anchor.diff:  
   StatusFunctional but not feature-complete compared to libXau. Feel free to contribute! 
   
  -Known ProblemsThe API is not documented, but the example file should be self-explanatory.",http://code.google.com/p/xauthxx,,0,3,528,C++,lgpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,167548,C,Shared Library,1,0,0,10,"X11 authorization.  Important, but X not typically network-exposed today, so expect reduced risk today compared to past."
  -linux-headers-3.2.0-4-amd64,linux,3.2.63-2+deb7u2,Header files for Linux 3.2.0-4-amd64,,403,https://security-tracker.debian.org/tracker/source-package/linux,https://www.openhub.net/projects/libc-headers,linux-libc-kernel-headers,This project has not yet submitted a short description. You can submit it now.,http://savannah.nongnu.org/projects/libc-headers/,,0,5,71260,C,gpl,Stable Y-O-Y development activity,Short source control history,Well-commented source code,No recent development activity,27190,,,0,0,0,10,
  -patch,,2.6.1-3,Apply a diff file to an original,,5,https://security-tracker.debian.org/tracker/source-package/patch,https://www.openhub.net/projects/diffutils,GNU Diff Utilities,"The GNU diffutils are comprised of diff, diff3, sdiff, and cmp, utilities for showing differences between files. The manual also documents patch, which uses diff output to update files.",http://savannah.gnu.org/projects/diffutils,http://ftp.gnu.org/gnu/diffutils/,3,17,9727,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,161731,C,,0,0,0,10,
  +Known ProblemsThe API is not documented, but the example file should be self-explanatory.",http://code.google.com/p/xauthxx,,0,3,528,C++,lgpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,167548,C,Shared Library,1,0,0,10,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","X11 authorization.  Important, but X not typically network-exposed today, so expect reduced risk today compared to past."
  +linux-headers-3.2.0-4-amd64,linux,3.2.63-2+deb7u2,Header files for Linux 3.2.0-4-amd64,,403,https://security-tracker.debian.org/tracker/source-package/linux,https://www.openhub.net/projects/libc-headers,linux-libc-kernel-headers,This project has not yet submitted a short description. You can submit it now.,http://savannah.nongnu.org/projects/libc-headers/,,0,5,71260,C,gpl,Stable Y-O-Y development activity,Short source control history,Well-commented source code,No recent development activity,27190,,,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 0, Language: 2, Exposure: 0 , Data only: 0",
  +patch,,2.6.1-3,Apply a diff file to an original,,5,https://security-tracker.debian.org/tracker/source-package/patch,https://www.openhub.net/projects/diffutils,GNU Diff Utilities,"The GNU diffutils are comprised of diff, diff3, sdiff, and cmp, utilities for showing differences between files. The manual also documents patch, which uses diff output to update files.",http://savannah.gnu.org/projects/diffutils,http://ftp.gnu.org/gnu/diffutils/,3,17,9727,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,161731,C,,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
   virtualbox-guest-dkms,virtualbox,4.1.18-dfsg-2+deb7u3,x86 virtualization solution - guest addition module source for dkms,http://www.virtualbox.org/,27,https://security-tracker.debian.org/tracker/source-package/virtualbox,https://www.openhub.net/projects/virtualbox,Oracle VM VirtualBox,"Oracle VM VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. VirtualBox is an extremely feature rich, high performance product for enterprise customers.
   
  -VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,8367,,,0,0,1,10,
  +VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,8367,,,0,0,1,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 0, Language: 2, Exposure: 1 , Data only: 0",
   virtualbox-guest-utils,virtualbox,4.1.18-dfsg-2+deb7u3,x86 virtualization solution - non-X11 guest utilities,http://www.virtualbox.org/,27,https://security-tracker.debian.org/tracker/source-package/virtualbox,https://www.openhub.net/projects/virtualbox,Oracle VM VirtualBox,"Oracle VM VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. VirtualBox is an extremely feature rich, high performance product for enterprise customers.
   
  -VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,8661,,,0,0,1,10,
  +VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,8661,,,0,0,1,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 0, Language: 2, Exposure: 1 , Data only: 0",
   virtualbox-guest-x11,virtualbox,4.1.18-dfsg-2+deb7u3,x86 virtualization solution - X11 guest utilities,http://www.virtualbox.org/,27,https://security-tracker.debian.org/tracker/source-package/virtualbox,https://www.openhub.net/projects/virtualbox,Oracle VM VirtualBox,"Oracle VM VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. VirtualBox is an extremely feature rich, high performance product for enterprise customers.
   
  -VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,8240,,,0,0,1,10,
  +VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,8240,,,0,0,1,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 0, Language: 2, Exposure: 1 , Data only: 0",
   virtualbox-ose-guest-x11,virtualbox,4.1.18-dfsg-2+deb7u3,transitional package for virtualbox-guest-x11,http://www.virtualbox.org/,27,https://security-tracker.debian.org/tracker/source-package/virtualbox,https://www.openhub.net/projects/virtualbox,Oracle VM VirtualBox,"Oracle VM VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. VirtualBox is an extremely feature rich, high performance product for enterprise customers.
   
  -VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,6823,,,0,0,1,10,
  -bouncycastle,,,,,4,https://security-tracker.debian.org/tracker/source-package/bouncycastle,https://www.openhub.net/projects/5523,Bouncy Castle,"Here at the Bouncy Castle, we believe in encryption. That's something that's near and dear to our hearts. We believe so strongly in encryption, that we've gone to the effort to provide some for everybody.",http://www.bouncycastle.org,,0,1,468546,Java,BSD-3-Clause,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,No recent development activity,0,,,1,0,0,10,
  -libapache2-mod-gnutls,mod-gnutls,0.5.10-1.1,Apache module for SSL and TLS encryption with GnuTLS,http://www.outoforder.cc/projects/apache/mod_gnutls/,1,https://security-tracker.debian.org/tracker/source-package/mod-gnutls,https://www.openhub.net/projects/mod_gnutls,mod_gnutls,"mod_gnutls uses the GnuTLS library to provide SSL 3.0, TLS 1.0 and TLS 1.1 and TLS 1.2 encryption for Apache HTTPD. It is similar to mod_ssl in purpose, but does not use OpenSSL.",http://www.outoforder.cc/projects/apache/mod_gnutls/,http://www.outoforder.cc/projects/apache/mod_gnutls/,0,5,4020,C,apache_2,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,666,,,1,0,0,10,"This is in widespread use for SSL/TLS on webservers; it uses GnuTLS instead of OpenSSL.  Old website http://www.outoforder.cc/projects/apache/mod_gnutls/ points to newer site ""https://mod.gnutls.org/?outoforder-ref"".  At newer site the mailing list has a few relevant postings/month, though the March 2015 postings raise concerns about dropped patches.  The bug tracker is badly spammed and one seems to be fixing/addressing it.  Last release 17-Feb-2014.  This looks like it badly needs help. +++"
  -postfix,,2.9.6-2,High-performance mail transport agent,http://www.postfix.org,3,https://security-tracker.debian.org/tracker/source-package/postfix,https://www.openhub.net/projects/postfix,Postfix,"Postfix is Wietse Venema's mailer that started life as an alternative to the widely-used Sendmail program. Postfix attempts to be fast, easy to administer, and secure, while at the same time being sendmail compatible enough to not upset existing users. Thus, the outside has a sendmail-ish flavor, but the inside is completely different.",http://www.postfix.org/,http://www.postfix.org/download.html,2,3,217169,C,ibm_public,Stable Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Small development team,28872,C,Program,1,0,0,10,"This is a widely-used mail transfer agent (MTA).
  +VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,6823,,,0,0,1,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 0, Language: 2, Exposure: 1 , Data only: 0",
  +bouncycastle,,,,,4,https://security-tracker.debian.org/tracker/source-package/bouncycastle,https://www.openhub.net/projects/5523,Bouncy Castle,"Here at the Bouncy Castle, we believe in encryption. That's something that's near and dear to our hearts. We believe so strongly in encryption, that we've gone to the effort to provide some for everybody.",http://www.bouncycastle.org,,0,1,468546,Java,BSD-3-Clause,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,No recent development activity,0,,,1,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 0, Language: 0, Exposure: 2 , Data only: 0",
  +libapache2-mod-gnutls,mod-gnutls,0.5.10-1.1,Apache module for SSL and TLS encryption with GnuTLS,http://www.outoforder.cc/projects/apache/mod_gnutls/,1,https://security-tracker.debian.org/tracker/source-package/mod-gnutls,https://www.openhub.net/projects/mod_gnutls,mod_gnutls,"mod_gnutls uses the GnuTLS library to provide SSL 3.0, TLS 1.0 and TLS 1.1 and TLS 1.2 encryption for Apache HTTPD. It is similar to mod_ssl in purpose, but does not use OpenSSL.",http://www.outoforder.cc/projects/apache/mod_gnutls/,http://www.outoforder.cc/projects/apache/mod_gnutls/,0,5,4020,C,apache_2,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,666,,,1,0,0,10,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 0, Language: 2, Exposure: 2 , Data only: 0","This is in widespread use for SSL/TLS on webservers; it uses GnuTLS instead of OpenSSL.  Old website http://www.outoforder.cc/projects/apache/mod_gnutls/ points to newer site ""https://mod.gnutls.org/?outoforder-ref"".  At newer site the mailing list has a few relevant postings/month, though the March 2015 postings raise concerns about dropped patches.  The bug tracker is badly spammed and one seems to be fixing/addressing it.  Last release 17-Feb-2014.  This looks like it badly needs help. +++"
  +postfix,,2.9.6-2,High-performance mail transport agent,http://www.postfix.org,3,https://security-tracker.debian.org/tracker/source-package/postfix,https://www.openhub.net/projects/postfix,Postfix,"Postfix is Wietse Venema's mailer that started life as an alternative to the widely-used Sendmail program. Postfix attempts to be fast, easy to administer, and secure, while at the same time being sendmail compatible enough to not upset existing users. Thus, the outside has a sendmail-ish flavor, but the inside is completely different.",http://www.postfix.org/,http://www.postfix.org/download.html,2,3,217169,C,ibm_public,Stable Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Small development team,28872,C,Program,1,0,0,10,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 0, Language: 2, Exposure: 2 , Data only: 0","This is a widely-used mail transfer agent (MTA).
   Postfix was created by Wietse Venema, main site www.postfix.org.  On February 8, 2015 Postfix released 3.0.0, so currently active.  Developer mailing list postfix-devel has activity. (e.g., http://news.gmane.org/gmane.mail.postfix.devel/cutoff=2948).  There is no public repo; Wietse (the lead developer) does not want to allow any external review before formal release, as noted in https://groups.google.com/forum/#!topic/mailing.postfix.users/6Kkel3J_nv4 (The Debian package may be an obsolete fork; the Debian package has been assembled by LaMont Jones from sources available from http://www.postfix.org, and can be cloned from git via: git clone git://git.debian.org/~lamont/postfix.git.  Changes on http://anonscm.debian.org/cgit/users/lamont/postfix.git/log/ in git stop in 2011.) ++"
  -acpi,,1.6-1,displays information on ACPI devices,http://sourceforge.net/projects/acpiclient,0,https://security-tracker.debian.org/tracker/source-package/acpi,https://www.openhub.net/projects/acpi,ACPI,"Linux ACPI client is a command-line tool, similar to the ""apm"" command, that provides information on battery status, AC power, and thermal readings.",http://grahame.angrygoats.net/acpi.shtml,,0,3,14813,C,,Stable Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,147993,,Program,0,0,1,9,Provides data on local hardware. Conceivably might allow local raise in privilege.
  -cron,,3.0pl1-124,process scheduling daemon,http://ftp.isc.org/isc/cron/,3,https://security-tracker.debian.org/tracker/source-package/cron,https://www.openhub.net/projects/pkg-cron,pkg-cron,This is the Debian GNU/Linux prepackaged and heavily modified version of Paul Vixie's cron subsystem.,https://alioth.debian.org/projects/pkg-cron/,,2,6,5367,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,169633,C,,0,0,0,9,
  -dmsetup,lvm2 (2.02.95-8),2:1.02.74-8,Linux Kernel Device Mapper userspace library,http://sources.redhat.com/lvm2/,1,https://security-tracker.debian.org/tracker/source-package/lvm2,https://www.openhub.net/projects/device-mapper,Device Mapper,"The userspace portion of device mapper, a generic framework to map one block device into another with sector granularity. Device mapper forms the foundation of LVM2 and EVMS, software RAIDs, dm-crypt disk encryption, and offers additional features such as file-system snapshots.",http://sources.redhat.com/dm,http://sources.redhat.com/dm,0,15,34138,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,161528,C,,0,0,0,9,
  -gzip,,1.5-1.1,GNU compression utilities,,1,https://security-tracker.debian.org/tracker/source-package/gzip,https://www.openhub.net/projects/gzip,gzip,gzip (GNU zip) is a compression utility designed to be a replacement for compress. Its main advantages over compress are much better compression and freedom from patented algorithms. It has been adopted by the GNU project and is now relatively popular on the Internet.,http://www.gnu.org/software/gzip/,,2,15,8631,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,169892,C,,0,1,0,9,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. http://www.gnu.org/software/gzip/ Maintained on Savannah (http://savannah.gnu.org/projects/gzip/) using git. Last formal release was years ago (June 2013).  Multiple contributors, but not many. Current git contributions, but only a few a month (2015-02-08, 2015-01-02, 2014-11-10, 2014-10-10), and most seem to be small/trivial (document and syntax tweaks). +++"
  -iproute,iproute (20120521-3),20120521-3+b3,networking and traffic control tools,http://www.linux-foundation.org/en/Net:Iproute2,1,https://security-tracker.debian.org/tracker/source-package/iproute,https://www.openhub.net/projects/iproute-mptcp,iproute-mptcp,IP-Route extensions for MultiPath TCP,https://github.com/multipath-tcp/iproute-mptcp,https://github.com/multipath-tcp/iproute-mptcp/downloads,0,192,52045,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,163524,C,Program,0,0,0,9,
  -iputils-ping,iputils (3:20101006-1),3:20101006-1+b1,Tools to test the reachability of network hosts,,1,https://security-tracker.debian.org/tracker/source-package/iputils,https://www.openhub.net/projects/iputils,iputils,http://www.skbuff.net/iputils/,https://github.com/boocz3ch/iputils,https://github.com/boocz3ch/iputils/downloads,0,13,18123,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,No recent development activity,169397,C,Program,0,0,0,9,
  -klibc-utils,klibc,2.0.1-3.1,small utilities built with klibc for early boot,http://git.kernel.org/?p=libs/klibc/klibc.git;a=summary,2,https://security-tracker.debian.org/tracker/source-package/klibc,https://www.openhub.net/projects/klibc,klibc,"klibc is intended to be a minimalistic libc subset for use with initramfs.  It is deliberately written for small size, minimal entanglement, and portability, not speed.  It is definitely a work in progress, and a lot of things are still missing.",http://en.wikipedia.org/wiki/Klibc,http://www.kernel.org/pub/linux/libs/klibc/,2,95,53134,C,BSD-3-Clause gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168471,C,Program,0,0,0,9,
  -libdevmapper1.02.1,lvm2 (2.02.95-8),2:1.02.74-8,Linux Kernel Device Mapper userspace library,http://sources.redhat.com/lvm2/,1,https://security-tracker.debian.org/tracker/source-package/lvm2,https://www.openhub.net/projects/lvm2,lvm2,,,,0,18,57726,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,167105,C,Shared Library,0,0,0,9,
  -libgeoip1,geoip,1.4.8+dfsg-3,non-DNS IP-to-country resolver library,http://www.maxmind.com/,0,https://security-tracker.debian.org/tracker/source-package/geoip,https://www.openhub.net/projects/geoip,MaxMind GeoIP,"MaxMind GeoIP is a set of APIs for looking up the location of an IP address, including the country, region, city, latitude, and longitude. Free GeoLite databases are available at http://www.maxmind.com/app/geolitecity",http://sourceforge.net/projects/geoip,,0,2,83883,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,156657,C,Shared Library,0,1,0,9,Should not be security-relevant.
  -libgmp10,gmp,2:5.0.5+dfsg-2,Multiprecision arithmetic library,http://gmplib.org/,0,https://security-tracker.debian.org/tracker/source-package/gmp,https://www.openhub.net/projects/gmp,GMP,"GMP is a free library for arbitrary precision arithmetic, operating on signed integers, rational numbers, and floating point numbers. There is no practical limit to the precision except the ones implied by the available memory in the machine GMP runs on. GMP has a rich set of functions, and the functions have a regular interface.",http://gmplib.org/,http://ftp.sunet.se/pub/gnu/gmp/,0,17,209398,C,lgpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,122633,C,Shared Library,0,1,0,9,Multi-precision can be security-relevant if used to process crypto data.
  +acpi,,1.6-1,displays information on ACPI devices,http://sourceforge.net/projects/acpiclient,0,https://security-tracker.debian.org/tracker/source-package/acpi,https://www.openhub.net/projects/acpi,ACPI,"Linux ACPI client is a command-line tool, similar to the ""apm"" command, that provides information on battery status, AC power, and thermal readings.",http://grahame.angrygoats.net/acpi.shtml,,0,3,14813,C,,Stable Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,147993,,Program,0,0,1,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Provides data on local hardware. Conceivably might allow local raise in privilege.
  +cron,,3.0pl1-124,process scheduling daemon,http://ftp.isc.org/isc/cron/,3,https://security-tracker.debian.org/tracker/source-package/cron,https://www.openhub.net/projects/pkg-cron,pkg-cron,This is the Debian GNU/Linux prepackaged and heavily modified version of Paul Vixie's cron subsystem.,https://alioth.debian.org/projects/pkg-cron/,,2,6,5367,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,169633,C,,0,0,0,9,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +dmsetup,lvm2 (2.02.95-8),2:1.02.74-8,Linux Kernel Device Mapper userspace library,http://sources.redhat.com/lvm2/,1,https://security-tracker.debian.org/tracker/source-package/lvm2,https://www.openhub.net/projects/device-mapper,Device Mapper,"The userspace portion of device mapper, a generic framework to map one block device into another with sector granularity. Device mapper forms the foundation of LVM2 and EVMS, software RAIDs, dm-crypt disk encryption, and offers additional features such as file-system snapshots.",http://sources.redhat.com/dm,http://sources.redhat.com/dm,0,15,34138,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,161528,C,,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +gzip,,1.5-1.1,GNU compression utilities,,1,https://security-tracker.debian.org/tracker/source-package/gzip,https://www.openhub.net/projects/gzip,gzip,gzip (GNU zip) is a compression utility designed to be a replacement for compress. Its main advantages over compress are much better compression and freedom from patented algorithms. It has been adopted by the GNU project and is now relatively popular on the Internet.,http://www.gnu.org/software/gzip/,,2,15,8631,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,169892,C,,0,1,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. http://www.gnu.org/software/gzip/ Maintained on Savannah (http://savannah.gnu.org/projects/gzip/) using git. Last formal release was years ago (June 2013).  Multiple contributors, but not many. Current git contributions, but only a few a month (2015-02-08, 2015-01-02, 2014-11-10, 2014-10-10), and most seem to be small/trivial (document and syntax tweaks). +++"
  +iproute,iproute (20120521-3),20120521-3+b3,networking and traffic control tools,http://www.linux-foundation.org/en/Net:Iproute2,1,https://security-tracker.debian.org/tracker/source-package/iproute,https://www.openhub.net/projects/iproute-mptcp,iproute-mptcp,IP-Route extensions for MultiPath TCP,https://github.com/multipath-tcp/iproute-mptcp,https://github.com/multipath-tcp/iproute-mptcp/downloads,0,192,52045,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,163524,C,Program,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +iputils-ping,iputils (3:20101006-1),3:20101006-1+b1,Tools to test the reachability of network hosts,,1,https://security-tracker.debian.org/tracker/source-package/iputils,https://www.openhub.net/projects/iputils,iputils,http://www.skbuff.net/iputils/,https://github.com/boocz3ch/iputils,https://github.com/boocz3ch/iputils/downloads,0,13,18123,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,No recent development activity,169397,C,Program,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +klibc-utils,klibc,2.0.1-3.1,small utilities built with klibc for early boot,http://git.kernel.org/?p=libs/klibc/klibc.git;a=summary,2,https://security-tracker.debian.org/tracker/source-package/klibc,https://www.openhub.net/projects/klibc,klibc,"klibc is intended to be a minimalistic libc subset for use with initramfs.  It is deliberately written for small size, minimal entanglement, and portability, not speed.  It is definitely a work in progress, and a lot of things are still missing.",http://en.wikipedia.org/wiki/Klibc,http://www.kernel.org/pub/linux/libs/klibc/,2,95,53134,C,BSD-3-Clause gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168471,C,Program,0,0,0,9,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +libdevmapper1.02.1,lvm2 (2.02.95-8),2:1.02.74-8,Linux Kernel Device Mapper userspace library,http://sources.redhat.com/lvm2/,1,https://security-tracker.debian.org/tracker/source-package/lvm2,https://www.openhub.net/projects/lvm2,lvm2,,,,0,18,57726,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,167105,C,Shared Library,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +libgeoip1,geoip,1.4.8+dfsg-3,non-DNS IP-to-country resolver library,http://www.maxmind.com/,0,https://security-tracker.debian.org/tracker/source-package/geoip,https://www.openhub.net/projects/geoip,MaxMind GeoIP,"MaxMind GeoIP is a set of APIs for looking up the location of an IP address, including the country, region, city, latitude, and longitude. Free GeoLite databases are available at http://www.maxmind.com/app/geolitecity",http://sourceforge.net/projects/geoip,,0,2,83883,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,156657,C,Shared Library,0,1,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Should not be security-relevant.
  +libgmp10,gmp,2:5.0.5+dfsg-2,Multiprecision arithmetic library,http://gmplib.org/,0,https://security-tracker.debian.org/tracker/source-package/gmp,https://www.openhub.net/projects/gmp,GMP,"GMP is a free library for arbitrary precision arithmetic, operating on signed integers, rational numbers, and floating point numbers. There is no practical limit to the precision except the ones implied by the available memory in the machine GMP runs on. GMP has a rich set of functions, and the functions have a regular interface.",http://gmplib.org/,http://ftp.sunet.se/pub/gnu/gmp/,0,17,209398,C,lgpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,122633,C,Shared Library,0,1,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Multi-precision can be security-relevant if used to process crypto data.
   libidn11,libidn,1.25-2,"GNU Libidn library, implementation of IETF IDN specifications",https://www.gnu.org/software/libidn/,1,https://security-tracker.debian.org/tracker/source-package/libidn,https://www.openhub.net/projects/libidn,LibIDN,"GNU Libidn is an implementation of the Stringprep, Punycode and IDNA specifications defined by the IETF Internationalized Domain Names (IDN) working group, used for internationalized domain names. The C library is available under the GNU Lesser General Public License.
   
