Is anyone at Debian paid to keep up with this spigot of CVEs?