- [#1121391] trixie-pu bug for cups-filter to fix three CVEs in Trixie.
- [#1121392] bookworm-pu bug for cups-filter to fix three CVEs in Bookworm.
- [#112433] trixie-pu bug for rlottie to finally fix three CVEs in Trixie.
- [#112437] bookworm-pu bug for rlottie to finally fix three CVEs in Bookworm.
I also attended the monthly LTS/ELTS meeting and did a week of LTS/ELTS frontdesk duties. I also stumbled upon a bug in python3-paramiko, where the parsing of include statements in the ssh_config does not work. Rather annoying but already fixed in the newest version, that only needs to find its way to my old VM.
Debian Printing
This month I uploaded a new upstream version or a bugfix version of:
- … lprng to unstable.
- … cpdb-backend-cups to unstable.
- … cpdb-libs to unstable.
- … ippsample to unstable.
- … cups-filters to unstable.
I also uploaded cups to Trixie, to fix bug #1109471 related to a configuration problem with the admin panel.
This work is generously funded by Freexian!
Debian Astro
This month I uploaded a new upstream version or a bugfix version of:
- … siril to unstable (sponsored upload).
- … supernovas to unstable (sponsored upload).
Debian IoT
This month I uploaded a new upstream version or a bugfix version of:
- … openzwave-controlpanel to unstable.
- … pywws to unstable.
Debian Mobcom
This month I uploaded a new upstream version or a bugfix version of:
- … osmo-tetra to unstable.
- … libgsm to unstable.
- … osmo-tetra to unstable.
misc
This month I uploaded a new upstream version or a bugfix version of:
- … cpptest to unstable.
- … npd6 to unstable.
- … ptunnel to unstable.
- … ptunnel-ng to unstable.
- … dateutils to unstable.
- … apcupsd to unstable.
- … puppet-modules-cirrax-gitolite to unstable.
- … visam to unstable.
- … apcupsd to unstable.
On my fight against outdated RFPs, I closed 30 of them in November.
I started with about 3500 open RFP bugs. and after working six months on this project, I have closed 183 bugs. Of course new bugs appeared, so the overall number of bugs is only down to about 3360.
Though I view this as a successful project, I also have to admit that it is a bit boring to work on this daily. Therefore I close this diary again and will add the closed RFP bugs to my bug logbook now. I also try to close some of these bugs by really uploading some software, probably one package per month.
FTP master
This month I accepted 236 and rejected 16 packages. The overall number of packages that got accepted was 247.
08 Dec 2025 3:20pm GMT
François Marier: Learning a new programming language with an LLM
I started learning Go this year. First, I picked a Perl project I wanted to rewrite, got a good book and ignored AI tools since I thought they would do nothing but interfere with learning. Eventually though, I decided to experiment a bit and ended up finding a few ways to use AI assistants effectively even when learning something new.
Searching more efficiently
The first use case that worked for me was search. Instead of searching on a traditional search engine and then ending up on Stack Overflow, I could get the answer I was looking for directly in an AI side-window in my editor. Of course, that's bad news for Stack Overflow.
I was however skeptical from the beginning since LLMs make mistakes, sometimes they making up function signatures or APIs that don't exist. Therefore I got into the habit of going to the official standard library documentation to double-check suggestions. For example, if the LLM suggests using strings.SplitN, I verify the function signature and behaviour carefully before using it. Basically, "don't trust and do verify."
I stuck to the standard library in my project, but if an LLM recommends third-party dependencies for you, make sure they exist and that Socket doesn't flag them as malicious. Research has found that 5-20% of packages suggested by LLMs don't actually exist, making this a real attack vector (dubbed "slopsquatting").
Autocomplete is too distracting
A step I took early on was to disable AI autocomplete in my editor. When learning a new language, you need to develop muscle memory for the syntax. Also, Go is no Java. There's not that much boilerplate to write in general.