  -The library contains a generic Stringprep implementation that does Unicode 3.2 NFKC normalization, mapping and prohibitation of characters, and bidirectional character handling. Profiles for iSCSI, Kerberos 5, Nameprep, SASL and XMPP are included. Punycode and ASCII Compatible Encoding (ACE) via IDNA are supported.",http://www.gnu.org/software/libidn/,,2,5,103506,C,gpl lgpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168599,C,Shared Library,0,1,0,9,"Libidn's purpose is to encode and decode internationalized domain names; this data may come straight from attackers (e.g., in web page links, etc.)."
  -libklibc,klibc,2.0.1-3.1,minimal libc subset for use with initramfs,http://git.kernel.org/?p=libs/klibc/klibc.git;a=summary,2,https://security-tracker.debian.org/tracker/source-package/klibc,https://www.openhub.net/projects/klibc,klibc,"klibc is intended to be a minimalistic libc subset for use with initramfs.  It is deliberately written for small size, minimal entanglement, and portability, not speed.  It is definitely a work in progress, and a lot of things are still missing.",http://en.wikipedia.org/wiki/Klibc,http://www.kernel.org/pub/linux/libs/klibc/,2,95,53134,C,BSD-3-Clause gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168489,,Shared Library,0,0,0,9,
  -libnfnetlink0,libnfnetlink,1.0.0-1.1,Netfilter netlink library,,0,https://security-tracker.debian.org/tracker/source-package/libnfnetlink,https://www.openhub.net/projects/libnfnetlink,libnfnetlink,libnfnetlink is the low-level library for netfilter related kernel/userspace communication.,http://www.netfilter.org/projects/libnfnetlink/index.html,http://www.netfilter.org/projects/libnfnetlink/downloads.html,2,14,2030,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Small development team,160950,,Shared Library,1,0,0,9,"Typically the user is already trusted, and the runtime for netlink is part of the kernel, so vulnerabilities would typically not be here."
  +The library contains a generic Stringprep implementation that does Unicode 3.2 NFKC normalization, mapping and prohibitation of characters, and bidirectional character handling. Profiles for iSCSI, Kerberos 5, Nameprep, SASL and XMPP are included. Punycode and ASCII Compatible Encoding (ACE) via IDNA are supported.",http://www.gnu.org/software/libidn/,,2,5,103506,C,gpl lgpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168599,C,Shared Library,0,1,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Libidn's purpose is to encode and decode internationalized domain names; this data may come straight from attackers (e.g., in web page links, etc.)."
  +libklibc,klibc,2.0.1-3.1,minimal libc subset for use with initramfs,http://git.kernel.org/?p=libs/klibc/klibc.git;a=summary,2,https://security-tracker.debian.org/tracker/source-package/klibc,https://www.openhub.net/projects/klibc,klibc,"klibc is intended to be a minimalistic libc subset for use with initramfs.  It is deliberately written for small size, minimal entanglement, and portability, not speed.  It is definitely a work in progress, and a lot of things are still missing.",http://en.wikipedia.org/wiki/Klibc,http://www.kernel.org/pub/linux/libs/klibc/,2,95,53134,C,BSD-3-Clause gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168489,,Shared Library,0,0,0,9,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +libnfnetlink0,libnfnetlink,1.0.0-1.1,Netfilter netlink library,,0,https://security-tracker.debian.org/tracker/source-package/libnfnetlink,https://www.openhub.net/projects/libnfnetlink,libnfnetlink,libnfnetlink is the low-level library for netfilter related kernel/userspace communication.,http://www.netfilter.org/projects/libnfnetlink/index.html,http://www.netfilter.org/projects/libnfnetlink/downloads.html,2,14,2030,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Small development team,160950,,Shared Library,1,0,0,9,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Typically the user is already trusted, and the runtime for netlink is part of the kernel, so vulnerabilities would typically not be here."
   libsasl2-2,cyrus-sasl2,2.1.25.dfsg1-6+deb7u1,Cyrus SASL - authentication abstraction library,http://www.cyrusimap.org/,1,https://security-tracker.debian.org/tracker/source-package/cyrus-sasl2,https://www.openhub.net/projects/12134,Cyrus SASL,"SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. If its use is negotiated, a security layer is inserted between the protocol and the connection.
   
  -Cyrus SASL is the reference implementation of SASL.",http://asg.web.cmu.edu/sasl/,http://ftp.andrew.cmu.edu/pub/cyrus-mail/,1,20,72049,C,Carnegie_Mellon_Licence,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,168686,C,Shared Library,0,1,0,9,"Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++"
  +Cyrus SASL is the reference implementation of SASL.",http://asg.web.cmu.edu/sasl/,http://ftp.andrew.cmu.edu/pub/cyrus-mail/,1,20,72049,C,Carnegie_Mellon_Licence,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,168686,C,Shared Library,0,1,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++"
   libsasl2-modules,cyrus-sasl2,2.1.25.dfsg1-6+deb7u1,Cyrus SASL - pluggable authentication modules,http://www.cyrusimap.org/,1,https://security-tracker.debian.org/tracker/source-package/cyrus-sasl2,https://www.openhub.net/projects/12134,Cyrus SASL,"SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. If its use is negotiated, a security layer is inserted between the protocol and the connection.
   
  -Cyrus SASL is the reference implementation of SASL.",http://asg.web.cmu.edu/sasl/,http://ftp.andrew.cmu.edu/pub/cyrus-mail/,1,20,72049,C,Carnegie_Mellon_Licence,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,157085,C,Plugin,0,1,0,9,"Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++"
  -libudev0,udev,175-7.2,libudev shared library,,1,https://security-tracker.debian.org/tracker/source-package/udev,https://www.openhub.net/projects/udev,udev,Managing device nodes in /dev on Linux.,http://www.freedesktop.org/software/systemd/man/udev.html,http://www.kernel.org/pub/linux/utils/kernel/hotplug/,0,224,23505,C,gpl lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,144230,C,Shared Library,0,0,0,9,
  -libxcb1,libxcb,1.8.1-2+deb7u1,X C Binding,http://xcb.freedesktop.org,1,https://security-tracker.debian.org/tracker/source-package/libxcb,https://www.openhub.net/projects/libxcb,libxcb,,https://github.com/StarchLinux/libxcb,https://github.com/StarchLinux/libxcb/downloads,0,1,87401,C,,,Short source control history,Very well-commented source code,No recent development activity,166104,C,Shared Library,0,0,0,9,
  -nano,nano (2.2.6-1),2.2.6-1+b1,"small, friendly text editor inspired by Pico",http://www.nano-editor.org/,2,https://security-tracker.debian.org/tracker/source-package/nano,https://www.openhub.net/projects/nano,GNU nano,"GNU nano is designed to be a free replacement for the Pico text editor, part of the Pine email suite from The University of Washington. It aims to ""emulate Pico as closely as possible and perhaps include extra functionality"".",http://www.nano-editor.org/,,3,10,20032,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,164806,C,Program,0,0,0,9,
  -tar,,1.26+dfsg-0.1,GNU version of the tar archiving utility,,1,https://security-tracker.debian.org/tracker/source-package/tar,https://www.openhub.net/projects/tar,GNU tar,"The Tar program provides the ability to create tar archives, as well as various other kinds of manipulation.",http://savannah.gnu.org/projects/tar/,,3,21,23495,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Small development team,169899,,,0,1,0,9,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. Has Home page, mailing list, Public Repo git://git.savannah.gnu.org/tar.git, uses ""technical support"" for issue tracking (could be confusing).  Does have changes in git repo, but only a few a month and typically small. ++"
  -udev,,175-7.2,/dev/ and hotplug management daemon,,1,https://security-tracker.debian.org/tracker/source-package/udev,https://www.openhub.net/projects/udev,udev,Managing device nodes in /dev on Linux.,http://www.freedesktop.org/software/systemd/man/udev.html,http://www.kernel.org/pub/linux/utils/kernel/hotplug/,0,224,23505,C,gpl lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,169330,C,Program,0,0,0,9,
  -zlib1g,zlib,1:1.2.7.dfsg-13,compression library - runtime,http://zlib.net/,0,https://security-tracker.debian.org/tracker/source-package/zlib,https://www.openhub.net/projects/zlib,zlib,"zlib is designed to be a free, general-purpose, legally unencumbered -- that is, not covered by any patents -- lossless data-compression library for use on virtually any computer hardware and operating system. The zlib data format is itself portable across platforms. Unlike the LZW compression method used in Unix compress(1) and in the GIF image format, the compression method currently used in zlib essentially never expands the data. (LZW can double or triple the file size in extreme cases.) zlib's memory footprint is also independent of the input data and can be reduced, if necessary, at some cost in compression.",http://www.zlib.net/,http://www.zlib.net/,0,20,36295,C,zlib_libpng,Stable Y-O-Y development activity,"Young, but established codebase",Well-commented source code,No recent development activity,169896,C,Shared Library,0,1,0,9,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. HAS Home Page, has mailing list zlib@gzip.org, NO issue tracker, Latest release April 2013 (old). +++"
  -zip,,3.0-6,Archiver for .zip files,http://www.info-zip.org/Zip.html,0,https://security-tracker.debian.org/tracker/source-package/zip,https://www.openhub.net/projects/infozip,Zip & Unzip,,http://www.info-zip.org/,,0,2,878,C,BSD-3-Clause,Stable Y-O-Y development activity,"Young, but established codebase",Average number of code comments,No recent development activity,61799,C,,0,1,0,9,
  -bind9-host,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Version of 'host' bundled with BIND 9.X,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161011,,,1,0,0,8,"Bind9 is critical for security. It does have active development. Support is via mailing lists. Very active development, issue tracker intentionally not public...claimed to be ""huge backlog"" of issues. Public git repo. Active history of CVEs raised and fixed. ++"
  -bzip2,,1.0.6-4,high-quality block-sorting file compressor - utilities,http://www.bzip.org/,2,https://security-tracker.debian.org/tracker/source-package/bzip2,https://www.openhub.net/projects/bzip2,bzip2,"bzip2 is a freely available, patent free, high-quality data compressor. It typically compresses files to within 10% to 15% of the best available techniques (the PPM family of statistical compressors), whilst being around twice as fast at compression and six times faster at decompression.",http://bzip.org/,http://www.bzip.org/downloads.html,,,,,BSD-3-Clause,,,,,154602,C,,0,1,0,8,"Bzip2 is widely used for decompression of network-supplied data. No code repo, only released code source tarballs. This is the reference implementation, many alternate implementations shown on https://en.wikipedia.org/wiki/Bzip2. Last release in 2010, v1.0.6, in response to CVE-2010-0405. No forums found. At least one HTTP server supports bzip2 for compression.  +++"
  -db5.1-util,db,5.1.29-5,Berkeley v5.1 Database Utilities,http://www.oracle.com/technology/software/products/berkeley-db/index.html,0,https://security-tracker.debian.org/tracker/source-package/db,https://www.openhub.net/projects/berkeleydb,Berkeley DB,"Berkeley DB (BDB) is a high-performance, embedded database library with bindings in C, C++, Java, Perl, Python, Tcl, Smalltalk and many other programming languages. BDB stores arbitrary key/data pairs as byte arrays, and supports multiple data items for a single key. BDB can support thousands of simultaneous threads of control or concurrent processes manipulating databases as large as 256 terabytes, on a wide variety of systems including most UNIX-like and Windows systems as well as real-time operating systems.",http://www.oracle.com/technology/products/berkeley-db/db/index.html,,0,3,1746106,C,sleepycat,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,No recent development activity,93090,,Program,0,0,0,8,
  -debianutils,,4.3.2,Miscellaneous utilities specific to Debian,,0,https://security-tracker.debian.org/tracker/source-package/debianutils,https://www.openhub.net/projects/debian-installer-utils,debian-installer-utils,,,,3,89,1170,shell script,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Small development team,169899,C,Program,0,0,0,8,"Collection of small tools.The tempfile(1) command is security-relevant (temp file mistakes are a common security vulnerability) but is relatively small, and usually the problem is a failure to use tempfile(1) or similar."
  -dnsutils,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Clients provided with BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",156816,,,1,0,0,8,Bind9 is critical for security. It does have active development. ++
  -dpkg,,1.16.15,Debian package management system,http://wiki.debian.org/Teams/Dpkg,10,https://security-tracker.debian.org/tracker/source-package/dpkg,https://www.openhub.net/projects/dpkg,dpkg,Debian's PacKaGe manager,http://wiki.debian.org/Teams/Dpkg/,http://packages.debian.org/src:dpkg,43,205,64794,C,bsd_2clause_ish GNU_General_Public_License_v2_0_only gpl Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169894,,,1,0,0,8,"Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  -eject,,2.1.5+deb1+cvs20081104-13,ejects CDs and operates CD-Changers under Linux,http://www.pobox.com/~tranter/eject.html,0,https://security-tracker.debian.org/tracker/source-package/eject,https://www.openhub.net/projects/eject,eject utility for removable media,"Eject allows  removable media (typically a CD-ROM, floppy disk, tape, or JAZ or ZIP disk) to be ejected under  software control. The command can also control some multi-disc CD-ROM changers, the auto-eject feature supported by  some devices, and more.",http://sourceforge.net/projects/eject,,0,1,1247,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,155486,,Program,0,0,0,8,
  -exim4,,4.80-7+deb7u1,metapackage to ease Exim MTA (v4) installation,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",121505,C,Dummy Package,1,0,0,8,"This is an MTA, thus has to process untrustworthy data.  Mailing lists, bugzilla tracker, public git repo. Active history of CVE issues and fixes. Active with 16 contributors in last year. ++"
  -exim4-base,exim4,4.80-7+deb7u1,support files for all Exim MTA (v4) packages,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",125159,C,,1,0,0,8,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  -exim4-config,exim4,4.80-7+deb7u1,configuration for the Exim MTA (v4),http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",125426,"sh, bash, ksh, tcsh and other shells",Program,1,0,0,8,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  -exim4-daemon-light,exim4,4.80-7+deb7u1,lightweight Exim MTA (v4) daemon,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",122835,C,,1,0,0,8,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  -fakeroot,,1.18.4-2,tool for simulating superuser privileges,,0,https://security-tracker.debian.org/tracker/source-package/fakeroot,https://www.openhub.net/projects/6854,fakeroot,Gives a fake root environment through the use of LD_PRELOAD and SYSV IPC or TCP IPC trickery.,http://packages.debian.org/fakeroot,http://packages.debian.org/fakeroot,0,3,4906,C,,,,,,90563,C,,0,0,0,8,
  -ftp,netkit-ftp,0.17-27,classical file transfer client,,0,https://security-tracker.debian.org/tracker/source-package/netkit-ftp,,,,,,,,,,,,,,,149032,C,Program,1,0,0,8,"Ftp isn't secure by itself, and the ftp client is less commonly used now.  That said, it certainly is used and connects to the wide Internet."
  -ifupdown,,0.7.8,high level tools to configure network interfaces,,0,https://security-tracker.debian.org/tracker/source-package/ifupdown,https://www.openhub.net/projects/ifupdown-ng,ifupdown-ng,Next-generation network interface configuration tool,https://github.com/kmoffett/ifupdown-ng,https://github.com/kmoffett/ifupdown-ng/downloads,0,1,830,Python,,Stable Y-O-Y development activity,Short source control history,Well-commented source code,No recent development activity,169457,C,Program,0,0,0,8,
  -initscripts,sysvinit,2.88dsf-41+deb7u1,scripts for initializing and shutting down the system,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/sysvinit,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,169876,"sh, bash, ksh, tcsh and other shells",Program,0,0,0,8,
  -insserv,,1.14.0-5,boot sequence organizer using LSB init.d script dependency information,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/insserv,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,161625,,Program,0,0,0,8,
  -isc-dhcp-client,isc-dhcp,4.2.2.dfsg.1-5+deb70u6,ISC DHCP client,,22,https://security-tracker.debian.org/tracker/source-package/isc-dhcp,https://www.openhub.net/projects/4273,DHCP (ISC),"The Internet Systems Consortium (ISC) offers a Dynamic Host Configuration Protocol (DHCP) distribution including a DHCP server, client and relay agent. This distribution supports POSIX-compliant operating systems and also non-POSIX systems like Windows NT and MacOS.",http://www.isc.org/downloads/dhcp/,http://ftp.isc.org/isc/dhcp/,6,22,124066,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,157880,C,,1,0,0,8,"In wide use, accepts data from external sources.  Includes dhclient. Very similar to BIND. Perhaps slightly less active, lower developer count, but steady commits and releases. Somewhat critical due to being core network functionality. ++"
  +Cyrus SASL is the reference implementation of SASL.",http://asg.web.cmu.edu/sasl/,http://ftp.andrew.cmu.edu/pub/cyrus-mail/,1,20,72049,C,Carnegie_Mellon_Licence,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,157085,C,Plugin,0,1,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++"
  +libudev0,udev,175-7.2,libudev shared library,,1,https://security-tracker.debian.org/tracker/source-package/udev,https://www.openhub.net/projects/udev,udev,Managing device nodes in /dev on Linux.,http://www.freedesktop.org/software/systemd/man/udev.html,http://www.kernel.org/pub/linux/utils/kernel/hotplug/,0,224,23505,C,gpl lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,144230,C,Shared Library,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +libxcb1,libxcb,1.8.1-2+deb7u1,X C Binding,http://xcb.freedesktop.org,1,https://security-tracker.debian.org/tracker/source-package/libxcb,https://www.openhub.net/projects/libxcb,libxcb,,https://github.com/StarchLinux/libxcb,https://github.com/StarchLinux/libxcb/downloads,0,1,87401,C,,,Short source control history,Very well-commented source code,No recent development activity,166104,C,Shared Library,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +nano,nano (2.2.6-1),2.2.6-1+b1,"small, friendly text editor inspired by Pico",http://www.nano-editor.org/,2,https://security-tracker.debian.org/tracker/source-package/nano,https://www.openhub.net/projects/nano,GNU nano,"GNU nano is designed to be a free replacement for the Pico text editor, part of the Pine email suite from The University of Washington. It aims to ""emulate Pico as closely as possible and perhaps include extra functionality"".",http://www.nano-editor.org/,,3,10,20032,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,164806,C,Program,0,0,0,9,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +tar,,1.26+dfsg-0.1,GNU version of the tar archiving utility,,1,https://security-tracker.debian.org/tracker/source-package/tar,https://www.openhub.net/projects/tar,GNU tar,"The Tar program provides the ability to create tar archives, as well as various other kinds of manipulation.",http://savannah.gnu.org/projects/tar/,,3,21,23495,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Small development team,169899,,,0,1,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. Has Home page, mailing list, Public Repo git://git.savannah.gnu.org/tar.git, uses ""technical support"" for issue tracking (could be confusing).  Does have changes in git repo, but only a few a month and typically small. ++"
  +udev,,175-7.2,/dev/ and hotplug management daemon,,1,https://security-tracker.debian.org/tracker/source-package/udev,https://www.openhub.net/projects/udev,udev,Managing device nodes in /dev on Linux.,http://www.freedesktop.org/software/systemd/man/udev.html,http://www.kernel.org/pub/linux/utils/kernel/hotplug/,0,224,23505,C,gpl lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,169330,C,Program,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +zlib1g,zlib,1:1.2.7.dfsg-13,compression library - runtime,http://zlib.net/,0,https://security-tracker.debian.org/tracker/source-package/zlib,https://www.openhub.net/projects/zlib,zlib,"zlib is designed to be a free, general-purpose, legally unencumbered -- that is, not covered by any patents -- lossless data-compression library for use on virtually any computer hardware and operating system. The zlib data format is itself portable across platforms. Unlike the LZW compression method used in Unix compress(1) and in the GIF image format, the compression method currently used in zlib essentially never expands the data. (LZW can double or triple the file size in extreme cases.) zlib's memory footprint is also independent of the input data and can be reduced, if necessary, at some cost in compression.",http://www.zlib.net/,http://www.zlib.net/,0,20,36295,C,zlib_libpng,Stable Y-O-Y development activity,"Young, but established codebase",Well-commented source code,No recent development activity,169896,C,Shared Library,0,1,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. HAS Home Page, has mailing list zlib@gzip.org, NO issue tracker, Latest release April 2013 (old). +++"
  +zip,,3.0-6,Archiver for .zip files,http://www.info-zip.org/Zip.html,0,https://security-tracker.debian.org/tracker/source-package/zip,https://www.openhub.net/projects/infozip,Zip & Unzip,,http://www.info-zip.org/,,0,2,878,C,BSD-3-Clause,Stable Y-O-Y development activity,"Young, but established codebase",Average number of code comments,No recent development activity,61799,C,,0,1,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",
  +bind9-host,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Version of 'host' bundled with BIND 9.X,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161011,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Bind9 is critical for security. It does have active development. Support is via mailing lists. Very active development, issue tracker intentionally not public...claimed to be ""huge backlog"" of issues. Public git repo. Active history of CVEs raised and fixed. ++"
  +bzip2,,1.0.6-4,high-quality block-sorting file compressor - utilities,http://www.bzip.org/,2,https://security-tracker.debian.org/tracker/source-package/bzip2,https://www.openhub.net/projects/bzip2,bzip2,"bzip2 is a freely available, patent free, high-quality data compressor. It typically compresses files to within 10% to 15% of the best available techniques (the PPM family of statistical compressors), whilst being around twice as fast at compression and six times faster at decompression.",http://bzip.org/,http://www.bzip.org/downloads.html,,,,,BSD-3-Clause,,,,,154602,C,,0,1,0,8,"Website points: 0, CVE: 2, 12-month contributor: 2, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Bzip2 is widely used for decompression of network-supplied data. No code repo, only released code source tarballs. This is the reference implementation, many alternate implementations shown on https://en.wikipedia.org/wiki/Bzip2. Last release in 2010, v1.0.6, in response to CVE-2010-0405. No forums found. At least one HTTP server supports bzip2 for compression.  +++"
  +db5.1-util,db,5.1.29-5,Berkeley v5.1 Database Utilities,http://www.oracle.com/technology/software/products/berkeley-db/index.html,0,https://security-tracker.debian.org/tracker/source-package/db,https://www.openhub.net/projects/berkeleydb,Berkeley DB,"Berkeley DB (BDB) is a high-performance, embedded database library with bindings in C, C++, Java, Perl, Python, Tcl, Smalltalk and many other programming languages. BDB stores arbitrary key/data pairs as byte arrays, and supports multiple data items for a single key. BDB can support thousands of simultaneous threads of control or concurrent processes manipulating databases as large as 256 terabytes, on a wide variety of systems including most UNIX-like and Windows systems as well as real-time operating systems.",http://www.oracle.com/technology/products/berkeley-db/db/index.html,,0,3,1746106,C,sleepycat,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,No recent development activity,93090,,Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +debianutils,,4.3.2,Miscellaneous utilities specific to Debian,,0,https://security-tracker.debian.org/tracker/source-package/debianutils,https://www.openhub.net/projects/debian-installer-utils,debian-installer-utils,,,,3,89,1170,shell script,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Small development team,169899,C,Program,0,0,0,8,"Website points: 1, CVE: 0, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0","Collection of small tools.The tempfile(1) command is security-relevant (temp file mistakes are a common security vulnerability) but is relatively small, and usually the problem is a failure to use tempfile(1) or similar."
  +dnsutils,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Clients provided with BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",156816,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Bind9 is critical for security. It does have active development. ++
  +dpkg,,1.16.15,Debian package management system,http://wiki.debian.org/Teams/Dpkg,10,https://security-tracker.debian.org/tracker/source-package/dpkg,https://www.openhub.net/projects/dpkg,dpkg,Debian's PacKaGe manager,http://wiki.debian.org/Teams/Dpkg/,http://packages.debian.org/src:dpkg,43,205,64794,C,bsd_2clause_ish GNU_General_Public_License_v2_0_only gpl Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169894,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  +eject,,2.1.5+deb1+cvs20081104-13,ejects CDs and operates CD-Changers under Linux,http://www.pobox.com/~tranter/eject.html,0,https://security-tracker.debian.org/tracker/source-package/eject,https://www.openhub.net/projects/eject,eject utility for removable media,"Eject allows  removable media (typically a CD-ROM, floppy disk, tape, or JAZ or ZIP disk) to be ejected under  software control. The command can also control some multi-disc CD-ROM changers, the auto-eject feature supported by  some devices, and more.",http://sourceforge.net/projects/eject,,0,1,1247,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,155486,,Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +exim4,,4.80-7+deb7u1,metapackage to ease Exim MTA (v4) installation,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",121505,C,Dummy Package,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","This is an MTA, thus has to process untrustworthy data.  Mailing lists, bugzilla tracker, public git repo. Active history of CVE issues and fixes. Active with 16 contributors in last year. ++"
  +exim4-base,exim4,4.80-7+deb7u1,support files for all Exim MTA (v4) packages,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",125159,C,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  +exim4-config,exim4,4.80-7+deb7u1,configuration for the Exim MTA (v4),http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",125426,"sh, bash, ksh, tcsh and other shells",Program,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  +exim4-daemon-light,exim4,4.80-7+deb7u1,lightweight Exim MTA (v4) daemon,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",122835,C,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  +fakeroot,,1.18.4-2,tool for simulating superuser privileges,,0,https://security-tracker.debian.org/tracker/source-package/fakeroot,https://www.openhub.net/projects/6854,fakeroot,Gives a fake root environment through the use of LD_PRELOAD and SYSV IPC or TCP IPC trickery.,http://packages.debian.org/fakeroot,http://packages.debian.org/fakeroot,0,3,4906,C,,,,,,90563,C,,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +ftp,netkit-ftp,0.17-27,classical file transfer client,,0,https://security-tracker.debian.org/tracker/source-package/netkit-ftp,,,,,,,,,,,,,,,149032,C,Program,1,0,0,8,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Ftp isn't secure by itself, and the ftp client is less commonly used now.  That said, it certainly is used and connects to the wide Internet."
  +ifupdown,,0.7.8,high level tools to configure network interfaces,,0,https://security-tracker.debian.org/tracker/source-package/ifupdown,https://www.openhub.net/projects/ifupdown-ng,ifupdown-ng,Next-generation network interface configuration tool,https://github.com/kmoffett/ifupdown-ng,https://github.com/kmoffett/ifupdown-ng/downloads,0,1,830,Python,,Stable Y-O-Y development activity,Short source control history,Well-commented source code,No recent development activity,169457,C,Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +initscripts,sysvinit,2.88dsf-41+deb7u1,scripts for initializing and shutting down the system,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/sysvinit,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,169876,"sh, bash, ksh, tcsh and other shells",Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +insserv,,1.14.0-5,boot sequence organizer using LSB init.d script dependency information,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/insserv,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,161625,,Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +isc-dhcp-client,isc-dhcp,4.2.2.dfsg.1-5+deb70u6,ISC DHCP client,,22,https://security-tracker.debian.org/tracker/source-package/isc-dhcp,https://www.openhub.net/projects/4273,DHCP (ISC),"The Internet Systems Consortium (ISC) offers a Dynamic Host Configuration Protocol (DHCP) distribution including a DHCP server, client and relay agent. This distribution supports POSIX-compliant operating systems and also non-POSIX systems like Windows NT and MacOS.",http://www.isc.org/downloads/dhcp/,http://ftp.isc.org/isc/dhcp/,6,22,124066,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,157880,C,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","In wide use, accepts data from external sources.  Includes dhclient. Very similar to BIND. Perhaps slightly less active, lower developer count, but steady commits and releases. Somewhat critical due to being core network functionality. ++"
   libattr1,attr,1:2.4.46-8,Extended attribute shared library,http://savannah.nongnu.org/projects/attr/,0,https://security-tracker.debian.org/tracker/source-package/attr,https://www.openhub.net/projects/attr,Linux Extended Attributes,"A set of tools for manipulating extended attributes on filesystem objects, in particular getfattr(1) and setfattr(1).
  -An attr(1) command is also provided which is largely compatible with the SGI IRIX tool of the same name.",http://savannah.nongnu.org/projects/attr,http://savannah.nongnu.org/files/?group=attr,2,27,2691,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,169897,C,Shared Library,0,0,1,8,Actual acl checking implemented by the kernel.
  -libbind9-80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,BIND9 Shared Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",105540,,,1,0,0,8,Bind9 is critical for security. It does have active development. ++
  -libbz2-1.0,bzip2,1.0.6-4,high-quality block-sorting file compressor library - runtime,http://www.bzip.org/,2,https://security-tracker.debian.org/tracker/source-package/bzip2,https://www.openhub.net/projects/bzip2,bzip2,"bzip2 is a freely available, patent free, high-quality data compressor. It typically compresses files to within 10% to 15% of the best available techniques (the PPM family of statistical compressors), whilst being around twice as fast at compression and six times faster at decompression.",http://bzip.org/,http://www.bzip.org/downloads.html,,,,,BSD-3-Clause,,,,,169891,C,Shared Library,0,1,0,8,Bzip2 is widely used for decompression of network-supplied data. ++
  -libdb5.1,db,5.1.29-5,Berkeley v5.1 Database Libraries [runtime],http://www.oracle.com/technology/software/products/berkeley-db/index.html,0,https://security-tracker.debian.org/tracker/source-package/db,https://www.openhub.net/projects/berkeleydb,Berkeley DB,"Berkeley DB (BDB) is a high-performance, embedded database library with bindings in C, C++, Java, Perl, Python, Tcl, Smalltalk and many other programming languages. BDB stores arbitrary key/data pairs as byte arrays, and supports multiple data items for a single key. BDB can support thousands of simultaneous threads of control or concurrent processes manipulating databases as large as 256 terabytes, on a wide variety of systems including most UNIX-like and Windows systems as well as real-time operating systems.",http://www.oracle.com/technology/products/berkeley-db/db/index.html,,0,3,1746106,C,sleepycat,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,No recent development activity,117520,,Shared Library,0,0,0,8,
  -libdns88,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,DNS Shared Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",104754,,,1,0,0,8,Bind9 is critical for security. It does have active development. ++
  -libedit2,libedit,2.11-20080614-5,BSD editline and history libraries,http://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/lib/libedit/,0,https://security-tracker.debian.org/tracker/source-package/libedit,https://www.openhub.net/projects/libedit-merge,libedit-merge,,http://github.com/alloy/libedit-merge,,0,1,32187,C,,Stable Y-O-Y development activity,Short source control history,Average number of code comments,No recent development activity,169609,C,Shared Library,0,0,0,8,
  -libgnutls26,gnutls26,2.12.20-8+deb7u2,GNU TLS library - runtime library,http://www.gnutls.org/,21,https://security-tracker.debian.org/tracker/source-package/gnutls26,https://www.openhub.net/projects/gnutls,GnuTLS,"GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. It is aimed to be portable and efficient with focus on security and interoperability.",http://www.gnutls.org,,21,79,185927,C,gpl3_or_later lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",157014,,,1,0,0,8,"TLS implementation.  Less used than OpenSSL, but is in use (it avoids OpenSSL licensing issues). Good ""security activity"" metrics, except suspiciously empty GitLab issue tracker, especially when Debian Security page shows many existing vulnerabilities. They may sweep the public issue tracker so as not to expose what they're trying to fix before it's ready. Notably still supporting SSL 3.0, which has known exploits. There is evidence they do stay on top of things, though. They have responded to questions regarding FREAK in their mailing lists, explaining gnutls is not vulnerable due to how it operates. ++"
  -libgssapi-krb5-2,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - krb5 GSS-API Mechanism,http://web.mit.edu/kerberos/,45,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,21,96,388789,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161577,,,1,0,0,8,"Vital when using Kerberos; unclear how common that is today. (For Windows, may use SAMBA)"
  -libice6,libice,2:1.0.8-2,X11 Inter-Client Exchange library,,0,https://security-tracker.debian.org/tracker/source-package/libice,https://www.openhub.net/projects/libice,libice,ICE - Is a generic module for Interactive Connectivity Establishment to make better flow of data between the endpoints in the internet. This is mostly used to intiate the media session between the endpoints. It is written in Purely ANSI C so that it can be compiled to embedded platforms.,http://code.google.com/p/libice,,0,1,0,,gpl,Stable Y-O-Y development activity,Short source control history,,No recent development activity,137357,C,Shared Library,0,0,0,8,
  -libkeyutils1,keyutils,1.5.5-3+deb7u1,Linux Key Management Utilities (library),http://people.redhat.com/~dhowells/keyutils/,0,https://security-tracker.debian.org/tracker/source-package/keyutils,https://www.openhub.net/projects/keyutils,keyutils,Linux Key Management Utilities,https://github.com/pld-linux/keyutils,,1,4,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Only a single active developer,167697,C,Shared Library,0,1,0,8,"Manages authorization and encryption keys required to perform secure operations. Public Repo, NO bug tracker, NO mailing list. ++"
  -libkrb5-3,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries,http://web.mit.edu/kerberos/,45,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,21,96,388789,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161582,,,1,0,0,8,"Vital when using Kerberos; unclear how common that is today. (For Windows, may use SAMBA)"
  +An attr(1) command is also provided which is largely compatible with the SGI IRIX tool of the same name.",http://savannah.nongnu.org/projects/attr,http://savannah.nongnu.org/files/?group=attr,2,27,2691,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,169897,C,Shared Library,0,0,1,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Actual acl checking implemented by the kernel.
  +libbind9-80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,BIND9 Shared Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",105540,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Bind9 is critical for security. It does have active development. ++
  +libbz2-1.0,bzip2,1.0.6-4,high-quality block-sorting file compressor library - runtime,http://www.bzip.org/,2,https://security-tracker.debian.org/tracker/source-package/bzip2,https://www.openhub.net/projects/bzip2,bzip2,"bzip2 is a freely available, patent free, high-quality data compressor. It typically compresses files to within 10% to 15% of the best available techniques (the PPM family of statistical compressors), whilst being around twice as fast at compression and six times faster at decompression.",http://bzip.org/,http://www.bzip.org/downloads.html,,,,,BSD-3-Clause,,,,,169891,C,Shared Library,0,1,0,8,"Website points: 0, CVE: 2, 12-month contributor: 2, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Bzip2 is widely used for decompression of network-supplied data. ++
  +libdb5.1,db,5.1.29-5,Berkeley v5.1 Database Libraries [runtime],http://www.oracle.com/technology/software/products/berkeley-db/index.html,0,https://security-tracker.debian.org/tracker/source-package/db,https://www.openhub.net/projects/berkeleydb,Berkeley DB,"Berkeley DB (BDB) is a high-performance, embedded database library with bindings in C, C++, Java, Perl, Python, Tcl, Smalltalk and many other programming languages. BDB stores arbitrary key/data pairs as byte arrays, and supports multiple data items for a single key. BDB can support thousands of simultaneous threads of control or concurrent processes manipulating databases as large as 256 terabytes, on a wide variety of systems including most UNIX-like and Windows systems as well as real-time operating systems.",http://www.oracle.com/technology/products/berkeley-db/db/index.html,,0,3,1746106,C,sleepycat,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,No recent development activity,117520,,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +libdns88,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,DNS Shared Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",104754,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Bind9 is critical for security. It does have active development. ++
  +libedit2,libedit,2.11-20080614-5,BSD editline and history libraries,http://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/lib/libedit/,0,https://security-tracker.debian.org/tracker/source-package/libedit,https://www.openhub.net/projects/libedit-merge,libedit-merge,,http://github.com/alloy/libedit-merge,,0,1,32187,C,,Stable Y-O-Y development activity,Short source control history,Average number of code comments,No recent development activity,169609,C,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +libgnutls26,gnutls26,2.12.20-8+deb7u2,GNU TLS library - runtime library,http://www.gnutls.org/,21,https://security-tracker.debian.org/tracker/source-package/gnutls26,https://www.openhub.net/projects/gnutls,GnuTLS,"GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. It is aimed to be portable and efficient with focus on security and interoperability.",http://www.gnutls.org,,21,79,185927,C,gpl3_or_later lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",157014,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","TLS implementation.  Less used than OpenSSL, but is in use (it avoids OpenSSL licensing issues). Good ""security activity"" metrics, except suspiciously empty GitLab issue tracker, especially when Debian Security page shows many existing vulnerabilities. They may sweep the public issue tracker so as not to expose what they're trying to fix before it's ready. Notably still supporting SSL 3.0, which has known exploits. There is evidence they do stay on top of things, though. They have responded to questions regarding FREAK in their mailing lists, explaining gnutls is not vulnerable due to how it operates. ++"
  +libgssapi-krb5-2,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - krb5 GSS-API Mechanism,http://web.mit.edu/kerberos/,45,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,21,96,388789,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161577,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Vital when using Kerberos; unclear how common that is today. (For Windows, may use SAMBA)"
  +libice6,libice,2:1.0.8-2,X11 Inter-Client Exchange library,,0,https://security-tracker.debian.org/tracker/source-package/libice,https://www.openhub.net/projects/libice,libice,ICE - Is a generic module for Interactive Connectivity Establishment to make better flow of data between the endpoints in the internet. This is mostly used to intiate the media session between the endpoints. It is written in Purely ANSI C so that it can be compiled to embedded platforms.,http://code.google.com/p/libice,,0,1,0,,gpl,Stable Y-O-Y development activity,Short source control history,,No recent development activity,137357,C,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +libkeyutils1,keyutils,1.5.5-3+deb7u1,Linux Key Management Utilities (library),http://people.redhat.com/~dhowells/keyutils/,0,https://security-tracker.debian.org/tracker/source-package/keyutils,https://www.openhub.net/projects/keyutils,keyutils,Linux Key Management Utilities,https://github.com/pld-linux/keyutils,,1,4,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Only a single active developer,167697,C,Shared Library,0,1,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Manages authorization and encryption keys required to perform secure operations. Public Repo, NO bug tracker, NO mailing list. ++"
  +libkrb5-3,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries,http://web.mit.edu/kerberos/,45,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,21,96,388789,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161582,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Vital when using Kerberos; unclear how common that is today. (For Windows, may use SAMBA)"
   libldap-2.4-2,openldap,2.4.31-1+nmu2,OpenLDAP libraries,http://www.openldap.org/,13,https://security-tracker.debian.org/tracker/source-package/openldap,https://www.openhub.net/projects/openldap,OpenLDAP,"OpenLDAP Software is the premier open source implementation of the Lightweight Directory Access Protocol. It is the most reliable and standards-compliant. Since 2005 it has been the world's fastest; it is the gold standard against which all other directory software is compared.
   
   The suite includes:
   
   * slapd - stand-alone LDAP daemon (server)
   * libraries implementing the LDAP protocol, and
  -* utilities, tools, and sample clients.",http://www.openldap.org/,http://www.openldap.org/software/download/,18,104,564452,C,OpenLDAP_Public_License,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",166665,,,1,0,0,8,"Wide use, vitally important. Very active. Public repo, issue tracker, lists, active development, closing CVEs, the works. This is vitally important, but they appear to have things in hand in terms of project activity. ++"
  -liblwres80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Lightweight Resolver Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",105345,,,1,0,0,8,Bind9 is critical for security. It does have active development. ++
  -libmpfr4,mpfr4,3.1.0-5,multiple precision floating-point computation,http://www.mpfr.org/,1,https://security-tracker.debian.org/tracker/source-package/mpfr4,https://www.openhub.net/projects/gnu-mpfr,GNU MPFR,Provides a library for multiple-precision floating-point computation with correct rounding. The computation is both efficient and has a well-defined semantics. It copies the good ideas from the ANSI/IEEE-754 standard for double-precision floating-point arithmetic.,http://www.mpfr.org/,http://www.mpfr.org/mpfr-current/,2,17,91557,C,lgpv3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,139170,C,Shared Library,0,0,0,8,
  -libpam-modules,pam,1.1.3-7.1,Pluggable Authentication Modules for PAM,http://pam.sourceforge.net/,15,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,7,20,57169,C,BSD-3-Clause gpl gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169892,C,Plugin,1,0,0,8,"Critical central role for authentication.  Real site is http://www.linux-pam.org/ (Debian lists as http://pam.sourceforge.net/ but that points to https://fedorahosted.org/linux-pam/ which points to this). It has a somewhat active mailing list, and an active issue tracker where issues are clearly opened and closed. Stable version is somewhat old (2013); recent changes in git though relatively small (https://git.fedorahosted.org/cgit/linux-pam.git/) ++"
  -libpam0g,pam,1.1.3-7.1,Pluggable Authentication Modules library,http://pam.sourceforge.net/,15,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,7,20,57169,C,BSD-3-Clause gpl gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169889,C,Shared Library,1,0,0,8,Critical central role for authentication; not very active.  Concerning. ++
  -libpciaccess0,libpciaccess,0.13.1-2,Generic PCI access library for X,,0,https://security-tracker.debian.org/tracker/source-package/libpciaccess,https://www.openhub.net/projects/pci-utility,PCI Configuration Utility.,pci-utility is utility developed to access PCI Device configuration Space. It enables user to read and write registers on PCI Configuration space of PCI Devices.,http://sourceforge.net/projects/pci-utility,,0,1,1119,C,,Stable Y-O-Y development activity,Short source control history,Average number of code comments,No recent development activity,110995,,Shared Library,0,0,0,8,
  +* utilities, tools, and sample clients.",http://www.openldap.org/,http://www.openldap.org/software/download/,18,104,564452,C,OpenLDAP_Public_License,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",166665,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Wide use, vitally important. Very active. Public repo, issue tracker, lists, active development, closing CVEs, the works. This is vitally important, but they appear to have things in hand in terms of project activity. ++"
  +liblwres80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Lightweight Resolver Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",105345,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Bind9 is critical for security. It does have active development. ++
  +libmpfr4,mpfr4,3.1.0-5,multiple precision floating-point computation,http://www.mpfr.org/,1,https://security-tracker.debian.org/tracker/source-package/mpfr4,https://www.openhub.net/projects/gnu-mpfr,GNU MPFR,Provides a library for multiple-precision floating-point computation with correct rounding. The computation is both efficient and has a well-defined semantics. It copies the good ideas from the ANSI/IEEE-754 standard for double-precision floating-point arithmetic.,http://www.mpfr.org/,http://www.mpfr.org/mpfr-current/,2,17,91557,C,lgpv3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,139170,C,Shared Library,0,0,0,8,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +libpam-modules,pam,1.1.3-7.1,Pluggable Authentication Modules for PAM,http://pam.sourceforge.net/,15,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,7,20,57169,C,BSD-3-Clause gpl gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169892,C,Plugin,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Critical central role for authentication.  Real site is http://www.linux-pam.org/ (Debian lists as http://pam.sourceforge.net/ but that points to https://fedorahosted.org/linux-pam/ which points to this). It has a somewhat active mailing list, and an active issue tracker where issues are clearly opened and closed. Stable version is somewhat old (2013); recent changes in git though relatively small (https://git.fedorahosted.org/cgit/linux-pam.git/) ++"
  +libpam0g,pam,1.1.3-7.1,Pluggable Authentication Modules library,http://pam.sourceforge.net/,15,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,7,20,57169,C,BSD-3-Clause gpl gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169889,C,Shared Library,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Critical central role for authentication; not very active.  Concerning. ++
  +libpciaccess0,libpciaccess,0.13.1-2,Generic PCI access library for X,,0,https://security-tracker.debian.org/tracker/source-package/libpciaccess,https://www.openhub.net/projects/pci-utility,PCI Configuration Utility.,pci-utility is utility developed to access PCI Device configuration Space. It enables user to read and write registers on PCI Configuration space of PCI Devices.,http://sourceforge.net/projects/pci-utility,,0,1,1119,C,,Stable Y-O-Y development activity,Short source control history,Average number of code comments,No recent development activity,110995,,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
   libprocps0,procps,1:3.3.3-3,library for accessing process information from /proc,http://gitorious.org/procps,0,https://security-tracker.debian.org/tracker/source-package/procps,https://www.openhub.net/projects/procps,Procps - The /proc file system utilities,"procps is the package that has a bunch of small useful utilities that give information about processes using the /proc filesystem. The package includes the programs ps, top, vmstat, w, kill, free, slabtop, and skill.
   
  -Version 3 includes NPTL thread support, a rewritten top, many bug fixes, performance improvements, and new features.",http://procps.sourceforge.net/,http://procps.sourceforge.net/download.html,0,2,15622,C,lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,117203,,Shared Library,0,0,0,8,
  -libssl1.0.0,openssl,1.0.1e-2+deb7u13,SSL shared libraries,,87,https://security-tracker.debian.org/tracker/source-package/openssl,https://www.openhub.net/projects/openssl,OpenSSL,"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and dev",http://www.openssl.org/,http://www.openssl.org//source/,107,177,437855,C,OpenSSL_License,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",136119,,,1,0,0,8,"Critical, in wide use.  OpenSSL is already funded by CII. ++"
  -libusb-1.0-0,libusbx,2:1.0.11-1,userspace USB programming library,http://www.linux-usb.org/,0,https://security-tracker.debian.org/tracker/source-package/libusbx,https://www.openhub.net/projects/libusbx,libusbx,libusbx is a cross-platform user mode library that provides generic access to USB devices,http://libusbx.org,http://sourceforge.net/projects/libusbx/files/,0,71,28479,C,lgpl21_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,No recent development activity,133195,C,Shared Library,0,0,0,8,
  +Version 3 includes NPTL thread support, a rewritten top, many bug fixes, performance improvements, and new features.",http://procps.sourceforge.net/,http://procps.sourceforge.net/download.html,0,2,15622,C,lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,117203,,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +libssl1.0.0,openssl,1.0.1e-2+deb7u13,SSL shared libraries,,87,https://security-tracker.debian.org/tracker/source-package/openssl,https://www.openhub.net/projects/openssl,OpenSSL,"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and dev",http://www.openssl.org/,http://www.openssl.org//source/,107,177,437855,C,OpenSSL_License,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",136119,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Critical, in wide use.  OpenSSL is already funded by CII. ++"
  +libusb-1.0-0,libusbx,2:1.0.11-1,userspace USB programming library,http://www.linux-usb.org/,0,https://security-tracker.debian.org/tracker/source-package/libusbx,https://www.openhub.net/projects/libusbx,libusbx,libusbx is a cross-platform user mode library that provides generic access to USB devices,http://libusbx.org,http://sourceforge.net/projects/libusbx/files/,0,71,28479,C,lgpl21_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,No recent development activity,133195,C,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
   libustr-1.0-1,ustr,1.0.4-3,Micro string library: shared library,http://www.and.org/ustr/,0,https://security-tracker.debian.org/tracker/source-package/ustr,https://www.openhub.net/projects/10874,Ustr,"Micro string library, very low overhead from plain strdup() (Ave. 44% for 0-20B strings). Very easy to use in existing C code. At it's simplest you can
  -just include a single header file into your .c and start using it.",http://www.and.org/ustr/,http://www.and.org/ustr/,0,2,27200,C,mit,Stable Y-O-Y development activity,Short source control history,Very few source code comments,No recent development activity,136967,,Shared Library,0,0,0,8,
  -libxrender1,libxrender,1:0.9.7-1+deb7u1,X Rendering Extension client library,,1,https://security-tracker.debian.org/tracker/source-package/libxrender,https://www.openhub.net/projects/libxrender,libXrender,,http://cgit.freedesktop.org/xorg/lib/libXrender,http://cgit.freedesktop.org/xorg/lib/libXrender,2,31,2995,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,139934,,,0,0,0,8,
  +just include a single header file into your .c and start using it.",http://www.and.org/ustr/,http://www.and.org/ustr/,0,2,27200,C,mit,Stable Y-O-Y development activity,Short source control history,Very few source code comments,No recent development activity,136967,,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +libxrender1,libxrender,1:0.9.7-1+deb7u1,X Rendering Extension client library,,1,https://security-tracker.debian.org/tracker/source-package/libxrender,https://www.openhub.net/projects/libxrender,libXrender,,http://cgit.freedesktop.org/xorg/lib/libXrender,http://cgit.freedesktop.org/xorg/lib/libXrender,2,31,2995,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,139934,,,0,0,0,8,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
   linux-image-3.2.0-4-amd64,linux,3.2.63-2+deb7u2,Linux 3.2 for 64-bit PCs,,403,https://security-tracker.debian.org/tracker/source-package/linux,https://www.openhub.net/projects/linux,Linux Kernel,"Linux is a free software kernel, which combined with the GNU libraries, core utils and shell form the GNU/Linux operating system.
   