I found it quite distracting to see some almost correct code replace my thinking about the next step. I can see how one could go faster with these suggestions, but being a developer is not just about cranking out lines of code as fast as possible, it's also about constantly learning new things (and retaining them).
Asking about idiomatic code
One of the most useful prompts when learning a new language is "Is this the most idiomatic way to do this in Go?". Large language models are good at recognizing patterns and can point out when you're writing code that works but doesn't follow the conventions of the language. This is especially valuable early on when you don't yet have a feel for what "good" code looks like in that language.
It's usually pretty easy (at least for an experience developer) to tell when the LLM suggestion is actually counter productive or wrong. If it increases complexity or is harder to read/decode, it's probably not a good idea to do it.
Reviews
One way a new dev gets better is through code review. If you have access to a friend who's an expert in the language you're learning, then you can definitely gain a lot by asking for feedback on your code.
If you don't have access to such a valuable resource, or as a first step before you consult your friend, I found that AI-assisted code reviews can be useful:
- Get the model to write the review prompt for you. Describe what you want reviewed and let it generate a detailed prompt.
- Feed that prompt to multiple models. They each have different answers and will detect different problems.
- Be prepared to ignore 50% of what they recommend. Some suggestions will be stylistic preferences, others will be wrong, or irrelevant.
The value is in the other 50%: the suggestions that make you think about your code differently or catch genuine problems.
Similarly for security reviews:
- A lot of what they flag will need to be ignored (false positives, or things that don't apply to your threat model).
- Some of it may highlight areas for improvement that you hadn't considered.
- Occasionally, they will point out real vulnerabilities.
But always keep in mind that AI chatbots are trained to be people-pleasers and often feel the need to suggest something when nothing was needed
An unexpected benefit
One side effect of using AI assistants was that having them write the scaffolding for unit tests motivated me to increase my code coverage. Trimming unnecessary test cases and adding missing ones is pretty quick when the grunt work is already done, and I ended up testing more of my code (being a personal project written in my own time) than I might have otherwise.
Learning
In the end, I continue to believe in the value of learning from quality books (I find reading paper-based most effective). In addition, I like to create Anki questions for common mistakes or things I find I have to look up often. Remembering something will always be faster than asking an AI tool.
So my experience this year tells me that LLMs can supplement traditional time-tested learning techniques, but I don't believe it obsoletes them.
P.S. I experimented with getting an LLM to ghost-write this post for me from an outline (+ a detailed style guide) and I ended up having to rewrite at least 75% of it. It was largely a waste of time.
08 Dec 2025 12:15am GMT
Freexian Collaborators: Debian's /usr-move transition has been completed (by Helmut Grohne)

By now, the /usr-merge is an old transition. Effectively, it turns top-level directories such as /bin into symbolic links pointing below /usr. That way the entire operating system can be contained below the /usr hierarchy enabling e.g. image based update mechanisms. It was first supported in Debian 9, which is no longer in active use at this point (except for users of Freexian's ELTS offer). When it became mandatory in Debian 12, it wasn't really done though, because Debian's package manager was not prepared to handle file system objects being referred to via two different paths. With nobody interested in handling the resulting issues, Freexian stepped in and funded a project lead by Helmut Grohne to resolve the remaining issues.
While the initial idea was to enhance the package manager, Debian's members disagreed. They preferred an approach where files were simply tracked with their physical location while handling the resulting misbehavior of the package manager using package-specific workarounds. This has been recorded in the DEP17 document. During the Debian 13 release cycle, the plan has been implemented. A tool for detecting possible problems was developed specifically for this transition. Since all files are now tracked with their physical location and necessary workarounds have been added, problematic behavior is no longer triggered. An upgrade from Debian 12 to Debian 13 is unlikely to run into aliasing problems as a result.
This whole project probably consumed more than 1500 hours of work from Debian contributors, of which 700 were sponsored by Freexian through the work of Helmut Grohne. What remains is eventually removing the workarounds.
08 Dec 2025 12:00am GMT