  -!!!PLEASE!!! DO NOT REMOVE git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git enlistment. It contains historical pre-2.6.12 commit data.",http://kernel.org/,,3714,14514,18036029,C,GNU_General_Public_License_v2_0_only,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",74082,,,1,0,0,8,"Linux kernel. Fundamental to security, but it has extremely active development and many tools/organizations reviewing."
  -menu,,2.1.46,generates programs menu for all menu-aware applications,,0,https://security-tracker.debian.org/tracker/source-package/menu,https://www.openhub.net/projects/8294,Debian menu,Generate menus files for applications from a list of menu entries files and an application specific menu-method file. This is the way coherence between installed packages and programs menu is achieved on Debian systems.,http://alioth.debian.org/projects/menu/,http://alioth.debian.org/scm/?group_id=30046,0,7,5098,C++,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,90826,,Program,0,0,0,8,
  -netcat-traditional,netcat,1.10-40,TCP/IP swiss army knife,,0,https://security-tracker.debian.org/tracker/source-package/netcat,,,,,,,,,,,,,,,166141,C,,1,0,0,8,Netcat is typically used only by invocation in specific cases.
  -nfs-common,nfs-utils,1:1.2.6-4,NFS support files common to client and server,http://nfs.sourceforge.net/,4,https://security-tracker.debian.org/tracker/source-package/nfs-utils,https://www.openhub.net/projects/nfs-utils,nfs-utils,"The Network File System (NFS) was developed to allow machines to mount a disk partition on a remote machine as if it were a local disk. It allows for fast, seamless sharing of files across a network.",http://nfs.sourceforge.net/,http://sourceforge.net/projects/nfs/files/nfs-utils/,36,142,38969,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",143800,C,,1,0,0,8,"Important for NFS, amount of use unclear."
  +!!!PLEASE!!! DO NOT REMOVE git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git enlistment. It contains historical pre-2.6.12 commit data.",http://kernel.org/,,3714,14514,18036029,C,GNU_General_Public_License_v2_0_only,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",74082,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Linux kernel. Fundamental to security, but it has extremely active development and many tools/organizations reviewing."
  +menu,,2.1.46,generates programs menu for all menu-aware applications,,0,https://security-tracker.debian.org/tracker/source-package/menu,https://www.openhub.net/projects/8294,Debian menu,Generate menus files for applications from a list of menu entries files and an application specific menu-method file. This is the way coherence between installed packages and programs menu is achieved on Debian systems.,http://alioth.debian.org/projects/menu/,http://alioth.debian.org/scm/?group_id=30046,0,7,5098,C++,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,90826,,Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  +netcat-traditional,netcat,1.10-40,TCP/IP swiss army knife,,0,https://security-tracker.debian.org/tracker/source-package/netcat,,,,,,,,,,,,,,,166141,C,,1,0,0,8,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Netcat is typically used only by invocation in specific cases.
  +nfs-common,nfs-utils,1:1.2.6-4,NFS support files common to client and server,http://nfs.sourceforge.net/,4,https://security-tracker.debian.org/tracker/source-package/nfs-utils,https://www.openhub.net/projects/nfs-utils,nfs-utils,"The Network File System (NFS) was developed to allow machines to mount a disk partition on a remote machine as if it were a local disk. It allows for fast, seamless sharing of files across a network.",http://nfs.sourceforge.net/,http://sourceforge.net/projects/nfs/files/nfs-utils/,36,142,38969,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",143800,C,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Important for NFS, amount of use unclear."
   openssh-client,openssh,1:6.0p1-4+deb7u2,"secure shell (SSH) client, for secure access to remote machines",http://www.openssh.org/,13,https://security-tracker.debian.org/tracker/source-package/openssh,https://www.openhub.net/projects/openssh,OpenSSH,"OpenSSH is a free SSH/SecSH protocol suite providing encryption for network services like remote login or remote file transfer.
   
   The following is a list of OpenSSH features:
  
positive.code:  It can be run on several .deb archives at a time to get a list of all
   of the changes that would be effected by installing or upgrading a
   group of packages.  It can be configured to do this automatically
   during upgrades using apt.",http://packages.debian.org/apt-listchanges,http://packages.debian.org/apt-listchanges,0,2,994,Python,gpl,,,,,135160,,Program,0,0,0,6,
  bsdutils,util-linux (2.20.1-5.3),1:2.20.1-5.3,Basic utilities from 4.4BSD-Lite,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/Util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169894,C,,0,0,0,6,
  busybox,,1:1.20.0-7,Tiny utilities for small and embedded systems,http://www.busybox.net,5,https://security-tracker.debian.org/tracker/source-package/busybox,https://www.openhub.net/projects/busybox,BusyBox,"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. The utilities in BusyBox generally have fewer options than their full-featured GNU cousins; however, the options that are included provide the expected functionality and behave very much like their GNU counterparts. BusyBox provides a fairly complete environment for any small or embedded system.
  
  BusyBox has been written with size-optimization and limited resources in mind. It is also extremely modular so you can easily include or exclude commands (or features) at compile time. This makes it easy to customize your embedd",http://busybox.net/,http://busybox.net/download.html,41,250,175036,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",166884,,Program,0,0,0,6,
  hostname,,3.11,utility to set/show the host name or domain name,,0,https://security-tracker.debian.org/tracker/source-package/hostname,,,,,,,,,,,,,,,169894,C,,0,0,0,6,Relatively small functionality.
  installation-report,,2.49,system installation report,,0,https://security-tracker.debian.org/tracker/source-package/installation-report,https://www.openhub.net/projects/installation-report,installation-report,,,,2,66,468,shell script,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,162957,,Program,0,0,0,6,
  less,,444-4,pager program similar to more,http://www.greenwoodsoftware.com/less/,1,https://security-tracker.debian.org/tracker/source-package/less,,,,,,,,,,,,,,,164427,C,Program,0,0,0,6,Less likely to be a security vulnerability :-).
  libacl1,acl,2.2.51-8,Access control list shared library,http://savannah.nongnu.org/projects/acl/,0,https://security-tracker.debian.org/tracker/source-package/acl,,,,,,,,,,,,,,,169898,C,Shared Library,0,0,1,6,"Access control-related, so of concern."
  libaudit0,audit,1:1.7.18-1.1,Dynamic library for security auditing,http://people.redhat.com/sgrubb/audit/,0,https://security-tracker.debian.org/tracker/source-package/audit,,,,,,,,,,,,,,,75354,C,Shared Library,0,0,1,6,"Audit framework for Debian, many other components depend on it.  Useful for detecting problems. Project infrastructure at Red Hat. SVN repo available. Most recent code change 2 months ago. Mailing lists and IRC exist. v2.4 release 10/2014, plans exist for v2.5 and 2.6. Couldn't find an issue tracker. ++"
  libblkid1,util-linux,2.20.1-5.3,block device id library,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/Util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169900,C,Shared Library,0,0,0,6,
  libept1.4.12,libept,1.0.9,High-level library for managing Debian package information,,0,https://security-tracker.debian.org/tracker/source-package/libept,,,,,,,,,,,,,,,129952,C++,Development Library,0,0,0,6,"Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  libgl1-mesa-dri,mesa,8.0.5-4+deb7u2,free implementation of the OpenGL API -- DRI modules,http://mesa3d.sourceforge.net/,4,https://security-tracker.debian.org/tracker/source-package/mesa,https://www.openhub.net/projects/mesa,Mesa,"Mesa is an open-source implementation of the OpenGL specification - a system for rendering interactive 3D graphics.
  
  A variety of device drivers allows Mesa to be used in many different environments ranging from software emulation to complete hardware acceleration for modern GPUs.
  
  Mesa ties into several other open-source projects: the Direct Rendering Infrastructure and X.org to provide OpenGL support to users of X on Linux, FreeBSD and other operating systems.",http://sourceforge.net/projects/mesa3d,,167,682,1037410,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",113945,,Shared Library,0,0,0,6,
  libgpgme11,gpgme1.0,1.2.0-1.4+deb7u1,GPGME - GnuPG Made Easy,,1,https://security-tracker.debian.org/tracker/source-package/gpgme1.0,https://www.openhub.net/projects/gpgme,GPGME,"GnuPG Made Easy (GPGME) is a library designed to make access to GnuPG easier for applications. It provides a High-Level Crypto API for encryption, decryption, signing, signature verification and key management. Currently it uses GnuPG as its backend but the API isn't restricted to this engine; in fact we have already developed a backend for CMS (S/MIME).",http://www.gnupg.org/gpgme.html,http://www.gnupg.org/download/index.html#gpgme,4,16,71180,C,lgpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,148645,C,Shared Library,1,0,0,6,"Vital for protecting email (see gpg) Git repo available. Issue tracker site uses self-signed cert; it's concerning that a user would have to compromise the HTTPS security model just to view and interact with the bug tracker. Openhub doesn't reflect their mailing lists in *multiple languages*. Appears to be actively maintained mostly by one dev, but notably just got donations supporting him for the next 2-3 years. ++"
  libgssglue1,libgssglue,0.4-2,mechanism-switch gssapi library,http://www.citi.umich.edu/projects/nfsv4/linux/,1,https://security-tracker.debian.org/tracker/source-package/libgssglue,,,,,,,,,,,,,,,132579,,Shared Library,1,0,0,6,Vital for systems that use it; amount of use unclear.
  liblocale-gettext-perl,liblocale-gettext-perl (1.05-7),1.05-7+b1,module using libc functions for internationalization in Perl,http://search.cpan.org/dist/gettext/gettext.pm,0,https://security-tracker.debian.org/tracker/source-package/liblocale-gettext-perl,https://www.openhub.net/projects/catatylstgettex,Catalyst::Plugin::I18N::Gettext,The Perl module Catalyst::Plugin::I18N::Gettext is a internationalization plugin using GNU gettext in the Catalyst framework without using module Locale::Maketext.,http://sourceforge.net/projects/catatylstgettex/,,0,1,290,Perl,,Stable Y-O-Y development activity,Short source control history,Average number of code comments,No recent development activity,169765,,,0,0,0,6,
  libmount1,util-linux,2.20.1-5.3,block device id library,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",135560,C,Shared Library,0,0,0,6,
  libsqlite3-0,sqlite3,3.7.13-1+deb7u1,SQLite 3 shared library,http://www.sqlite.org/,5,https://security-tracker.debian.org/tracker/source-package/sqlite3,https://www.openhub.net/projects/sqlite,SQLite,"SQLite is a small C library that implements a self-contained, embeddable, zero-configuration SQL database engine. Implements most of SQL92 and ACID (atomic, consistent, isolated, and durable) transactions; no setup or administration needed.",http://sqlite.org/,http://sqlite.org/download.html,4,30,235125,C,Public_Domain,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,169160,,,0,0,0,6,
  libtirpc1,libtirpc,0.2.2-5,transport-independent RPC library,,1,https://security-tracker.debian.org/tracker/source-package/libtirpc,https://www.openhub.net/projects/libtirpc,libtirpc,Libtirpc is a port of Suns Transport-Independent RPC library to Linux. It's being developed by the Bull GNU/Linux NFSv4 project. Note: The SVN Repository on this site is *not* used. Use the git://git.infradead.org/~steved/libtirpc.git GIT tree,http://sourceforge.net/projects/libtirpc,,9,31,18347,C,,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",118553,,Shared Library,1,0,0,6,"RPC library, used by NFS."
  libuuid1,util-linux,2.20.1-5.3,Universally Unique ID library,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169892,C,Shared Library,0,0,0,6,
  libx11-6,libx11,2:1.5.0-1+deb7u1,X11 client-side library,,4,https://security-tracker.debian.org/tracker/source-package/libx11,https://www.openhub.net/projects/libx11,libX11,git://anongit.freedesktop.org/xorg/lib/libX11,https://github.com/mirror/libX11,https://github.com/mirror/libX11/downloads,7,136,221808,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",167543,,,0,0,0,6,
  libx11-data,libx11,2:1.5.0-1+deb7u1,X11 client-side library,,4,https://security-tracker.debian.org/tracker/source-package/libx11,https://www.openhub.net/projects/libx11,libX11,git://anongit.freedesktop.org/xorg/lib/libX11,https://github.com/mirror/libX11,https://github.com/mirror/libX11/downloads,7,136,221808,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",167500,,,0,0,0,6,
  libxfont1,libxfont,1:1.4.5-4,X11 font rasterisation library,,8,https://security-tracker.debian.org/tracker/source-package/libxfont,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",116868,,,0,0,0,6,
  linux-base,,3.5,Linux image base package,,0,https://security-tracker.debian.org/tracker/source-package/linux-base,,,,,,,,,,,,,,,159593,C,Program,0,0,0,6,These are small scripts and utilities for the Linux kernel.
  linux-headers-3.2.0-4-common,linux,3.2.63-2+deb7u2,Common header files for Linux 3.2.0-4,,403,https://security-tracker.debian.org/tracker/source-package/linux,https://www.openhub.net/projects/linux,Linux Kernel,"Linux is a free software kernel, which combined with the GNU libraries, core utils and shell form the GNU/Linux operating system.
  
  !!!PLEASE!!! DO NOT REMOVE git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git enlistment. It contains historical pre-2.6.12 commit data.",http://kernel.org/,,3714,14514,18036029,C,GNU_General_Public_License_v2_0_only,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",36073,,,0,0,0,6,
  linux-libc-dev,linux,3.2.63-2+deb7u2,Linux support headers for userspace development,,403,https://security-tracker.debian.org/tracker/source-package/linux,https://www.openhub.net/projects/linux,Linux Kernel,"Linux is a free software kernel, which combined with the GNU libraries, core utils and shell form the GNU/Linux operating system.
  
  !!!PLEASE!!! DO NOT REMOVE git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git enlistment. It contains historical pre-2.6.12 commit data.",http://kernel.org/,,3714,14514,18036029,C,GNU_General_Public_License_v2_0_only,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",114294,,,0,0,0,6,
  login,shadow,1:4.1.5.1-1,system login tools,http://pkg-shadow.alioth.debian.org/,2,https://security-tracker.debian.org/tracker/source-package/shadow,https://www.openhub.net/projects/shadow-tool-suite,Shadow Tool Suite,"The shadow tool suite contains the following commands among others: login, passwd, useradd, groupadd.",http://pkg-shadow.alioth.debian.org/,http://pkg-shadow.alioth.debian.org/download.php,7,20,127125,C,bsd,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",169894,C,Program,0,0,1,6,"Front door for local login. Has Home Page, part of shadow tool suite, Latest release May 2014, Public Repo, Somewhat active mailing list, NO issue tracker. ++"
  mount,util-linux,2.20.1-5.3,Tools for mounting and manipulating filesystems,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169778,,Program,0,0,0,6,
  python-chardet,chardet,2.0.1-2,universal character encoding detector,http://chardet.feedparser.org/,0,https://security-tracker.debian.org/tracker/source-package/chardet,https://www.openhub.net/projects/chardet,chardet,,,,0,1,176656,XSL Transformation,,,,,,137682,,Shared Library,0,0,0,6,
  python-debianbts,,1.11,Python interface to Debian's Bug Tracking System,,0,https://security-tracker.debian.org/tracker/source-package/python-debianbts,https://www.openhub.net/projects/python-debianbts,python-debianbts,,,,2,4,281,Python,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,122211,Python,Program,0,0,0,6,
  telnet,netkit-telnet,0.17-36,The telnet client,,0,https://security-tracker.debian.org/tracker/source-package/netkit-telnet,,,,,,,,,,,,,,,155277,,Program,1,0,0,6,Telnet is a fundamentally insecure protocol and is being phased out in most locations.
  util-linux,,2.20.1-5.3,Miscellaneous system utilities,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169889,,,0,0,0,6,
  w3m,,0.5.3-8,WWW browsable pager with excellent tables/frames support,http://sourceforge.net/projects/w3m,1,https://security-tracker.debian.org/tracker/source-package/w3m,https://www.openhub.net/projects/w3m,w3m,"w3m is a pager/text-based WWW browser. It is similar to Lynx, but handles some things like page navigation differently. It can render tables and frames (by converting frames into tables) or display a document given from standard input. It can also be used with mouse in an xterm or in a gpm-driven console, and it is small.",http://w3m.sourceforge.net,http://sourceforge.net/project/showfiles.php?group_id=39518,17,28,166972,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,"Large, active development team",149248,C,,1,0,0,6,"Web browser, so can clearly process attacker data.  However, less commonly used in practice."
  x11-common,xorg,1:7.7+3~deb7u1,X Window System (X.Org) infrastructure,,2,https://security-tracker.debian.org/tracker/source-package/xorg,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",142707,"sh, bash, ksh, tcsh and other shells",,0,0,1,6,X development is transitioning towards Wayland.
  libapr1,apr,1.4.6-3+deb7u1,Apache Portable Runtime Library,http://apr.apache.org/,3,https://security-tracker.debian.org/tracker/source-package/apr,https://www.openhub.net/projects/apr,Apache Portable Runtime,"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.",http://apr.apache.org/,,14,67,419947,C,apache_2,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",125815,C,Shared Library,0,1,0,6,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  However, it's not as clear that the LDAP library in it is as actively managed. HAS Home Page, HAS Mailing List, Issue tracker https://bz.apache.org/bugzilla/enter_bug.cgi?product=APR \++"
  libaprutil1-ldap,apr-util,1.4.1-3,Apache Portable Runtime Utility Library - LDAP Driver,http://apr.apache.org/,1,https://security-tracker.debian.org/tracker/source-package/apr-util,https://www.openhub.net/projects/apr,Apache Portable Runtime,"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.",http://apr.apache.org/,,14,67,419947,C,apache_2,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",109791,C,Shared Library,1,0,0,6,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  The LDAP driver is maintained as part of APR, http://apr.apache.org/ The APR-util version 1.5.4 was released September 22, 2014, so it is actively maintained. They use the apache.org repo and subversion; apr-util has been merged into main trunk, making it a little harder to see LDAP specifics to determine if the LDAP portion is active. Mailing list dev@apr.apache.org seems active. ++"
  libpng3,libpng,1.2.49-1,PNG library - runtime,http://libpng.org/pub/png/libpng.html,20,https://security-tracker.debian.org/tracker/source-package/libpng,https://www.openhub.net/projects/libpng,libpng,"libpng is the official PNG reference library. It supports almost all PNG features, is extensible, and has been extensively tested for over 17 years.
  
  libpng is available as ANSI C source code and requires zlib 1.0.4 or later (1.2.3 or 1.1.4 recommended due to potential security vulnerabilities in earlier versions). In addition to the main library sources, libpng includes the rpng, rpng2 and wpng demo programs, the pngminus demo program, a subset of Willem van Schaik's PngSuite test images, and Willem's VisualPng demo program.  Configure, CMake, Visualc projects, and various makefiles are included for building libpng.
  
  Libpng is under the libpng license.",http://www.libpng.org/pub/png/libpng.html,http://sourceforge.net/project/showfiles.php?group_id=5624,5,10,407995,C,libpng,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,1272,,Dummy Package,0,1,0,6,
  libpng,,,,,20,https://security-tracker.debian.org/tracker/source-package/libpng,https://www.openhub.net/projects/libpng,libpng,"libpng is the official PNG reference library. It supports almost all PNG features, is extensible, and has been extensively tested for over 17 years.
  
  libpng is available as ANSI C source code and requires zlib 1.0.4 or later (1.2.3 or 1.1.4 recommended due to potential security vulnerabilities in earlier versions). In addition to the main library sources, libpng includes the rpng, rpng2 and wpng demo programs, the pngminus demo program, a subset of Willem van Schaik's PngSuite test images, and Willem's VisualPng demo program.  Configure, CMake, Visualc projects, and various makefiles are included for building libpng.
  
  Libpng is under the libpng license.",http://www.libpng.org/pub/png/libpng.html,http://sourceforge.net/project/showfiles.php?group_id=5624,5,10,407995,C,libpng,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,1,,,0,1,0,6,
  rpm,,4.10.0-5+deb7u1,package manager for RPM,http://rpm.org/,11,https://security-tracker.debian.org/tracker/source-package/rpm,https://www.openhub.net/projects/rpm,RPM,"The RPM Package Manager (RPM) is a powerful command line driven package management system capable of installing, uninstalling, verifying, querying, and updating computer software packages. Each software package consists of an archive of files along with information about the package like its version, a description, and the like. There is also a library API, permitting advanced developers to manage such transactions from programming languages such as C or Python.",http://rpm.org,http://wiki.rpm.org/Download,16,102,67656,C,gpl lgpl21_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",26685,,,0,1,0,6,"This is used by RPM-based systems to install programs.  Here we refer to the version at rpm.org (used by Fedora, Red Hat Enterprise Linux, CentOS, SUSE).  (Note that there is a fork by the original RPM maintainer (Jeff Johnson) at rpm5.org, used by some organizations.)  Has ticket tracker, many long-opened defect tickets. Latest release 2014-10-09.
  Repo publicly available in git, see: http://rpm.org/wiki/GetSource and a number of commits in 2015 (and before)."
  openvpn,,2.2.1-8+deb7u3,virtual private network daemon,http://www.openvpn.net/,2,https://security-tracker.debian.org/tracker/source-package/openvpn,https://www.openhub.net/projects/openvpn,OpenVPN,"OpenVPN is a robust and highly configurable VPN (Virtual Private Network) daemon which can be used to securely link two or more private networks using an encrypted tunnel over the Internet. OpenVPN's principal strengths include wide cross-platform portability, excellent stability, support for dynamic IP addresses and NAT, adaptive link compression, single TCP/UDP port usage, a modular design that offloads most crypto tasks to the OpenSSL library, and relatively easy installation that in most cases doesn't require a special kernel module.",http://openvpn.net,http://openvpn.net/download.html,24,81,328250,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",29649,,Program,1,0,0,6,
  dnsmasq,,2.62-3+deb7u1,Small caching DNS proxy and DHCP/TFTP server,,3,https://security-tracker.debian.org/tracker/source-package/dnsmasq,https://www.openhub.net/projects/dnsmasq,Dnsmasq,"Dnsmasq is a lightweight, easy to configure DNS forwarder and DHCP server. It is designed to provide DNS and, optionally, DHCP, to a small network. It can serve the names of local machines which are not in the global DNS. The DHCP server integrates with the DNS server and allows machines with DHCP-allocated addresses to appear in the DNS with names configured either in each host or in a central configuration file. Dnsmasq supports static and dynamic DHCP leases and BOOTP/TFTP for network booting of diskless machines.",http://www.thekelleys.org.uk/dnsmasq/doc.html,http://www.thekelleys.org.uk/dnsmasq/doc.html,31,55,30256,C,gpl gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Very large, active development team",4480,,,1,1,0,6,
  ffmpeg,libav,6:0.8.16-1,"Multimedia player, server, encoder and transcoder (transitional package)",http://libav.org/,188,https://security-tracker.debian.org/tracker/source-package/libav,https://www.openhub.net/projects/ffmpeg,FFmpeg,"FFmpeg is a complete solution to record, convert and stream audio and video. It includes libavcodec, the leading audio/video codec library. FFmpeg is mostly developed under Linux, but portable to operating systems, including Windows.",http://www.ffmpeg.org/,http://www.ffmpeg.org/download.html,305,1321,886911,C,lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Very large, active development team",25956,,,0,1,0,6,
  qemu,,1.1.2+dfsg-6a+deb7u6,fast processor emulator,http://www.qemu.org/,66,https://security-tracker.debian.org/tracker/source-package/qemu,https://www.openhub.net/projects/qemu,QEMU,"QEMU is a generic and open source machine emulator and virtualizer.
  
  When used as a machine emulator, QEMU can run OSes and programs made for one machine on a different machine. By using dynamic translation, it achieves very good performance.
  
  When used as a virtualizer, QEMU achieves near native performances by executing the guest code directly on the host CPU.",http://www.qemu.org/,http://wiki.qemu.org/Download,319,937,939991,C,bsd gpl lgpl Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Very large, active development team",9697,,,0,0,1,6,
  git,,1:1.7.10.4-1+wheezy1,"fast, scalable, distributed revision control system",http://git-scm.com/,3,https://security-tracker.debian.org/tracker/source-package/git,https://www.openhub.net/projects/git,Git,"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals.",http://git-scm.com/,http://git-scm.com/downloads,173,1345,366634,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",73334,C,,0,1,0,6,
  base-passwd,,3.5.26,Debian base system master password and group files,,0,https://security-tracker.debian.org/tracker/source-package/base-passwd,https://www.openhub.net/projects/passwd,passwd,Implementation of the password setting/changing utility through PAM and libuser libraries.,https://fedorahosted.org/passwd/,https://fedorahosted.org/releases/p/a/passwd/,1,104,1512,C,BSD-3-Clause GPL-1-0plus,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,169899,,Application Data,0,0,1,5,
  e2fslibs,e2fsprogs,1.42.5-1.1,ext2/ext3/ext4 file system libraries,http://e2fsprogs.sourceforge.net,2,https://security-tracker.debian.org/tracker/source-package/e2fsprogs,https://www.openhub.net/projects/e2fsprogs,e2fsprogs,The e2fsprogs package contains the utilities for handling the ext2 file system. It also supports the ext3 and ext4 journaling file systems.,http://ext4.wiki.kernel.org/,http://e2fsprogs.sourceforge.net/,30,139,159294,C,BSD-3-Clause GNU_General_Public_License_v2_0_only lgpl-2_0 mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169896,,,0,0,0,5,
  e2fsprogs,,1.42.5-1.1,ext2/ext3/ext4 file system utilities,http://e2fsprogs.sourceforge.net,2,https://security-tracker.debian.org/tracker/source-package/e2fsprogs,https://www.openhub.net/projects/e2fsprogs,e2fsprogs,The e2fsprogs package contains the utilities for handling the ext2 file system. It also supports the ext3 and ext4 journaling file systems.,http://ext4.wiki.kernel.org/,http://e2fsprogs.sourceforge.net/,30,139,159294,C,BSD-3-Clause GNU_General_Public_License_v2_0_only lgpl-2_0 mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169891,,,0,0,0,5,
  grep,,2.12-2,"GNU grep, egrep and fgrep",http://www.gnu.org/software/grep/,2,https://security-tracker.debian.org/tracker/source-package/grep,https://www.openhub.net/projects/grep,GNU grep,"Grep searches one or more input files for lines containing a match to a specified pattern. By default, grep prints the matching lines.",http://savannah.gnu.org/projects/grep/,,5,41,10816,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,169894,C,,0,0,0,5,
  isc-dhcp-common,isc-dhcp,4.2.2.dfsg.1-5+deb70u6,common files used by all the isc-dhcp* packages,,22,https://security-tracker.debian.org/tracker/source-package/isc-dhcp,https://www.openhub.net/projects/4273,DHCP (ISC),"The Internet Systems Consortium (ISC) offers a Dynamic Host Configuration Protocol (DHCP) distribution including a DHCP server, client and relay agent. This distribution supports POSIX-compliant operating systems and also non-POSIX systems like Windows NT and MacOS.",http://www.isc.org/downloads/dhcp/,http://ftp.isc.org/isc/dhcp/,6,22,124066,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,158659,,Application Data,1,0,0,5,
  libboost-iostreams1.49.0,boost1.49,1.49.0-3.2,Boost.Iostreams Library,http://www.boost.org/libs/iostreams/,2,https://security-tracker.debian.org/tracker/source-package/boost1.49,,,,,,,,,,,,,,,117893,,Shared Library,0,0,0,5,
  libcomerr2,e2fsprogs,1.42.5-1.1,common error description library,http://e2fsprogs.sourceforge.net,2,https://security-tracker.debian.org/tracker/source-package/e2fsprogs,https://www.openhub.net/projects/e2fsprogs,e2fsprogs,The e2fsprogs package contains the utilities for handling the ext2 file system. It also supports the ext3 and ext4 journaling file systems.,http://ext4.wiki.kernel.org/,http://e2fsprogs.sourceforge.net/,30,139,159294,C,BSD-3-Clause GNU_General_Public_License_v2_0_only lgpl-2_0 mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169894,,,0,0,0,5,
  liblzma5,xz-utils,5.1.1alpha+20120614-2,XZ-format compression library,http://tukaani.org/xz/,1,https://security-tracker.debian.org/tracker/source-package/xz-utils,https://www.openhub.net/projects/xz-utils,XZ Utils,"XZ Utils is free general-purpose data compression software with high compression ratio. XZ Utils were written for POSIX-like systems, but also work on some not-so-POSIX systems. XZ Utils are the successor to LZMA Utils.",http://tukaani.org/xz/,,4,13,28089,C,gpl lgpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Average size development team,135947,C,,0,1,0,5,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. Has Home page, public repo, Fairly active ML http://www.mail-archive.com/xz-devel@tukaani.org/, NO bug tracker ++"
  libnfsidmap2,libnfsidmap,0.25-4,NFS idmapping library,http://www.citi.umich.edu/projects/nfsv4/linux/,0,https://security-tracker.debian.org/tracker/source-package/libnfsidmap,,,,,,,,,,,,,,,149187,,Shared Library,1,0,0,5,"Important for NFS, amount of use unclear."
  libpixman-1-0,pixman,0.26.0-4+deb7u1,pixel-manipulation library for X and cairo,,2,https://security-tracker.debian.org/tracker/source-package/pixman,https://www.openhub.net/projects/pixman,Pixman,"Pixman is a low-level software library for pixel manipulation, providing features such as image compositing and trapezoid rasterization. Important users of pixman are the cairo graphics library and the X server.",http://www.pixman.org/,http://cgit.freedesktop.org/pixman/,8,117,58390,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",137264,C,Shared Library,0,0,0,5,
  libsemanage1,libsemanage,2.1.6-6,SELinux policy management library,http://userspace.selinuxproject.org/,0,https://security-tracker.debian.org/tracker/source-package/libsemanage,https://www.openhub.net/projects/libsemanage,libsemanage,An interface for SELinux management,https://github.com/pld-linux/libsemanage,,1,9,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Only a single active developer,138361,,Shared Library,0,0,0,5,
  libss2,e2fsprogs,1.42.5-1.1,command-line interface parsing library,http://e2fsprogs.sourceforge.net,2,https://security-tracker.debian.org/tracker/source-package/e2fsprogs,https://www.openhub.net/projects/e2fsprogs,e2fsprogs,The e2fsprogs package contains the utilities for handling the ext2 file system. It also supports the ext3 and ext4 journaling file systems.,http://ext4.wiki.kernel.org/,http://e2fsprogs.sourceforge.net/,30,139,159294,C,BSD-3-Clause GNU_General_Public_License_v2_0_only lgpl-2_0 mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169891,,,0,0,0,5,
  libxt6,libxt,1:1.1.3-1+deb7u1,X11 toolkit intrinsics library,,2,https://security-tracker.debian.org/tracker/source-package/libxt,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",133202,C,Shared Library,0,0,0,5,
  lsof,,4.86+dfsg-1,Utility to list open files,http://people.freebsd.org/~abe/,0,https://security-tracker.debian.org/tracker/source-package/lsof,https://www.openhub.net/projects/lsof,lsof,"The free, open-source, Unix administrative tool lsof (for LiSt Open Files) displays information about files open to Unix processes.",http://people.freebsd.org/~abe/,http://people.freebsd.org/~abe/,,,,,Distributable,,,,,159219,C,,0,0,0,5,Unlikely to be a security vulnerability
  mime-support,,3.52-1,"MIME files 'mime.types' & 'mailcap', and support programs",,1,https://security-tracker.debian.org/tracker/source-package/mime-support,,,,,,,,,,,,,,,168503,Perl,Program,0,0,0,5,Processes potentially untrustworthy files.
  net-tools,,1.60-24.2,The NET-3 networking toolkit,http://net-tools.berlios.de/,0,https://security-tracker.debian.org/tracker/source-package/net-tools,https://www.openhub.net/projects/net-tools,net-tools,"A collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Includes: arp, hostname, ifconfig, netstat, rarp, route, plipconfig, slattach, mii-tool, iptunn
  
  Please keep in mind that most net-tools programs are obsolete now. See ethtool and iproute2 instead.",https://sourceforge.net/projects/net-tools/,http://downloads.sourceforge.net/net-tools/,5,25,14709,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Average size development team,169690,C,,1,0,0,5,"It's unclear if the Debian package and SourceForge project are still related.  This warrants further examination. Upstream listed as https://developer.berlios.de/projects/net-tools/ but has moved to http://sourceforge.net/projects/net-tools/ Has mailing though rather inactive. Has public git repo, latest commit 2015-01-07 on 2015-03-12. These are tools for controlling the network and typically run as root; it's unclear how exposed they are to network attack (most, if not all, are probably not exposed). This lack of exposure probably lowers their priority. ++"
  sysv-rc,sysvinit,2.88dsf-41+deb7u1,System-V-like runlevel change mechanism,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/sysvinit,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,169739,,Application Data,0,0,0,5,
  ucf,,3.0025+nmu3,Update Configuration File: preserve user changes to config files.,,0,https://security-tracker.debian.org/tracker/source-package/ucf,https://www.openhub.net/projects/cfg-update,cfg-update,Gentoo cfg-update config file update utility,https://github.com/rich0/cfg-update,,2,4,2495,Perl,GNU_General_Public_License_v2_0_only,Stable Y-O-Y development activity,"Young, but established codebase",Very few source code comments,Small development team,169624,,Program,0,0,0,5,
  vim-common,vim,2:7.3.547-7,Vi IMproved - Common files,http://www.vim.org/,1,https://security-tracker.debian.org/tracker/source-package/vim,https://www.openhub.net/projects/vim,Vim,"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. It's useful whether you're already using vi or using a different editor.",http://www.vim.org/,http://www.vim.org/download.php,1,12,844733,C,Vim_License,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,168687,,Application Data,0,0,0,5,
  xz-utils,,5.1.1alpha+20120614-2,XZ-format compression utilities,http://tukaani.org/xz/,1,https://security-tracker.debian.org/tracker/source-package/xz-utils,https://www.openhub.net/projects/xz-utils,XZ Utils,"XZ Utils is free general-purpose data compression software with high compression ratio. XZ Utils were written for POSIX-like systems, but also work on some not-so-POSIX systems. XZ Utils are the successor to LZMA Utils.",http://tukaani.org/xz/,,4,13,28089,C,gpl lgpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Average size development team,161482,C,,0,1,0,5,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. HAS Home Page, public code repo http://git.tukaani.org/?p=xz.git;a=summary - fairly active by small # of committers.  Some mailing list activity.  No bug tracker found. ++"
  apache2-doc,apache2,2.2.22-13+deb7u3,Apache HTTP Server documentation,http://httpd.apache.org/,47,https://security-tracker.debian.org/tracker/source-package/apache2,https://www.openhub.net/projects/apache,Apache HTTP Server,"The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.",http://httpd.apache.org/,http://httpd.apache.org/download.cgi,30,117,1760653,C,apache_2,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",26469,,,0,0,0,5,
  apache2.2-bin,apache2,2.2.22-13+deb7u3,Apache HTTP Server common binary files,http://httpd.apache.org/,47,https://security-tracker.debian.org/tracker/source-package/apache2,https://www.openhub.net/projects/apache,Apache HTTP Server,"The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.",http://httpd.apache.org/,http://httpd.apache.org/download.cgi,30,117,1760653,C,apache_2,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",92285,,Application Data,1,0,0,5,
  apache2.2-common,apache2,2.2.22-13+deb7u3,Apache HTTP Server common files,http://httpd.apache.org/,47,https://security-tracker.debian.org/tracker/source-package/apache2,https://www.openhub.net/projects/apache,Apache HTTP Server,"The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.",http://httpd.apache.org/,http://httpd.apache.org/download.cgi,30,117,1760653,C,apache_2,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",62354,C,Application Data,1,0,0,5,
  libaprutil1,apr-util,1.4.1-3,Apache Portable Runtime Utility Library,http://apr.apache.org/,1,https://security-tracker.debian.org/tracker/source-package/apr-util,https://www.openhub.net/projects/apr,Apache Portable Runtime,"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.",http://apr.apache.org/,,14,67,419947,C,apache_2,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",125468,C,Shared Library,0,1,0,5,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  However, it's not as clear that the LDAP library in it is as actively managed. HAS Home Page, HAS Mailing List, Issue tracker https://bz.apache.org/bugzilla/enter_bug.cgi?product=APR \++"
  libgd2-noxpm,libgd2,2.0.36~rc1~dfsg-6.1,GD Graphics Library version 2 (without XPM support),http://www.libgd.org/,3,https://security-tracker.debian.org/tracker/source-package/libgd2,https://www.openhub.net/projects/libgd,GD,"GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG or GIF, among other formats. GD is commonly used to generate charts, graphics, thumbnails, and most anything else, on the fly. While not restricted to use on the web, the most common applications of GD involve web site development.",http://www.libgd.org,https://bitbucket.org/libgd/gd-libgd/downloads,6,28,52918,C,BSD-3-Clause,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Average size development team,18088,,,0,1,0,5,
  coolkey,,1.1.0-12,Smart Card PKCS #11 cryptographic module,http://directory.fedoraproject.org/wiki/CoolKey,0,https://security-tracker.debian.org/tracker/source-package/coolkey,,,,,,,,,,,,,,,112,C,,0,1,0,5,"Smart card drivers.  Not used in many environments, but critically important for security in other environments.  Activity unclear. Managed via Fedora packaging active here: https://apps.fedoraproject.org/packages/coolkey but that is not where the real code is maintained. Important for users of PKCS#11, but slightly specialized. http://pkgs.fedoraproject.org/gitweb/?p=coolkey.git http://pkg-coolkey.alioth.debian.org/ ++"
  libopencryptoki0,opencryptoki,2.3.1+dfsg-3,PKCS#11 implementation (library),http://opencryptoki.sourceforge.net/,2,https://security-tracker.debian.org/tracker/source-package/opencryptoki,,,,,,,,,,,,,,,237,,Shared Library,0,1,0,5,
  binutils-dev,binutils,2.22-8,GNU binary utilities (BFD development files),,9,https://security-tracker.debian.org/tracker/source-package/binutils,https://www.openhub.net/projects/binutils,GNU binutils,"The GNU linker and related programs and libraries: ar, as, gprof, ld, nm, ranlib, strip, libbfd.  You depend on this utterly.",http://www.gnu.org/software/binutils/,http://ftp.gnu.org/gnu/binutils/,173,569,4635179,C,gpl3,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Very large, active development team",1870,,,0,0,0,5,
  libzrtpcpp2,libzrtpcpp,2.0.0-3,ccrtp extension for zrtp/Zfone support,http://www.gnu.org/software/ccrtp/,3,https://security-tracker.debian.org/tracker/source-package/libzrtpcpp,,,,,,,,,,,,,,,839,,Shared Library,0,1,0,5,
  sendmail,,8.14.4-4,"powerful, efficient, and scalable Mail Transport Agent",http://www.sendmail.org,1,https://security-tracker.debian.org/tracker/source-package/sendmail,https://www.openhub.net/projects/4536,Sendmail,"Sendmail is a remarkably flexible program, supporting many kinds of mail transfer and delivery including the overwhelmingly popular SMTP.",http://www.sendmail.org/,http://www.sendmail.com/sm/open_source/download/,,,,,sendmail,,,,,1993,,Metapackage,1,0,0,5,"This is a widely-used mail transfer agent (MTA). Sendmail main site https://www.sendmail.com/sm/open_source/
  No public repo found.  However, they have tarball    snapshots   ; on 2015-03-13 the current snapshot was 2015-03-06. This indicates active development, but its development seems opaque so difficult to say more. Version 8.15.1 posted 2014-12-06."
  glib-networking,,2.32.3-1,network-related giomodules for GLib,,0,https://security-tracker.debian.org/tracker/source-package/glib-networking,https://www.openhub.net/projects/glib-networking,glib-networking,,http://projects.gnome.org/,,15,136,12743,C,,Stable Y-O-Y development activity,Well-established codebase,Few source code comments,"Large, active development team",88513,C,Plugin,1,0,0,5,"TLS API. Implements its own certificate verification. No support for certificate revocation. No active developers.,Implements GLib's TLS API, most notably used by libsoup (used by all GNOME applications, WebKitGTK+, etc.). It uses GnuTLS internally."
  encfs,encfs (1.7.4-2.4),1.7.4-2.4+b1,encrypted virtual filesystem,http://www.arg0.net/encfs,4,https://security-tracker.debian.org/tracker/source-package/encfs,https://www.openhub.net/projects/6347,encfs,"EncFS provides an encrypted filesystem in user-space. It runs without any special permissions and uses the FUSE library and Linux kernel module to provide the filesystem interface. You can find links to source and binary releases below. EncFS is open source software, licensed under the GPL.
  
  As with most encrypted filesystems, Encfs is meant to provide security against off-line attacks; ie your notebook or backups fall into the wrong hands, etc. The way Encfs works is different from the  loopback  encrypted filesystem support built into the Linux kernel because it works on files at a time, not an entire block device. This is a big advantage in some ways, but does not come without a cost.",https://vgough.github.io/encfs/,,9,9,9265,C++,gpl3_or_later,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",2533,C++,,0,0,0,5,
  owncloud,,,,,101,https://security-tracker.debian.org/tracker/source-package/owncloud,https://www.openhub.net/projects/owncloud,ownCloud,"ownCloud is an open-source web application for data synchronization, file sharing, and cloud storage.
  
  ownCloud provides access to your data through a web interface or WebDAV while providing a platform to view, sync and share across devices easily   all under your control. ownCloud's open architecture is extensible via a simple but powerful API for applications and plugins and works with any storage.",http://ownCloud.org,http://owncloud.org/install/,345,778,2280056,JavaScript,AGPL3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",2085,,,1,0,0,5,
  bc,bc (1.06.95-2),1.06.95-2+b1,The GNU bc arbitrary precision calculator language,,0,https://security-tracker.debian.org/tracker/source-package/bc,,,,,,,,,,,,,,,154559,,Program,0,0,0,4,Use relatively rare.  Unlikely to process data from attacker.
  cpp-4.6,gcc-4.6,4.6.3-14,GNU C preprocessor,http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.6,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",47051,,Program,0,0,0,4,
  cpp-4.7,gcc-4.7,4.7.2-5,GNU C preprocessor,http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.7,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",97309,,,0,0,0,4,
  dc,bc (1.06.95-2),1.06.95-2+b1,The GNU dc arbitrary precision reverse-polish calculator,,0,https://security-tracker.debian.org/tracker/source-package/bc,,,,,,,,,,,,,,,149809,,,0,0,0,4,Use relatively rare.  Unlikely to process data from attacker.
  discover,,2.1.2-5.2,hardware identification system,,0,https://security-tracker.debian.org/tracker/source-package/discover,,,,,,,,,,,,,,,148431,,Program,0,0,0,4,"Conceivably a local exploit opportunity, but not likely."
  gcc-4.6,,4.6.3-14,GNU C compiler,http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.6,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",46415,,Program,0,0,0,4,
  gcc-4.7,,4.7.2-5,GNU C compiler,http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.7,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",75127,,,0,0,0,4,
  gcc-4.7-base,gcc-4.7,4.7.2-5,"GCC, the GNU Compiler Collection (base package)",http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.7,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",129149,,,0,0,0,4,
  grub-pc,grub2,1.99-27+deb7u2,"GRand Unified Bootloader, version 2 (PC/BIOS version)",http://www.gnu.org/software/grub/,1,https://security-tracker.debian.org/tracker/source-package/grub2,https://www.openhub.net/projects/grub,GNU GRUB,GRUB is the GRand Unified Bootloader.,http://savannah.gnu.org/projects/grub/,,30,185,313200,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",150649,C,Need an extra tag,0,0,0,4,
  grub-pc-bin,grub2,1.99-27+deb7u2,"GRand Unified Bootloader, version 2 (PC/BIOS binaries)",http://www.gnu.org/software/grub/,1,https://security-tracker.debian.org/tracker/source-package/grub2,https://www.openhub.net/projects/grub,GNU GRUB,GRUB is the GRand Unified Bootloader.,http://savannah.gnu.org/projects/grub/,,30,185,313200,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",125796,,,0,0,0,4,
  iptables,,1.4.14-3.1,administration tools for packet filtering and NAT,http://www.netfilter.org/,1,https://security-tracker.debian.org/tracker/source-package/iptables,https://www.openhub.net/projects/iptables,iptables,iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators.,http://www.netfilter.org/projects/iptables/index.html,http://www.netfilter.org/projects/iptables/downloads.html,17,231,47935,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",169118,C,Program,0,0,0,4,
  kbd,,1.15.3-9,Linux console font and keytable utilities,,1,https://security-tracker.debian.org/tracker/source-package/kbd,https://www.openhub.net/projects/kbd,kbd,"This package contains tools for managing the Linux console (Linux console, virtual terminals on it, keyboard, etc.). Mainly, what they do is loading console fonts and keyboard maps. Also this package contains a set of various fonts and keyboard maps.",http://www.kbd-project.org,http://www.kbd-project.org/download/,8,33,56653,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",147053,,Program,0,0,0,4,
  laptop-detect,,0.13.7,attempt to detect a laptop,,0,https://security-tracker.debian.org/tracker/source-package/laptop-detect,,,,,,,,,,,,,,,162766,,,0,0,0,4,Unlikely to be a security vulnerability
  libffi5,libffi,3.0.10-3,Foreign Function Interface library runtime,,0,https://security-tracker.debian.org/tracker/source-package/libffi,https://www.openhub.net/projects/11338,libffi,"Compilers for high level languages generate code that follows certain conventions. These conventions are necessary, in part, for separate compilation to work. One such convention is the ""calling convention"". The ""calling convention"" is a set of assumptions made by the compiler about where function arguments will be found on entry to a function. A ""calling convention"" also specifies where the return value for a function is found.
  
  The libffi library provides a portable, high level programming interface to various calling conventions. This allows a programmer to call any function specified by a call interface description at run-time.",http://sourceware.org/libffi,http://sourceware.org/libffi,23,63,45983,C,BSD-3-Clause,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",117671,C,Shared Library,0,1,0,4,Development tool library. Somewhat less likely to contain vulnerabilities directly.
  libfontenc1,libfontenc,1:1.1.1-1,X11 font encoding library,,0,https://security-tracker.debian.org/tracker/source-package/libfontenc,,,,,,,,,,,,,,,123044,,Shared Library,0,0,0,4,Less likely to be a security vulnerability.
  libgc1c2,libgc,1:7.1-9.1,conservative garbage collector for C and C++,http://www.hpl.hp.com/personal/Hans_Boehm/gc/,1,https://security-tracker.debian.org/tracker/source-package/libgc,,,,,,,,,,,,,,,152400,,Shared Library,0,0,0,4,
  libgcc1,gcc-4.7 (4.7.2-5),1:4.7.2-5,GCC support library,http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.7,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169861,C,Shared Library,0,0,0,4,
  libgomp1,gcc-4.7,4.7.2-5,GCC OpenMP (GOMP) support library,http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.7,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",144800,,Shared Library,0,0,0,4,
  libgpg-error0,libgpg-error,1.10-3.1,library for common error values and messages in GnuPG components,http://www.gnupg.org/related_software/libgpg-error/,0,https://security-tracker.debian.org/tracker/source-package/libgpg-error,https://www.openhub.net/projects/libgpg-error,libgpg-error,"This is a library that defines common error values for all GnuPG components.  Among these are GPG, GPGSM, GPGME, GPG-Agent, libgcrypt, Libksba, DirMngr, Pinentry, SmartCard Daemon and more.",,,14,23,44379,shell script,lgpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169763,C,Shared Library,0,1,0,4,See GNUPG.
  libitm1,gcc-4.7,4.7.2-5,GNU Transactional Memory Library,http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.7,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",91264,,Shared Library,0,0,0,4,
  libp11-kit0,p11-kit,0.12-3,Library for loading and coordinating access to PKCS#11 modules - runtime,http://p11-glue.freedesktop.org/p11-kit.html,0,https://security-tracker.debian.org/tracker/source-package/p11-kit,https://www.openhub.net/projects/p11-kit,p11-kit,"Provides a way to load and enumerate PKCS#11 modules. Provides a standard configuration setup for installing PKCS#11 modules in such a way that they're discoverable.
  
  Also solves problems with coordinating the use of PKCS#11 by different components or libraries living in the same process.",http://p11-glue.freedesktop.org/p11-kit.html,http://p11-glue.freedesktop.org/releases/,9,26,57382,C,bsd,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,"Large, active development team",136021,C,Shared Library,0,1,0,4,"Manages security keys. Has Home page, Bug Tracker https://bugs.freedesktop.org/enter_bug.cgi?product=p11-glue, ML http://lists.freedesktop.org/archives/p11-glue/ fairly active ++"
  libpam-runtime,pam,1.1.3-7.1,Runtime support for the PAM library,http://pam.sourceforge.net/,15,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,7,20,57169,C,BSD-3-Clause gpl gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169890,,Application Data,0,1,0,4,
  libquadmath0,gcc-4.7,4.7.2-5,GCC Quad-Precision Math Library,http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.7,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",117782,,Shared Library,0,0,0,4,
  libselinux1,libselinux,2.1.9-5,SELinux runtime shared libraries,,0,https://security-tracker.debian.org/tracker/source-package/libselinux,https://www.openhub.net/projects/selinux,Security-enhanced Linux,"This is a public forum for the NSA Security-Enhanced Linux project. This is not intended to replace NSA's work or official website but rather to allow broader participation in extending and adapting SELinux for distributions.
  
  SELinux normally comes with your Linux distribution. It is unusual for an ordinary user to install it manually.
  
  The proposed logo is not the official SELinux logo.",http://userspace.selinuxproject.org/,,27,77,167185,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",169736,C,Shared Library,0,0,1,4,SELinux vital for security on systems using it (there are many).  Many of the critical parts are in the kernel.
  libsm6,libsm,2:1.2.1-2,X11 Session Management library,,0,https://security-tracker.debian.org/tracker/source-package/libsm,,,,,,,,,,,,,,,137348,,Shared Library,0,0,0,4,Just stores X11 sessions for later use.
  libstdc++6,gcc-4.7,4.7.2-5,GNU Standard C++ Library v3,http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.7,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169850,C++,Shared Library,0,0,0,4,
  libxext6,libxext,2:1.3.1-2+deb7u1,X11 miscellaneous extension library,,1,https://security-tracker.debian.org/tracker/source-package/libxext,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",166259,C,Shared Library,0,0,0,4,
  libxfixes3,libxfixes,1:5.0-4+deb7u1,X11 miscellaneous 'fixes' extension library,,1,https://security-tracker.debian.org/tracker/source-package/libxfixes,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",129236,C,Shared Library,0,0,0,4,
  libxrandr2,libxrandr,2:1.3.2-2+deb7u1,X11 RandR extension library,,1,https://security-tracker.debian.org/tracker/source-package/libxrandr,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",126775,C,Shared Library,0,0,0,4,
  ncurses-base,ncurses,5.9-10,basic terminal type definitions,http://invisible-island.net/ncurses/,0,https://security-tracker.debian.org/tracker/source-package/ncurses,https://www.openhub.net/projects/ncurses,GNU Ncurses,"The Ncurses (new curses) library is a free software emulation of curses in System V Release 4.0, and more. It uses Terminfo format, supports pads and color and multiple highlights and forms characters and function-key mapping, and has all the other SYSV-curses enhancements over BSD Curses.
  
  The ncurses code was developed under GNU/Linux. It has been in use for some time with OpenBSD as the system curses library, and on FreeBSD and NetBSD as an external package. It should port easily to any ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
  
  The distribution includes the library and support utilities, including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Full manual pages are provided for the library and tools.
  
  The Ncurses distribution is available via anonymous FTP at the GNU distribution site",http://www.gnu.org/software/ncurses/,http://ftp.gnu.org/pub/gnu/ncurses,1,2,219912,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,169894,,Application Data,0,0,0,4,
  ncurses-term,ncurses,5.9-10,additional terminal type definitions,http://invisible-island.net/ncurses/,0,https://security-tracker.debian.org/tracker/source-package/ncurses,https://www.openhub.net/projects/ncurses,GNU Ncurses,"The Ncurses (new curses) library is a free software emulation of curses in System V Release 4.0, and more. It uses Terminfo format, supports pads and color and multiple highlights and forms characters and function-key mapping, and has all the other SYSV-curses enhancements over BSD Curses.
  
  The ncurses code was developed under GNU/Linux. It has been in use for some time with OpenBSD as the system curses library, and on FreeBSD and NetBSD as an external package. It should port easily to any ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
  
  The distribution includes the library and support utilities, including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Full manual pages are provided for the library and tools.
  
  The Ncurses distribution is available via anonymous FTP at the GNU distribution site",http://www.gnu.org/software/ncurses/,http://ftp.gnu.org/pub/gnu/ncurses,1,2,219912,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,159708,,Application Data,0,0,0,4,
  perl,,5.14.2-21+deb7u2,Larry Wall's Practical Extraction and Report Language,http://dev.perl.org/perl5/,21,https://security-tracker.debian.org/tracker/source-package/perl,https://www.openhub.net/projects/perl,Perl,"Perl is a general-purpose programming language originally developed for text manipulation and now used for a wide range of tasks including system administration, web development, network programming, GUI development, and more. Its major features include support for multiple programming paradigms (procedural, object-oriented, and functional styles), automatic memory management, built-in support for text processing, and a large collection of third-party modules.",http://www.perl.org/,http://www.perl.org/get.html,87,1211,1048297,Perl,artistic GNU_General_Public_License_1_0 gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",168981,,Program,0,0,0,4,
  perl-base,perl,5.14.2-21+deb7u2,minimal Perl system,http://dev.perl.org/perl5/,21,https://security-tracker.debian.org/tracker/source-package/perl,https://www.openhub.net/projects/perl,Perl,"Perl is a general-purpose programming language originally developed for text manipulation and now used for a wide range of tasks including system administration, web development, network programming, GUI development, and more. Its major features include support for multiple programming paradigms (procedural, object-oriented, and functional styles), automatic memory management, built-in support for text processing, and a large collection of third-party modules.",http://www.perl.org/,http://www.perl.org/get.html,87,1211,1048297,Perl,artistic GNU_General_Public_License_1_0 gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",169888,,,0,0,0,4,
  perl-modules,perl,5.14.2-21+deb7u2,Core Perl modules,http://dev.perl.org/perl5/,21,https://security-tracker.debian.org/tracker/source-package/perl,https://www.openhub.net/projects/perl,Perl,"Perl is a general-purpose programming language originally developed for text manipulation and now used for a wide range of tasks including system administration, web development, network programming, GUI development, and more. Its major features include support for multiple programming paradigms (procedural, object-oriented, and functional styles), automatic memory management, built-in support for text processing, and a large collection of third-party modules.",http://www.perl.org/,http://www.perl.org/get.html,87,1211,1048297,Perl,artistic GNU_General_Public_License_1_0 gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",169000,Perl,Development Library,0,0,0,4,
  python-reportbug,reportbug,6.4.4+deb7u1,Python modules for interacting with bug tracking systems,http://alioth.debian.org/projects/reportbug/,1,https://security-tracker.debian.org/tracker/source-package/reportbug,,,,,,,,,,,,,,,143784,,Development Library,0,0,0,4,
  python2.6,,2.6.8-1.1,Interactive high-level object-oriented language (version 2.6),,26,https://security-tracker.debian.org/tracker/source-package/python2.6,https://www.openhub.net/projects/python,Python programming language,"Python is a dynamic, object-oriented programming language that can be used for many kinds of software development. It offers strong support for integration with other languages and tools, comes with extensive standard libraries, and can be learned in a few days. Many Python programmers report substantial productivity gains and feel the language encourages the development of better code.",https://www.python.org,https://www.python.org/downloads/,53,207,998525,Python,python_software_foundation,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",130412,Python,Program,0,0,0,4,
  python2.6-minimal,python2.6,2.6.8-1.1,Minimal subset of the Python language (version 2.6),,26,https://security-tracker.debian.org/tracker/source-package/python2.6,https://www.openhub.net/projects/python,Python programming language,"Python is a dynamic, object-oriented programming language that can be used for many kinds of software development. It offers strong support for integration with other languages and tools, comes with extensive standard libraries, and can be learned in a few days. Many Python programmers report substantial productivity gains and feel the language encourages the development of better code.",https://www.python.org,https://www.python.org/downloads/,53,207,998525,Python,python_software_foundation,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",132674,Python,Program,0,0,0,4,
  python2.7,,2.7.3-6+deb7u2,Interactive high-level object-oriented language (version 2.7),,24,https://security-tracker.debian.org/tracker/source-package/python2.7,https://www.openhub.net/projects/python,Python programming language,"Python is a dynamic, object-oriented programming language that can be used for many kinds of software development. It offers strong support for integration with other languages and tools, comes with extensive standard libraries, and can be learned in a few days. Many Python programmers report substantial productivity gains and feel the language encourages the development of better code.",https://www.python.org,https://www.python.org/downloads/,53,207,998525,Python,python_software_foundation,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",134195,,,0,0,0,4,
  python2.7-minimal,python2.7,2.7.3-6+deb7u2,Minimal subset of the Python language (version 2.7),,24,https://security-tracker.debian.org/tracker/source-package/python2.7,https://www.openhub.net/projects/python,Python programming language,"Python is a dynamic, object-oriented programming language that can be used for many kinds of software development. It offers strong support for integration with other languages and tools, comes with extensive standard libraries, and can be learned in a few days. Many Python programmers report substantial productivity gains and feel the language encourages the development of better code.",https://www.python.org,https://www.python.org/downloads/,53,207,998525,Python,python_software_foundation,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",134221,,Program,0,0,0,4,
  analog,,2:6.0-19.1,web server log analyzer,http://www.analog.cx/,0,https://security-tracker.debian.org/tracker/source-package/analog,https://www.openhub.net/projects/AnalogCAmie,Analog C:Amie Edition,"Analog was created by Stephen Turner in 1995 as a multi-purpose, multi-platform log file analyser. He maintained the project until 2004, at which point he ceased to update the project. In 2007, as a long-term user of Analog and in light of the release of Windows Vista that could not be identified by Analog, C:Amie has undertaken to maintain Analog and to keep its detection current.",http://camie.dyndns.org/analog/,http://camie.dyndns.org/analog/download/,,,,,,,,,,23315,,Program,1,0,0,4,"Web log analyzer, analyzes attacker-provided data.  Could conceivably be way to attack via maliciously-formatted data for logging."
  libaprutil1-dbd-sqlite3,apr-util,1.4.1-3,Apache Portable Runtime Utility Library - SQLite3 Driver,http://apr.apache.org/,1,https://security-tracker.debian.org/tracker/source-package/apr-util,https://www.openhub.net/projects/apr,Apache Portable Runtime,"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.",http://apr.apache.org/,,14,67,419947,C,apache_2,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",109117,C,Shared Library,0,0,0,4,
  ssl-cert,,1.0.32,simple debconf wrapper for OpenSSL,,0,https://security-tracker.debian.org/tracker/source-package/ssl-cert,https://www.openhub.net/projects/debconf,debconf,,,,5,23,9385,Perl,,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,135045,,Program,1,0,0,4,See OpenSSL.
  libressl,,,,,0,https://security-tracker.debian.org/tracker/source-package/libressl,https://www.openhub.net/projects/libressl,libressl,LibreSSL is a FREE version of the SSL/TLS protocol forked from OpenSSL.,http://www.libressl.org/,,30,131,311828,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",0,,,1,0,0,4,"Fork of OpenSSL. HAS Home Page, Can Download as tarball,  VERY Active on Github https://github.com/libressl-portable/portable ++"
  bootp,,2.4.3-18,server for the bootp protocol with DHCP support,ftp://ftp.ntplx.net/pub/networking/bootp/,0,https://security-tracker.debian.org/tracker/source-package/bootp,,,,,,,,,,,,,,,123,,Program,1,0,0,4,Bootp has basic seucurity issues.
  libzrtp,,,,,0,https://security-tracker.debian.org/tracker/source-package/libzrtp,,,,,,,,,,,,,,,0,,,0,1,0,4,Unclear how widely this is used.
  libgif4,giflib,4.1.6-10,library for GIF images (library),http://giflib.sourceforge.net/,0,https://security-tracker.debian.org/tracker/source-package/giflib,https://www.openhub.net/projects/giflib,giflib -- A library for processing GIFs,"A library for rendering and generating GIF image files. This is the GIF service code in C used for over two decades by graphics applications, web browsers, game consoles, ATMs, and pretty much anything else that throws pixels on a display. Simple, stable, bulletproof, and no longer parent-encumbered.",http://sourceforge.net/projects/giflib,,4,13,11892,C,BSD-3-Clause,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,107351,C,Shared Library,0,1,0,4,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Active issue tracker, Mailing list, public repo. ++"
  fail2ban,,0.8.6-3wheezy3,ban hosts that cause multiple authentication errors,http://www.fail2ban.org,4,https://security-tracker.debian.org/tracker/source-package/fail2ban,https://www.openhub.net/projects/fail2ban,fail2ban,Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.,http://www.fail2ban.org/wiki/index.php/Main_Page,http://www.fail2ban.org/wiki/index.php/Downloads,38,103,11081,Python,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",14907,,,0,1,1,4,"Used on 10% of Debian installations according to popcon thus millions of users,Monitors and parses log files and  executes commands to manipulate firewalls based on parsed logfiles (thus possibility of injection) usually runs as root"
  parted,,2.3-12,disk partition manipulator,http://www.gnu.org/software/parted,0,https://security-tracker.debian.org/tracker/source-package/parted,https://www.openhub.net/projects/gparted,GNU Parted,"GNU Parted is an industrial-strength package for creating, destroying, resizing, checking and copying partitions, and the file systems on them. This is useful for creating space for new operating systems, reorganising disk usage, copying data on hard disks and disk imaging.",http://www.gnu.org/software/parted,http://www.gnu.org/software/parted,8,75,264447,C,gpl3,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",45089,C,Program,0,0,1,4,
  bsdmainutils,,9.0.3,collection of more utilities from FreeBSD,,0,https://security-tracker.debian.org/tracker/source-package/bsdmainutils,https://www.openhub.net/projects/freebsd,FreeBSD,"FreeBSD is an advanced operating system for x86 compatible (including Pentium and Athlon), amd64 compatible (including Opteron, Athlon64, and EM64T), UltraSPARC, IA-64, PC-98, (32-bit and 64-bit) MIPS and ARM architectures. It is derived from BSD, the version of UNIX developed at the University of California, Berkeley. It is developed and maintained by a large team of individuals. Additional platforms are in various stages of development.",https://github.com/trueos/trueos,https://github.com/trueos/trueos/downloads,193,684,14595925,C,BSD-2-Clause,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169760,C,,0,0,0,3,
  cpp,gcc-defaults (1.120),4:4.7.2-1,GNU C preprocessor (cpp),,0,https://security-tracker.debian.org/tracker/source-package/gcc-defaults,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",144701,,Dummy Package,0,0,0,3,
  dash,,0.5.7-3,POSIX-compliant shell,http://gondor.apana.org.au/~herbert/dash/,0,https://security-tracker.debian.org/tracker/source-package/dash,https://www.openhub.net/projects/dash,DASH,DASH is a POSIX-compliant implementation of /bin/sh that aims to be as small as possible.,http://gondor.apana.org.au/~herbert/dash/,http://gondor.apana.org.au/~herbert/dash/files/,9,39,13391,C,bsd,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",162278,C,Program,0,0,0,3,
  debian-faq,,5.0.1,Debian FAQ,http://www.debian.org/doc/user-manuals#faq,0,https://security-tracker.debian.org/tracker/source-package/debian-faq,,,,,,,,,,,,,,,140561,,,0,0,0,3,
  dictionaries-common,,1.12.11,Common utilities for spelling dictionary tools,http://dict-common.alioth.debian.org,0,https://security-tracker.debian.org/tracker/source-package/dictionaries-common,https://www.openhub.net/projects/dict-common,dictionaries-common for Debian,dictionaries-common is a package for the Debian system intended to provide the infrastructure and automatic configuration for spelling tools and dictionaries packages.  It also provides a Policy for those matters.,http://sourceforge.net/projects/dict-common,,,,,,,,,,,150192,Lisp,Plugin,0,0,0,3,
  findutils,,4.4.2-4,"utilities for finding files--find, xargs",http://savannah.gnu.org/projects/findutils/,0,https://security-tracker.debian.org/tracker/source-package/findutils,https://www.openhub.net/projects/findutils,GNU findutils,"GNU findutils includes find, xargs, locate and updatedb.  These tools proivide ways to search for files on your system by specifying what kind of file you're looking for.",http://savannah.gnu.org/projects/findutils/,,7,30,18425,C,gpl3_or_later,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169896,C,,0,0,0,3,
  gcc,gcc-defaults (1.120),4:4.7.2-1,GNU C compiler,,0,https://security-tracker.debian.org/tracker/source-package/gcc-defaults,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",114682,,Program,0,0,0,3,
  gettext-base,gettext,0.18.1.1-9,GNU Internationalization utilities for the base system,http://www.gnu.org/software/gettext/,0,https://security-tracker.debian.org/tracker/source-package/gettext,https://www.openhub.net/projects/gettext,gettext,gettext is the GNU internationalization (i18n) library. It is commonly used for writing multilingual programs.,http://savannah.gnu.org/projects/gettext/,http://ftp.gnu.org/gnu/gettext,16,45,359627,C,gpl gpl3_or_later lgpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",168276,,,0,0,0,3,
  groff-base,groff,1.21-9,GNU troff text-formatting system (base system components),http://groff.ffii.org/,0,https://security-tracker.debian.org/tracker/source-package/groff,https://www.openhub.net/projects/groff,GNU troff,The groff (GNU Troff) software is a typesetting package which reads plain text mixed with formatting commands and produces formatted output. Groff now supports HTML.,http://www.gnu.org/software/groff/,http://www.gnu.org/software/groff/#downloading,20,33,137684,C++,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",169753,C++,,0,0,0,3,
  info,texinfo,4.13a.dfsg.1-10,Standalone GNU Info documentation browser,,0,https://security-tracker.debian.org/tracker/source-package/texinfo,https://www.openhub.net/projects/texinfo,Texinfo,"Texinfo is the official documentation format of the GNU project. It was invented by Richard Stallman and Bob Chassell many years ago, loosely based on Brian Reid's Scribe and other formatting languages of the time. It is used by many non-GNU projects as well.
  
  Texinfo uses a single source file to produce output in a number of formats, both online and printed (dvi, html, info, pdf, xml, etc.). This means that instead of writing different documents for online information and another for a printed manual, you need write only one document. And when the work is revised, you need revise only that one document. The Texinfo system is well-integrated with GNU Emacs.",http://www.gnu.org/software/texinfo/,http://ftp.gnu.org/gnu/texinfo/,5,20,1549927,Perl,gpl3,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Average size development team,168149,C,Program,0,0,0,3,
  ispell,,3.3.02-6,International Ispell (an interactive spelling corrector),http://www.lasr.cs.ucla.edu/geoff/ispell.html,0,https://security-tracker.debian.org/tracker/source-package/ispell,,,,,,,,,,,,,,,132017,,Program,0,0,0,3,
  kmod,,9-3,tools for managing Linux kernel modules,,0,https://security-tracker.debian.org/tracker/source-package/kmod,https://www.openhub.net/projects/kmod,kmod,"Library and programs to manage Linux Kernel Modules.
  
  This project consists of a library (libkmod) that does the same work as traditional module-init-tools (m-i-t) but is easily usable by other programs that may need to check or load kernel modules, such as udev, systemd, iptables, ...
  
  The provided programs try to mimic m-i-t equivalents 1-to-1 and could be used as drop-in replacements in most cases.",http://git.profusion.mobi/cgit.cgi/kmod.git/,http://git.profusion.mobi/cgit.cgi/kmod.git/,15,60,17607,C,lgpl21_or_later,Increasing Y-O-Y development activity,Well-established codebase,Average number of code comments,"Large, active development team",134927,,,0,0,0,3,
  libasprintf0c2,gettext,0.18.1.1-9,GNU library to use fprintf and friends in C++,http://www.gnu.org/software/gettext/,0,https://security-tracker.debian.org/tracker/source-package/gettext,https://www.openhub.net/projects/gettext,gettext,gettext is the GNU internationalization (i18n) library. It is commonly used for writing multilingual programs.,http://savannah.gnu.org/projects/gettext/,http://ftp.gnu.org/gnu/gettext,16,45,359627,C,gpl gpl3_or_later lgpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",134644,,Shared Library,0,0,0,3,
  libclass-isa-perl,,0.36-3,report the search path for a class's ISA tree,http://search.cpan.org/dist/Class-ISA/,0,https://security-tracker.debian.org/tracker/source-package/libclass-isa-perl,,,,,,,,,,,,,,,130329,Perl,,0,0,0,3,
  libdrm-intel1,libdrm,2.4.40-1~deb7u2,Userspace interface to intel-specific kernel DRM services -- runtime,,0,https://security-tracker.debian.org/tracker/source-package/libdrm,https://www.openhub.net/projects/libdrm,libdrm,libdrm provides core library routines for the X Window System to directly interface with video hardware using the Linux kernel's Direct Rendering Manager (DRM).,http://www.mesa3d.org/,http://cgit.freedesktop.org/mesa/drm/,50,206,37930,C,mit,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",111209,,Shared Library,0,0,0,3,
  libdrm-nouveau1a,libdrm,2.4.40-1~deb7u2,Userspace interface to nouveau-specific kernel DRM services -- runtime,,0,https://security-tracker.debian.org/tracker/source-package/libdrm,https://www.openhub.net/projects/libdrm,libdrm,libdrm provides core library routines for the X Window System to directly interface with video hardware using the Linux kernel's Direct Rendering Manager (DRM).,http://www.mesa3d.org/,http://cgit.freedesktop.org/mesa/drm/,50,206,37930,C,mit,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",75210,,Shared Library,0,0,0,3,
  libdrm-radeon1,libdrm,2.4.40-1~deb7u2,Userspace interface to radeon-specific kernel DRM services -- runtime,,0,https://security-tracker.debian.org/tracker/source-package/libdrm,https://www.openhub.net/projects/libdrm,libdrm,libdrm provides core library routines for the X Window System to directly interface with video hardware using the Linux kernel's Direct Rendering Manager (DRM).,http://www.mesa3d.org/,http://cgit.freedesktop.org/mesa/drm/,50,206,37930,C,mit,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",112222,,Shared Library,0,0,0,3,
  libdrm2,libdrm,2.4.40-1~deb7u2,Userspace interface to kernel DRM services -- runtime,,0,https://security-tracker.debian.org/tracker/source-package/libdrm,https://www.openhub.net/projects/libdrm,libdrm,libdrm provides core library routines for the X Window System to directly interface with video hardware using the Linux kernel's Direct Rendering Manager (DRM).,http://www.mesa3d.org/,http://cgit.freedesktop.org/mesa/drm/,50,206,37930,C,mit,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",117939,C,Shared Library,0,0,0,3,
  libkmod2,kmod,9-3,libkmod shared library,,0,https://security-tracker.debian.org/tracker/source-package/kmod,https://www.openhub.net/projects/kmod,kmod,"Library and programs to manage Linux Kernel Modules.
  
  This project consists of a library (libkmod) that does the same work as traditional module-init-tools (m-i-t) but is easily usable by other programs that may need to check or load kernel modules, such as udev, systemd, iptables, ...
  
  The provided programs try to mimic m-i-t equivalents 1-to-1 and could be used as drop-in replacements in most cases.",http://git.profusion.mobi/cgit.cgi/kmod.git/,http://git.profusion.mobi/cgit.cgi/kmod.git/,15,60,17607,C,lgpl21_or_later,Increasing Y-O-Y development activity,Well-established codebase,Average number of code comments,"Large, active development team",134973,,Shared Library,0,0,0,3,
  libmpc2,mpclib,0.9-4,multiple precision complex floating-point library,http://www.multiprecision.org/mpc/,0,https://security-tracker.debian.org/tracker/source-package/mpclib,,,,,,,,,,,,,,,94814,,Shared Library,0,0,0,3,
  libpci3,pciutils,1:3.1.9-6,Linux PCI Utilities (shared library),http://atrey.karlin.mff.cuni.cz/~mj/pciutils.shtml,0,https://security-tracker.debian.org/tracker/source-package/pciutils,https://www.openhub.net/projects/pciutils,pciutils,"PCI utilities for many *nix systems and hopefully even Windows: lspci and setpci, for now.",http://mj.ucw.cz/pciutils.shtml,,7,36,10999,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",166617,,Shared Library,0,0,0,3,
  libpth20,pth,2.0.7-16,The GNU Portable Threads,http://www.gnu.org/software/pth/,0,https://security-tracker.debian.org/tracker/source-package/pth,,,,,,,,,,,,,,,149010,,Shared Library,0,0,0,3,
  libsemanage-common,libsemanage,2.1.6-6,Common files for SELinux policy management libraries,http://userspace.selinuxproject.org/,0,https://security-tracker.debian.org/tracker/source-package/libsemanage,https://www.openhub.net/projects/libsemanage,libsemanage,An interface for SELinux management,https://github.com/pld-linux/libsemanage,,1,9,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Only a single active developer,136084,,Application Data,0,0,1,3,
  libsepol1,libsepol,2.1.4-3,SELinux library for manipulating binary security policies,http://userspace.selinuxproject.org/,0,https://security-tracker.debian.org/tracker/source-package/libsepol,https://www.openhub.net/projects/serefpolicy,SELinux reference policy,SELinux reference policy,http://oss.tresys.com/projects/refpolicy,http://oss.tresys.com/projects/refpolicy/wiki/DownloadRelease,6,41,8552,Python,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,169724,C,Shared Library,0,0,0,3,
  libsigc++-2.0-0c2a,libsigc++-2.0,2.2.10-0.2,type-safe Signal Framework for C++ - runtime,,0,https://security-tracker.debian.org/tracker/source-package/libsigc++-2.0,https://www.openhub.net/projects/libsigc,libsigc++,"libsigc++ implements a typesafe callback system for standard C++. It allows you to define signals and to connect those signals to any callback function, either global or a member function, regardless of whether it is static or virtual.",http://libsigc.sourceforge.net/,http://libsigc.sourceforge.net/stable.shtml,5,33,24107,C++,lgpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,169415,C++,Shared Library,0,0,0,3,
  libswitch-perl,,2.16-2,switch statement for Perl,http://search.cpan.org/dist/Switch/,0,https://security-tracker.debian.org/tracker/source-package/libswitch-perl,,,,,,,,,,,,,,,130600,Perl,,0,0,0,3,
  libtext-charwidth-perl,libtext-charwidth-perl (0.04-7),0.04-7+b1,get display widths of characters on the terminal,http://search.cpan.org/search?module=Text::CharWidth,0,https://security-tracker.debian.org/tracker/source-package/libtext-charwidth-perl,,,,,,,,,,,,,,,169515,Perl,,0,0,0,3,
  libtext-iconv-perl,,1.7-5,converts between character sets in Perl,http://search.cpan.org/search?module=Text::Iconv,0,https://security-tracker.debian.org/tracker/source-package/libtext-iconv-perl,,,,,,,,,,,,,,,169749,,,0,0,0,3,
  libtext-wrapi18n-perl,,0.06-7,internationalized substitute of Text::Wrap,http://search.cpan.org/search?module=Text::WrapI18N,0,https://security-tracker.debian.org/tracker/source-package/libtext-wrapi18n-perl,,,,,,,,,,,,,,,169513,Perl,,0,0,0,3,
  libtokyocabinet9,tokyocabinet,1.4.47-2,Tokyo Cabinet Database Libraries [runtime],http://fallabs.com/tokyocabinet/,0,https://security-tracker.debian.org/tracker/source-package/tokyocabinet,https://www.openhub.net/projects/tokyocabinet,Tokyo Cabinet,"Tokyo Cabinet is the successor of QDBM, a high performance database library similar to the DBM family. It also supports hash and B-tree databases and does not require any server process. The overall speed is improved compared to QDBM.",http://fallabs.com/tokyocabinet/,,,,,,,,,,,120495,,Shared Library,0,0,0,3,
  libusb-0.1-4,libusb,2:0.1.12-20+nmu1,userspace USB programming library,http://www.linux-usb.org/,0,https://security-tracker.debian.org/tracker/source-package/libusb,https://www.openhub.net/projects/libusb,libusb,libusb aims at creating a library for use by user level applications to access USB devices regardless of OS,http://libusb.sourceforge.net/,http://libusb.sourceforge.net/download.html#stable,13,94,35845,C,lgpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",169878,C,Shared Library,0,0,0,3,
  libxapian22,xapian-core,1.2.12-2,Search engine library,http://xapian.org/,0,https://security-tracker.debian.org/tracker/source-package/xapian-core,https://www.openhub.net/projects/xapian,Xapian,"Xapian is an Open Source Search Engine Library, released under the GPL. It's written in C++, with bindings to allow use from Perl, Python, PHP, Java, Tcl, C#, Ruby, Lua and Erlang (so far!)
  
  Xapian is a highly adaptable toolkit which allows developers to easily add advanced indexing and search facilities to their own applications. It supports the Probabilistic Information Retrieval model and also supports a rich set of boolean query operators.",http://xapian.org/,http://xapian.org/download,6,28,124435,C++,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,160580,,,0,0,0,3,
  libxaw7,libxaw,2:1.0.10-2,X11 Athena Widget library,,0,https://security-tracker.debian.org/tracker/source-package/libxaw,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",122482,C,Shared Library,0,0,0,3,
  libxcomposite1,libxcomposite,1:0.4.3-2,X11 Composite extension library,,0,https://security-tracker.debian.org/tracker/source-package/libxcomposite,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",125366,C,Shared Library,0,0,0,3,
  libxdamage1,libxdamage,1:1.1.3-2,X11 damaged region extension library,,0,https://security-tracker.debian.org/tracker/source-package/libxdamage,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",127964,,Shared Library,0,0,0,3,
  libxdmcp6,libxdmcp,1:1.1.1-1,X11 Display Manager Control Protocol library,,0,https://security-tracker.debian.org/tracker/source-package/libxdmcp,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",167520,C,,0,0,0,3,
  libxkbfile1,libxkbfile,1:1.0.8-1,X11 keyboard file manipulation library,,0,https://security-tracker.debian.org/tracker/source-package/libxkbfile,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",103569,C,,0,0,0,3,
  libxmu6,libxmu,2:1.1.1-1,X11 miscellaneous utility library,,0,https://security-tracker.debian.org/tracker/source-package/libxmu,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",123786,,Shared Library,0,0,0,3,
  libxmuu1,libxmu,2:1.1.1-1,X11 miscellaneous micro-utility library,,0,https://security-tracker.debian.org/tracker/source-package/libxmu,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",161810,C,Shared Library,0,0,0,3,
  libxpm4,libxpm,1:3.5.10-1,X11 pixmap library,,0,https://security-tracker.debian.org/tracker/source-package/libxpm,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",141162,C,Shared Library,0,0,0,3,
  linux-image-amd64,linux-latest (46),3.2+46,Linux for 64-bit PCs (meta-package),,0,https://security-tracker.debian.org/tracker/source-package/linux-latest,https://www.openhub.net/projects/linux,Linux Kernel,"Linux is a free software kernel, which combined with the GNU libraries, core utils and shell form the GNU/Linux operating system.
  
  !!!PLEASE!!! DO NOT REMOVE git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git enlistment. It contains historical pre-2.6.12 commit data.",http://kernel.org/,,3714,14514,18036029,C,GNU_General_Public_License_v2_0_only,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",89892,,,0,0,0,3,
  linux-kbuild-3.2,linux-tools,3.2.17-1,Kbuild infrastructure for Linux 3.2,,0,https://security-tracker.debian.org/tracker/source-package/linux-tools,https://www.openhub.net/projects/linux,Linux Kernel,"Linux is a free software kernel, which combined with the GNU libraries, core utils and shell form the GNU/Linux operating system.
  
  !!!PLEASE!!! DO NOT REMOVE git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git enlistment. It contains historical pre-2.6.12 commit data.",http://kernel.org/,,3714,14514,18036029,C,GNU_General_Public_License_v2_0_only,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",37651,C,,0,0,0,3,
  lsb-base,lsb,4.1+Debian8+deb7u1,Linux Standard Base 4.1 init script functionality,http://www.linuxfoundation.org/collaborate/workgroups/lsb,0,https://security-tracker.debian.org/tracker/source-package/lsb,https://www.openhub.net/projects/lsb,Linux Standard Base,"The Linux Standard Base was created to lower the overall costs of supporting the Linux platform. LSB identifies and specifies the behavior of common functionality across distributions; distributions are then encouraged to stay compatible with that common base. By reducing the differences between individual Linux distributions, the LSB greatly reduces the costs involved with porting applications to different distributions, as well as lowering the cost and effort involved in after-market support of those applications.",http://www.linuxbase.org,https://www.linuxfoundation.org/collaborate/workgroups/lsb/download,6,61,4888477,C,Artistic_License_2_0 BSD-3-Clause GNU_Free_Documentation_License gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Average size development team,169871,"sh, bash, ksh, tcsh and other shells",Need an extra tag,0,0,0,3,
  lsb-release,lsb,4.1+Debian8+deb7u1,Linux Standard Base version reporting utility,http://www.linuxfoundation.org/collaborate/workgroups/lsb,0,https://security-tracker.debian.org/tracker/source-package/lsb,https://www.openhub.net/projects/lsb,Linux Standard Base,"The Linux Standard Base was created to lower the overall costs of supporting the Linux platform. LSB identifies and specifies the behavior of common functionality across distributions; distributions are then encouraged to stay compatible with that common base. By reducing the differences between individual Linux distributions, the LSB greatly reduces the costs involved with porting applications to different distributions, as well as lowering the cost and effort involved in after-market support of those applications.",http://www.linuxbase.org,https://www.linuxfoundation.org/collaborate/workgroups/lsb/download,6,61,4888477,C,Artistic_License_2_0 BSD-3-Clause GNU_Free_Documentation_License gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Average size development team,154210,Python,,0,0,0,3,
  make,make-dfsg,3.81-8.2,An utility for Directing compilation.,http://www.gnu.org/software/make/,0,https://security-tracker.debian.org/tracker/source-package/make-dfsg,https://www.openhub.net/projects/make,GNU Make,Make is a tool which controls the generation of executables and other non-source files of a program from the program's source files.,http://www.gnu.org/software/make/,,10,48,37738,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",109292,C,,0,0,0,3,
  man-db,,2.6.2-1,on-line manual pager,http://man-db.nongnu.org/,0,https://security-tracker.debian.org/tracker/source-package/man-db,https://www.openhub.net/projects/man-db,"man-db, the on-line manual database","man-db is an implementation of the standard Unix documentation system accessed using the man command. It is used by several popular GNU/Linux distributions, including Debian, Fedora, SuSE and Ubuntu.",http://man-db.nongnu.org/,http://savannah.nongnu.org/files/?group=man-db,8,40,188734,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",168908,C,,0,0,0,3,
  module-init-tools,kmod,9-3,transitional dummy package (module-init-tools to kmod),,0,https://security-tracker.debian.org/tracker/source-package/kmod,https://www.openhub.net/projects/kmod,kmod,"Library and programs to manage Linux Kernel Modules.
  
  This project consists of a library (libkmod) that does the same work as traditional module-init-tools (m-i-t) but is easily usable by other programs that may need to check or load kernel modules, such as udev, systemd, iptables, ...
  
  The provided programs try to mimic m-i-t equivalents 1-to-1 and could be used as drop-in replacements in most cases.",http://git.profusion.mobi/cgit.cgi/kmod.git/,http://git.profusion.mobi/cgit.cgi/kmod.git/,15,60,17607,C,lgpl21_or_later,Increasing Y-O-Y development activity,Well-established codebase,Average number of code comments,"Large, active development team",157383,C,,0,0,0,3,
  netbase,,5.0,Basic TCP/IP networking system,,0,https://security-tracker.debian.org/tracker/source-package/netbase,,,,,,,,,,,,,,,169861,,Application Data,1,0,0,3,
  pciutils,,1:3.1.9-6,Linux PCI Utilities,http://atrey.karlin.mff.cuni.cz/~mj/pciutils.shtml,0,https://security-tracker.debian.org/tracker/source-package/pciutils,https://www.openhub.net/projects/pciutils,pciutils,"PCI utilities for many *nix systems and hopefully even Windows: lspci and setpci, for now.",http://mj.ucw.cz/pciutils.shtml,,7,36,10999,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",168202,,Program,0,0,0,3,
  python-apt,,0.8.8.2,Python interface to libapt-pkg,,0,https://security-tracker.debian.org/tracker/source-package/python-apt,https://www.openhub.net/projects/python-apt,python-apt,"python-apt provides Python bindings for libapt, the backend to Debian's Advanced Package Tool.",http://sourceforge.net/projects/python-apt,,6,37,15852,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Average size development team,152644,,,0,0,0,3,
  python-apt-common,python-apt,0.8.8.2,Python interface to libapt-pkg (locales),,0,https://security-tracker.debian.org/tracker/source-package/python-apt,https://www.openhub.net/projects/python-apt,python-apt,"python-apt provides Python bindings for libapt, the backend to Debian's Advanced Package Tool.",http://sourceforge.net/projects/python-apt,,6,37,15852,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Average size development team,150527,,,0,0,0,3,
  python-fpconst,fpconst,0.7.2-5,Utilities for handling IEEE 754 floating point special values,http://pypi.python.org/pypi/fpconst,0,https://security-tracker.debian.org/tracker/source-package/fpconst,,,,,,,,,,,,,,,102827,,,0,0,0,3,
  sed,,4.2.1-10,The GNU sed stream editor,http://www.gnu.org/software/sed/,0,https://security-tracker.debian.org/tracker/source-package/sed,https://www.openhub.net/projects/sed,GNU sed,"Sed (streams editor) isn't really a true text editor or text processor. Instead, it is used to filter text, i.e., it takes text input and performs some operation (or set of operations) on it and outputs the modified text. 
  
  Sed is typically used for extracting part of a file using pattern matching or substituting multiple occurrences of a string within a file.",http://savannah.gnu.org/projects/sed/,,4,16,23676,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,169899,C,,0,0,0,3,
  sensible-utils,,0.0.7,Utilities for sensible alternative selection,,0,https://security-tracker.debian.org/tracker/source-package/sensible-utils,https://www.openhub.net/projects/debianutils,debianutils,"Miscellaneous utilities specific to Debian
  
  This package provides a number of small utilities which are used primarily by the installation scripts of Debian packages, although you may use them directly.
  
  The specific utilities included are: installkernel mkboot run-parts savelog sensible-browser sensible-editor sensible-pager tempfile which.",http://packages.debian.org/debianutils,http://packages.debian.org/debianutils,,,,,,,,,,161567,,Need an extra tag,0,0,0,3,
  task-ssh-server,tasksel,3.14.1,SSH server,,0,https://security-tracker.debian.org/tracker/source-package/tasksel,https://www.openhub.net/projects/tasksel,tasksel,"Tool for selecting tasks for installation on Debian system.
  
  tasksel is a simple interface for users who want to pick general tasks for installation on their Debian GNU/Linux system. This program is used during the installation process, but users can also use tasksel at any point.",https://launchpad.net/tasksel,,9,134,2064,Perl,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",61627,,Program,1,0,0,3,
  usbutils,,1:005-3,Linux USB utilities,,0,https://security-tracker.debian.org/tracker/source-package/usbutils,https://www.openhub.net/projects/usbutils,usbutils,USB utilities for Linux,https://github.com/gregkh/usbutils,http://www.kernel.org/pub/linux/utils/usb/usbutils/,7,43,7130,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,"Large, active development team",150846,C,,0,0,0,3,
  util-linux-locales,util-linux,2.20.1-5.3,Locales files for util-linux,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",89412,,Application Data,0,0,0,3,
  x11-xkb-utils,,7.7~1,X11 XKB utilities,,0,https://security-tracker.debian.org/tracker/source-package/x11-xkb-utils,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",102224,C,,0,0,0,3,
  xfonts-utils,,1:7.7~1,X Window System font utility programs,,0,https://security-tracker.debian.org/tracker/source-package/xfonts-utils,https://www.openhub.net/projects/xfonts,Linux Font Project,Developing console fonts and fixed- and variable-width fonts for X (and porting some of them to Windows). The purpose is to make new fonts to enrich the very poor selection of fonts available in both console and X and improve the existing ones.,http://sourceforge.net/projects/xfonts/,,,,,,,,,,,116591,,Program,0,0,0,3,
  xkb-data,xkeyboard-config,2.5.1-3,X Keyboard Extension (XKB) configuration data,http://www.freedesktop.org/Software/XKeyboardConfig,0,https://security-tracker.debian.org/tracker/source-package/xkeyboard-config,https://www.openhub.net/projects/xkeyboard-config,xkeyboard-config,"The non-arch keyboard configuration database for X Window. The goal is to provide the consistent, well-structured, frequently released open source of X keyboard configuration data for X Window System implementations (free, open source and commercial). The project is targeted to XKB-based systems.",http://freedesktop.org/wiki/Software/XKeyboardConfig,http://freedesktop.org/wiki/Software/XKeyboardConfig#line-26,14,94,9579,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",156161,,,0,0,0,3,
  cryptsetup,,2:1.4.3-4,disk encryption support - startup scripts,http://code.google.com/p/cryptsetup/,0,https://security-tracker.debian.org/tracker/source-package/cryptsetup,https://www.openhub.net/projects/cryptsetup,cryptsetup/LUKS,"Cryptsetup is utility used to conveniently setup disk encryption based on dm-crypt kernel module.
  
  These include plain dm-crypt volumes, LUKS volumes, loop-AES and TrueCrypt (including VeraCrypt extension) format.
  
  Project also includes veritysetup utility used to conveniently setup dm-verity block integrity checking kernel module.",https://gitlab.com/cryptsetup/cryptsetup/wikis/home,https://www.kernel.org/pub/linux/utils/cryptsetup/,7,16,19270,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",10908,,Program,0,0,1,3,"This is used to set up disk encryption (at rest), e.g., Linux Unified Key Setup (LUKS).  Home page http://code.google.com/p/cryptsetup , uses git. Tracker in active use.  Latest version 1.6.6 released 2014-08-16.  Development ongoing; 8 commits in February 2015. ++"
  mercurial,,2.2.2-3,"easy-to-use, scalable distributed version control system",http://mercurial.selenic.com/,3,https://security-tracker.debian.org/tracker/source-package/mercurial,https://www.openhub.net/projects/mercurial,Mercurial,"Mercurial is a fast, lightweight Source Control Management system designed for efficient handling of very large distributed projects.",http://mercurial.selenic.com/,http://mercurial.selenic.com/wiki/Download,73,588,260298,Perl,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,"Very large, active development team",12750,,,0,1,0,3,
  base-files,,7.1wheezy7,Debian base system miscellaneous files,,1,https://security-tracker.debian.org/tracker/source-package/base-files,,,,,,,,,,,,,,,169874,,Application Data,0,0,0,2,
  ca-certificates,,20130119+deb7u1,Common CA certificates,,0,https://security-tracker.debian.org/tracker/source-package/ca-certificates,,,,,,,,,,,,,,,163805,,Application Data,0,1,0,2,
  console-setup,,1.88,console font and keymap setup program,,0,https://security-tracker.debian.org/tracker/source-package/console-setup,https://www.openhub.net/projects/console-setup,console-setup,"console-setup provides the Linux console with the same versatile keyboard configuration that the X Window System uses. As a result there is no need to duplicate or change the keyboard files just to make simple customisations such as the use of dead keys, the key functioning as AltGr or Compose key, the key(s) to switch between Latin and non-Latin mode, etc.",,,5,26,27283,Perl,gpl Public_domain_,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Average size development team,149977,,Program,0,0,0,2,
  console-setup-linux,console-setup,1.88,Linux specific part of console-setup,,0,https://security-tracker.debian.org/tracker/source-package/console-setup,https://www.openhub.net/projects/console-setup,console-setup,"console-setup provides the Linux console with the same versatile keyboard configuration that the X Window System uses. As a result there is no need to duplicate or change the keyboard files just to make simple customisations such as the use of dead keys, the key functioning as AltGr or Compose key, the key(s) to switch between Latin and non-Latin mode, etc.",,,5,26,27283,Perl,gpl Public_domain_,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Average size development team,128195,,,0,0,0,2,
  debconf,,1.5.49,Debian configuration management system,,0,https://security-tracker.debian.org/tracker/source-package/debconf,https://www.openhub.net/projects/debconf,debconf,,,,5,23,9385,Perl,,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,169892,Perl,Program,0,0,0,2,
  dkms,,2.2.0.3-1.2,Dynamic Kernel Module Support Framework,http://linux.dell.com/dkms,0,https://security-tracker.debian.org/tracker/source-package/dkms,https://www.openhub.net/projects/dkms-framework,DKMS (Dynamic Kernel Module Support),DKMS stands for Dynamic Kernel Module Support. It is designed to create a framework where kernel dependent module source can reside so that it is very easy to rebuild modules as you upgrade kernels. This will allow Linux vendors to provide driver drops without having to wait for new kernel releases while also taking out the guesswork for customers attempting to recompile modules for new kernels.,http://linux.dell.com/dkms/,http://linux.dell.com/dkms/,8,24,4225,shell script,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",41422,,,0,0,1,2,
  geoip-database,,20130213-1,IP lookup command line tools that use the GeoIP library (country database),http://www.maxmind.com/,0,https://security-tracker.debian.org/tracker/source-package/geoip-database,https://www.openhub.net/projects/geoipdb,GeoIP DB,The GeoIP Database project facilitates dynamic geolocation for web-based applications.,http://sourceforge.net/projects/geoipdb,,,,,,,,,,,148101,,Application Data,1,0,0,2,
  initramfs-tools,,0.109.1,generic modular initramfs generator,,0,https://security-tracker.debian.org/tracker/source-package/initramfs-tools,https://www.openhub.net/projects/initramfs-tools,initramfs-tools,"initramfs-tools generates an initramfs for 2.6 kernel. The mounting of the real root file system occurs in early user space. klibc provides utilities to setup root. Having the root on MD, LVM2,  LUKS or NFS is also supported.",,http://packages.debian.org/unstable/utils/initramfs-tools,6,78,1936,shell script,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,168076,,,0,0,0,2,
  iso-codes,,3.41-1,"ISO language, territory, currency, script codes and their translations",http://pkg-isocodes.alioth.debian.org/,0,https://security-tracker.debian.org/tracker/source-package/iso-codes,https://www.openhub.net/projects/iso-codes,iso-codes,"This package provides the ISO-639 Language code list, the ISO-4217 currency list, the ISO-3166 Territory code list, and ISO-3166-2 sub-territory lists.
  It also (more importantly) provides their translations in .po form.",http://pkg-isocodes.alioth.debian.org/,http://pkg-isocodes.alioth.debian.org/,3,67,121687,shell script,lgpl,,,,,151137,,Standalone Data,0,0,0,2,
  keyboard-configuration,console-setup,1.88,system-wide keyboard preferences,,0,https://security-tracker.debian.org/tracker/source-package/console-setup,https://www.openhub.net/projects/console-setup,console-setup,"console-setup provides the Linux console with the same versatile keyboard configuration that the X Window System uses. As a result there is no need to duplicate or change the keyboard files just to make simple customisations such as the use of dead keys, the key functioning as AltGr or Compose key, the key(s) to switch between Latin and non-Latin mode, etc.",,,5,26,27283,Perl,gpl Public_domain_,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Average size development team,153077,,Program,0,0,0,2,
  linux-headers-amd64,linux-latest (46),3.2+46,Header files for Linux amd64 configuration (meta-package),,0,https://security-tracker.debian.org/tracker/source-package/linux-latest,https://www.openhub.net/projects/linux,Linux Kernel,"Linux is a free software kernel, which combined with the GNU libraries, core utils and shell form the GNU/Linux operating system.
  
  !!!PLEASE!!! DO NOT REMOVE git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git enlistment. It contains historical pre-2.6.12 commit data.",http://kernel.org/,,3714,14514,18036029,C,GNU_General_Public_License_v2_0_only,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",29700,,Development Library,0,0,0,2,
  os-prober,,1.58,utility to detect other OSes on a set of drives,,0,https://security-tracker.debian.org/tracker/source-package/os-prober,https://www.openhub.net/projects/os-prober,os-prober,,,,4,19,1740,shell script,,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Average size development team,151179,"sh, bash, ksh, tcsh and other shells",,0,0,0,2,
  python-debian,,0.1.21,Python modules to work with Debian-related data formats,,0,https://security-tracker.debian.org/tracker/source-package/python-debian,https://www.openhub.net/projects/python-debian,python-debian,,,,5,14,5752,Python,,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,135543,,Development Library,0,0,0,2,
  readline-common,readline6,6.2+dfsg-0.1,"GNU readline and history libraries, common files",,1,https://security-tracker.debian.org/tracker/source-package/readline6,,,,,,,,,,,,,,,169846,,Application Data,0,0,0,2,
  virt-manager,,0.9.1-4,desktop application for managing virtual machines,http://virt-manager.et.redhat.com/,0,https://security-tracker.debian.org/tracker/source-package/virt-manager,https://www.openhub.net/projects/virt-manager,virt-manager,"The ""Virtual Machine Manager"" application (virt-manager for short package name) is a desktop user interface for managing virtual machines. It presents a summary view of running domains and their live performance & resource utilization statistics. A detailed view presents graphs showing performance & utilization over time. Ultimately it will allow creation of new domains, and configuration & adjustment of a domain's resource allocation & virtual hardware. Finally an embedded VNC client viewer presents a full graphical console to the guest domain.
  
  The virt-install, virt-clone, and virt-xml command line tools are also developed as part of virt-manager",http://virt-manager.org,http://virt-manager.org/download.html,25,130,78458,Python,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",4771,,Program,1,0,0,2,
  bash-completion,,1:2.0-1,programmable completion for the bash shell,http://bash-completion.alioth.debian.org,0,https://security-tracker.debian.org/tracker/source-package/bash-completion,https://www.openhub.net/projects/bash-completion,bash-completion,"bash_completion extends bashs standard completion behavior to achieve complex command lines with just a few keystrokes.  This project was conceived to produce programmable completion routines for the most common Linux/UNIX commands, reducing the amount of typing sysadmins and programmers need to do on a daily basis.",http://bash-completion.alioth.debian.org,,8,68,9954,shell script,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",152762,"sh, bash, ksh, tcsh and other shells",Plugin,0,0,0,1,
  debian-archive-keyring,,2014.1~deb7u1,GnuPG archive keys of the Debian archive,,0,https://security-tracker.debian.org/tracker/source-package/debian-archive-keyring,,,,,,,,,,,,,,,169680,,Standalone Data,0,0,0,1,
  discover-data,,2.2010.10.18,Data lists for Discover hardware detection system,,0,https://security-tracker.debian.org/tracker/source-package/discover-data,,,,,,,,,,,,,,,148530,,Application Data,0,0,0,1,
  gcc-4.6-base,gcc-4.6,4.6.3-14,"GCC, the GNU Compiler Collection (base package)",http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.6,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,197,550,7204260,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",48090,,Application Data,0,0,0,1,
  grub-common,grub2,1.99-27+deb7u2,GRand Unified Bootloader (common files),http://www.gnu.org/software/grub/,1,https://security-tracker.debian.org/tracker/source-package/grub2,https://www.openhub.net/projects/grub,GNU GRUB,GRUB is the GRand Unified Bootloader.,http://savannah.gnu.org/projects/grub/,,30,185,313200,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",163806,,Application Data,0,0,0,1,
  grub2-common,grub2,1.99-27+deb7u2,GRand Unified Bootloader (common files for version 2),http://www.gnu.org/software/grub/,1,https://security-tracker.debian.org/tracker/source-package/grub2,https://www.openhub.net/projects/grub,GNU GRUB,GRUB is the GRand Unified Bootloader.,http://savannah.gnu.org/projects/grub/,,30,185,313200,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",131799,C,Application Data,0,0,0,1,
  install-info,texinfo,4.13a.dfsg.1-10,Manage installed documentation in info format,,0,https://security-tracker.debian.org/tracker/source-package/texinfo,https://www.openhub.net/projects/texinfo,Texinfo,"Texinfo is the official documentation format of the GNU project. It was invented by Richard Stallman and Bob Chassell many years ago, loosely based on Brian Reid's Scribe and other formatting languages of the time. It is used by many non-GNU projects as well.
  
  Texinfo uses a single source file to produce output in a number of formats, both online and printed (dvi, html, info, pdf, xml, etc.). This means that instead of writing different documents for online information and another for a printed manual, you need write only one document. And when the work is revised, you need revise only that one document. The Texinfo system is well-integrated with GNU Emacs.",http://www.gnu.org/software/texinfo/,http://ftp.gnu.org/gnu/texinfo/,5,20,1549927,Perl,gpl3,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Average size development team,160662,"sh, bash, ksh, tcsh and other shells",,0,0,0,1,
  libdiscover2,discover,2.1.2-5.2,hardware identification library,,0,https://security-tracker.debian.org/tracker/source-package/discover,,,,,,,,,,,,,,,148453,,Application Data,0,0,0,1,
  python,python-defaults,2.7.3-4+deb7u1,interactive high-level object-oriented language (default version),http://www.python.org/,0,https://security-tracker.debian.org/tracker/source-package/python-defaults,https://www.openhub.net/projects/python,Python programming language,"Python is a dynamic, object-oriented programming language that can be used for many kinds of software development. It offers strong support for integration with other languages and tools, comes with extensive standard libraries, and can be learned in a few days. Many Python programmers report substantial productivity gains and feel the language encourages the development of better code.",https://www.python.org,https://www.python.org/downloads/,53,207,998525,Python,python_software_foundation,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",167613,,,0,0,0,1,
  python-minimal,python-defaults,2.7.3-4+deb7u1,minimal subset of the Python language (default version),http://www.python.org/,0,https://security-tracker.debian.org/tracker/source-package/python-defaults,https://www.openhub.net/projects/python,Python programming language,"Python is a dynamic, object-oriented programming language that can be used for many kinds of software development. It offers strong support for integration with other languages and tools, comes with extensive standard libraries, and can be learned in a few days. Many Python programmers report substantial productivity gains and feel the language encourages the development of better code.",https://www.python.org,https://www.python.org/downloads/,53,207,998525,Python,python_software_foundation,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",167581,,Program,0,0,0,1,
  sgml-base,,1.26+nmu4,SGML infrastructure and SGML catalog file support,,0,https://security-tracker.debian.org/tracker/source-package/sgml-base,,,,,,,,,,,,,,,156213,,Application Data,0,0,0,1,
  task-english,tasksel,3.14.1,General English environment,,0,https://security-tracker.debian.org/tracker/source-package/tasksel,https://www.openhub.net/projects/tasksel,tasksel,"Tool for selecting tasks for installation on Debian system.
  
  tasksel is a simple interface for users who want to pick general tasks for installation on their Debian GNU/Linux system. This program is used during the installation process, but users can also use tasksel at any point.",https://launchpad.net/tasksel,,9,134,2064,Perl,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",50189,,,0,0,0,1,
  tasksel,,3.14.1,Tool for selecting tasks for installation on Debian systems,,0,https://security-tracker.debian.org/tracker/source-package/tasksel,https://www.openhub.net/projects/tasksel,tasksel,"Tool for selecting tasks for installation on Debian system.
  
  tasksel is a simple interface for users who want to pick general tasks for installation on their Debian GNU/Linux system. This program is used during the installation process, but users can also use tasksel at any point.",https://launchpad.net/tasksel,,9,134,2064,Perl,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",164678,,,0,0,0,1,
  texinfo,,4.13a.dfsg.1-10,Documentation system for on-line information and printed output,,0,https://security-tracker.debian.org/tracker/source-package/texinfo,https://www.openhub.net/projects/texinfo,Texinfo,"Texinfo is the official documentation format of the GNU project. It was invented by Richard Stallman and Bob Chassell many years ago, loosely based on Brian Reid's Scribe and other formatting languages of the time. It is used by many non-GNU projects as well.
  
  Texinfo uses a single source file to produce output in a number of formats, both online and printed (dvi, html, info, pdf, xml, etc.). This means that instead of writing different documents for online information and another for a printed manual, you need write only one document. And when the work is revised, you need revise only that one document. The Texinfo system is well-integrated with GNU Emacs.",http://www.gnu.org/software/texinfo/,http://ftp.gnu.org/gnu/texinfo/,5,20,1549927,Perl,gpl3,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Average size development team,148315,,Program,0,0,0,1,
  debconf-i18n,debconf,1.5.49,full internationalization support for debconf,,0,https://security-tracker.debian.org/tracker/source-package/debconf,https://www.openhub.net/projects/debconf,debconf,,,,5,23,9385,Perl,,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,168799,,Application Data,0,0,0,0,
  iamerican,ispell,3.3.02-6,American English dictionary for ispell (standard version),http://www.lasr.cs.ucla.edu/geoff/ispell.html,0,https://security-tracker.debian.org/tracker/source-package/ispell,,,,,,,,,,,,,,,67479,,Application Data,0,0,0,0,
  ibritish,ispell,3.3.02-6,British English dictionary for ispell (standard version),http://www.lasr.cs.ucla.edu/geoff/ispell.html,0,https://security-tracker.debian.org/tracker/source-package/ispell,,,,,,,,,,,,,,,68375,,Application Data,0,0,0,0,
  ienglish-common,ispell,3.3.02-6,Common files for British and American ispell dictionaries,http://www.lasr.cs.ucla.edu/geoff/ispell.html,0,https://security-tracker.debian.org/tracker/source-package/ispell,,,,,,,,,,,,,,,59098,,Application Data,0,0,0,0,
  manpages,,3.44-1,Manual pages about using a GNU/Linux system,http://www.kernel.org/doc/man-pages/,0,https://security-tracker.debian.org/tracker/source-package/manpages,,,,,,,,,,,,,,,169573,,Documentation,0,0,0,0,
  manpages-dev,manpages,3.44-1,Manual pages about using GNU/Linux for development,http://www.kernel.org/doc/man-pages/,0,https://security-tracker.debian.org/tracker/source-package/manpages,,,,,,,,,,,,,,,103927,,Documentation,0,0,0,0,
  openssh-blacklist,,0.4.1+nmu1,list of default blacklisted OpenSSH RSA and DSA keys,,0,https://security-tracker.debian.org/tracker/source-package/openssh-blacklist,https://www.openhub.net/projects/openssh,OpenSSH,"OpenSSH is a free SSH/SecSH protocol suite providing encryption for network services like remote login or remote file transfer.
  
  The following is a list of OpenSSH features:
  
negative.code: project_name,debian_source,debian_version,debian_desc,debian_home,CVE_since_2010,CVE_page,openhub_page,openhub_name,openhub_desc,openhub_home,openhub_download,twelve_month_contributor_count,total_contributor_count,total_code_lines,main_language_name,licenses,fact_activity,fact_age,fact_comments,fact_team_size,package_popularity,implemented_in,role,direct_network_exposure,process_network_data,potential_privilege_escalation,risk_index(max = 16),risk_index components,comment_on_priority
  libexpat1,expat,2.1.0-1+deb7u1,XML parsing C library - runtime library,http://expat.sourceforge.net,5,https://security-tracker.debian.org/tracker/source-package/expat,https://www.openhub.net/projects/expat,Expat XML Parser,"Expat is a fast, non-validating, stream-oriented XML parsing library.",http://expat.sourceforge.net,http://sourceforge.net/project/showfiles.php?group_id=10127,0,10,22710,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,168755,C,Shared Library,0,1,0,12,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Parses potentially-dangerous data. This is an XML parser library written in C. Maintenance appears to have effectively halted after its 2012 release. Project at: http://www.libexpat.org/ (It was at, http://expat.sourceforge.net/ and its movement is not obvious, so some may be using an older version; this was follow-on from James Clark's original Expat). On 24 March 2012 Expat 2.1.0 released, it includes security vulnerability fixes for 5 CVEs; Previous release was 2007. ""Bug reports"" produces error page - tracking does not seem to work.  No public mailing list. CVS browsing suggests little or no activity after 2012 (and little before that). Many systems build on top of this library. Note that this doesn't support XML 1.1. +++"
  procmail,,3.22-20+deb7u1,Versatile e-mail processor,http://www.procmail.org/,2,https://security-tracker.debian.org/tracker/source-package/procmail,https://www.openhub.net/projects/8853,procmail,"Procmail can be used to create mail-servers, mailing lists, sort your incoming mail into separate folders/files (real convenient when subscribing to one or more mailing lists or for prioritising your mail), preprocess your mail, start any programs upon mail arrival (e.g. to generate different chimes on your workstation for different types of mail) or selectively forward certain incoming mail automatically to someone.",http://www.procmail.org/,http://www.procmail.org/,0,4,15536,C,artistic gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,148942,C,Program,1,0,0,12,"Website points: 0, CVE: 2, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Processes email passed in, so it does process untrusted data from the network."
  unzip,,6.0-8,De-archiver for .zip files,http://www.info-zip.org/UnZip.html,5,https://security-tracker.debian.org/tracker/source-package/unzip,https://www.openhub.net/projects/infozip,Zip & Unzip,,http://www.info-zip.org/,,0,2,878,C,BSD-3-Clause,Stable Y-O-Y development activity,"Young, but established codebase",Average number of code comments,No recent development activity,134732,,,0,1,0,12,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can Download Binaries, NO issue tracker. +++"
  bsd-mailx,,8.1.2-0.20111106cvs-1,simple mail user agent,,1,https://security-tracker.debian.org/tracker/source-package/bsd-mailx,https://www.openhub.net/projects/nail,mailx,"Heirloom mailx (previously known as nail) is a mail user agent (MUA) for Unix systems. 
  
  Highlights are:
  
      * Derived from Berkeley Mail 8.1. An interface like the original Berkeley one is still optionally available.
  
      * Is a free implementation of the System V mailx command and features an interface like that by default.",http://heirloom.sourceforge.net/mailx.html,http://sourceforge.net/project/showfiles.php?group_id=106236&package_id=182246,0,1,29957,C,BSD-3-Clause common_development_and_distribution gpl lgpl zlib_libpng,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,145942,C,Program,1,0,0,11,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","This does take data from untrusted sources, but many systems won't actively use it (there are many mail clients)."
  libc-bin,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Binaries,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,161840,,,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libc-dev-bin,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Development binaries,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,110652,,,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libc6,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Shared libraries,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,169731,,,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libc6-dev,eglibc,2.13-38+deb7u6,Embedded GNU C Library: Development Libraries and Header Files,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,115179,,,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libpcre3,pcre3,1:8.30-5,Perl 5 Compatible Regular Expression Library - runtime files,,6,https://security-tracker.debian.org/tracker/source-package/pcre3,https://www.openhub.net/projects/pcre,PCRE,"The PCRE (Perl Compatible Regular Expressions) library is a set of functions that implement regular expression pattern matching using the same syntax and semantics as Perl 5. PCRE has its own native API, as well as a set of wrapper functions that correspond to the POSIX regular expression API. The PCRE library is free, even for building commercial software.",http://www.pcre.org/,,2,4,96755,C,BSD-3-Clause,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168728,C,Shared Library,0,1,0,11,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Regexes are widely used for security-relevant input validation. Has Home page, Bug Tracker http://bugs.exim.org/buglist.cgi?product=PCRE NOT very active, public repo http://sourceforge.net/projects/pcre/files/ ++"
  locales,eglibc,2.13-38+deb7u6,Embedded GNU C Library: National Language (locale) data [support],http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,168656,,,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  multiarch-support,eglibc,2.13-38+deb7u6,Transitional package to ensure multiarch compatibility,http://www.eglibc.org,47,https://security-tracker.debian.org/tracker/source-package/eglibc,https://www.openhub.net/projects/eglibc,EGLIBC,"Embedded GLIBC (EGLIBC) is a variant of the GNU C Library (GLIBC)  that is designed to work well on embedded systems. EGLIBC strives to be source and binary compatible with GLIBC. EGLIBC's goals include reduced footprint, configurable components, better support for cross-compilation and cross-testing.",http://www.eglibc.org/,,0,12,1239262,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,136986,,,0,0,0,11,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libjpeg8,,8d-1+deb7u1,Independent JPEG Group's JPEG runtime library,,2,https://security-tracker.debian.org/tracker/source-package/libjpeg8,https://www.openhub.net/projects/libjpeg,libjpeg,A widely used free library for JPEG image compression.,http://www.ijg.org,http://www.ijg.org,0,5,58006,C,IJG,Stable Y-O-Y development activity,Well-established codebase,Very well-commented source code,No recent development activity,118088,C,Shared Library,0,1,0,11,"Website points: 0, CVE: 2, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can download as tarball, NO issue tracker, latest version/activity Jan 2014, NO mailing list +++"
  rsync,,3.0.9-4,"fast, versatile, remote (and local) file-copying tool",http://rsync.samba.org/,3,https://security-tracker.debian.org/tracker/source-package/rsync,https://www.openhub.net/projects/rsync,rsync,rsync is an open source utility that provides fast incremental file transfer.,http://samba.anu.edu.au/rsync/,,3,15,48806,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,101346,,,1,0,0,11,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",
  acpi-support-base,acpi-support,0.140-5+deb7u3,scripts for handling base ACPI events such as the power button,,2,https://security-tracker.debian.org/tracker/source-package/acpi-support,https://www.openhub.net/projects/acpi-support,acpi-support,,,,0,24,228,shell script,,Stable Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,155853,"sh, bash, ksh, tcsh and other shells",Program,0,0,1,10,"Website points: 1, CVE: 2, 12-month contributor: 5, Popularity: 1, Language: 0, Exposure: 1 , Data only: 0",
  acpid,,1:2.0.16-1+deb7u1,Advanced Configuration and Power Interface event daemon,http://www.tedfelix.com/linux/acpid-netlink.html,3,https://security-tracker.debian.org/tracker/source-package/acpid,https://www.openhub.net/projects/acpid,ACPI Daemon,"ACPID is a completely flexible, totally extensible daemon for delivering ACPI events. It listens on netlink interface (or on the deprecated file /proc/acpi/event), and when an event occurs, executes programs to handle the event.",http://sourceforge.net/projects/acpid2/,,2,6,4787,C,GNU_General_Public_License_v2_0_only,Decreasing Y-O-Y development activity,Well-established codebase,Well-commented source code,Small development team,160993,,Program,0,0,1,10,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Provides data on local hardware. Conceivably might allow local raise in privilege.
  bash,,4.2+dfsg-0.1+deb7u3,GNU Bourne Again SHell,http://tiswww.case.edu/php/chet/bash/bashtop.html,8,https://security-tracker.debian.org/tracker/source-package/bash,https://www.openhub.net/projects/bash,Bash,"Bash is an sh-compatible command language interpreter that executes commands read from the standard input or from a file.  Bash also incorporates useful features from the Korn and C shells (ksh and csh).
  
  Bash is ultimately intended to be a conformant implementation of the IEEE POSIX Shell and Tools specification (IEEE Working Group 1003.2).",http://www.gnu.org/software/bash/,http://ftp.gnu.org/gnu/bash/,1,2,175812,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,169882,C,Program,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  cpio,,2.11+dfsg-0.1,GNU cpio -- a program to manage archives of files,http://www.gnu.org/software/cpio/,3,https://security-tracker.debian.org/tracker/source-package/cpio,https://www.openhub.net/projects/cpio,GNU cpio,GNU cpio is an archiver program that handles cpio and tar archives.,http://savannah.gnu.org/projects/cpio/,,1,5,6843,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,169606,C,,0,1,0,10,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Decompression software. Isolated cpio format uncommon today, but RPMs are based on it."
  file,,5.11-2+deb7u6,"Determines file type using ""magic"" numbers",http://www.darwinsys.com/file/,24,https://security-tracker.debian.org/tracker/source-package/file,https://www.openhub.net/projects/file,file,"File tests each argument in an attempt to classify it. There are three sets of tests, performed in this order: filesystem tests, magic number tests, and language tests. The first test that succeeds causes the file type to be printed.
  Starting with version 4, the file command is not much more than a wrapper around the ""magic"" library.",http://www.darwinsys.com/file/,http://www.darwinsys.com/file/,1,6,14012,C,BSD-3-Clause,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,167088,,,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libcap2,,1:2.22-1.2,support for getting/setting POSIX.1e capabilities,http://sites.google.com/site/fullycapable/,1,https://security-tracker.debian.org/tracker/source-package/libcap2,https://www.openhub.net/projects/libcap,libcap,libcap implements the user-space interfaces to the POSIX 1003.1e capabilities available in Linux kernels. These capabilities are a partitioning of the all powerful root privilege into a set of distinct privileges.,https://sites.google.com/site/fullycapable/,,0,19,3461,C,BSD-3-Clause,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,166557,C,Shared Library,0,0,1,10,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Implemented by kernel.  Less likely to have issues here.
  libfuse2,fuse,2.9.0-2+deb7u1,Filesystem in Userspace (library),http://fuse.sourceforge.net/,6,https://security-tracker.debian.org/tracker/source-package/fuse,https://www.openhub.net/projects/fuse,FUSE,Filesystem in Userspace is a simple interface for userspace programs to export a virtual filesystem to the Linux kernel. It also aims to provide a secure method for non privileged users to create and mount their own filesystem implementations.,http://fuse.sourceforge.net,,2,44,33588,C,gpl lgpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Small development team,144917,,,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libmagic1,file,5.11-2+deb7u6,"File type determination library using ""magic"" numbers",http://www.darwinsys.com/file/,24,https://security-tracker.debian.org/tracker/source-package/file,https://www.openhub.net/projects/file,file,"File tests each argument in an attempt to classify it. There are three sets of tests, performed in this order: filesystem tests, magic number tests, and language tests. The first test that succeeds causes the file type to be printed.
  Starting with version 4, the file command is not much more than a wrapper around the ""magic"" library.",http://www.darwinsys.com/file/,http://www.darwinsys.com/file/,1,6,14012,C,BSD-3-Clause,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,167830,,,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libxau6,libxau,1:1.0.7-1,X11 authorisation library,,0,https://security-tracker.debian.org/tracker/source-package/libxau,https://www.openhub.net/projects/xauthxx,xauthxx,"DescriptionXauth++ provides a C++ interface to Xauthority by wrapping libXau. 
  
  FeaturesXauthority file I/O Automatic generation of MIT Magic Cookies Easy-to-use object-oriented API LicensingAll source files are distributed under the GNU LGPL except the example file, testxauth.cc, which is distributed under the GNU GPL. 
  