anchor.diff:      * Interoperability (Compliance with SSH 1.3, 1.5, and 2.0 protocol Standards)
       * SFTP client and server support in both SSH1 and SSH2 protocols.
       * Kerberos and AFS Ticket Passing
  -    * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,25,92,64718,C,BSD-3-Clause ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169249,C,,1,0,0,8,Vital for security. CII already investing in this. ++
  -openssh-server,openssh,1:6.0p1-4+deb7u2,"secure shell (SSH) server, for secure access from remote machines",http://www.openssh.org/,12,https://security-tracker.debian.org/tracker/source-package/openssh,https://www.openhub.net/projects/openssh,OpenSSH,"OpenSSH is a free SSH/SecSH protocol suite providing encryption for network services like remote login or remote file transfer.
  +    * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,23,92,69047,C,BSD-3-Clause,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169249,C,,1,0,0,8,Vital for security. CII already investing in this. ++
  +openssh-server,openssh,1:6.0p1-4+deb7u2,"secure shell (SSH) server, for secure access from remote machines",http://www.openssh.org/,13,https://security-tracker.debian.org/tracker/source-package/openssh,https://www.openhub.net/projects/openssh,OpenSSH,"OpenSSH is a free SSH/SecSH protocol suite providing encryption for network services like remote login or remote file transfer.
   
   The following is a list of OpenSSH features:
       * Open Source Project
  
positive.code: easy to use and uniform interface to access the content of font
  files.
  FreeType 2 is released under two open-source licenses: our own
  BSD-like FreeType License and the GPL.",http://savannah.nongnu.org/projects/freetype/,http://sourceforge.net/projects/freetype/files/latest/download,16,109,301821,C,ftl gpl ,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",167684,C,Shared Library,0,1,0,7,"Dangerous.  Processes data from network, including fonts embedded in websites. Main site http://www.freetype.org/ Last release FreeType 2.5.5, 2014-12-30. Git repo. Very active git repo by multiple contributors. ++"
  libgcrypt11,,1.5.0-5+deb7u2,LGPL Crypto library - runtime library,http://directory.fsf.org/project/libgcrypt/,2,https://security-tracker.debian.org/tracker/source-package/libgcrypt11,https://www.openhub.net/projects/libgcrypt,libgcrypt,Libgcrypt is a general purpose crypto library based on the code used in GnuPG.,http://www.gnupg.org,http://www.gnupg.org/download/index.html#libgcrypt,8,28,150704,C,gpl lgpl ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",163321,C,Shared Library,0,1,0,7,"Crypto library, security-relevant. LGPL crypto library. Part of GnuPG (GNU Privacy Guard). http://ftp.gnupg.org/gcrypt/libgcrypt/. Already selected by CII. ++"
  libgeoip1,geoip,1.4.8+dfsg-3,non-DNS IP-to-country resolver library,http://www.maxmind.com/,0,https://security-tracker.debian.org/tracker/source-package/geoip,https://www.openhub.net/projects/geoip,MaxMind GeoIP,"MaxMind GeoIP is a set of APIs for looking up the location of an IP address, including the country, region, city, latitude, and longitude. Free GeoLite databases are available at http://www.maxmind.com/app/geolitecity",http://sourceforge.net/projects/geoip,,0,2,83883,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,156657,C,Shared Library,0,1,0,7,Should not be security-relevant.
  libgmp10,gmp,2:5.0.5+dfsg-2,Multiprecision arithmetic library,http://gmplib.org/,0,https://security-tracker.debian.org/tracker/source-package/gmp,https://www.openhub.net/projects/gmp,GMP,"GMP is a free library for arbitrary precision arithmetic, operating on signed integers, rational numbers, and floating point numbers. There is no practical limit to the precision except the ones implied by the available memory in the machine GMP runs on. GMP has a rich set of functions, and the functions have a regular interface.",http://gmplib.org/,http://ftp.sunet.se/pub/gnu/gmp/,0,17,209398,C,lgpl3 ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,122633,C,Shared Library,0,1,0,7,Multi-precision can be security-relevant if used to process crypto data.
  libgpg-error0,libgpg-error,1.10-3.1,library for common error values and messages in GnuPG components,http://www.gnupg.org/related_software/libgpg-error/,0,https://security-tracker.debian.org/tracker/source-package/libgpg-error,https://www.openhub.net/projects/libgpg-error,libgpg-error,"This is a library that defines common error values for all GnuPG components.  Among these are GPG, GPGSM, GPGME, GPG-Agent, libgcrypt, Libksba, DirMngr, Pinentry, SmartCard Daemon and more.",,,6,16,44016,shell script,lgpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,169763,C,Shared Library,0,1,0,7,See GNUPG.
  libidn11,libidn,1.25-2,"GNU Libidn library, implementation of IETF IDN specifications",https://www.gnu.org/software/libidn/,0,https://security-tracker.debian.org/tracker/source-package/libidn,https://www.openhub.net/projects/libidn,LibIDN,"GNU Libidn is an implementation of the Stringprep, Punycode and IDNA specifications defined by the IETF Internationalized Domain Names (IDN) working group, used for internationalized domain names. The C library is available under the GNU Lesser General Public License.
  
  The library contains a generic Stringprep implementation that does Unicode 3.2 NFKC normalization, mapping and prohibitation of characters, and bidirectional character handling. Profiles for iSCSI, Kerberos 5, Nameprep, SASL and XMPP are included. Punycode and ASCII Compatible Encoding (ACE) via IDNA are supported.",http://www.gnu.org/software/libidn/,,1,4,101881,C,gpl lgpl ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,168599,C,Shared Library,0,1,0,7,"Libidn's purpose is to encode and decode internationalized domain names; this data may come straight from attackers (e.g., in web page links, etc.)."
  libisc84,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,ISC Shared Library used by BIND,,32,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,6,46,635185,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,104904,C,Shared Library,0,1,0,7,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  libisccc80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Command Channel Library used by BIND,,32,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,6,46,635185,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,105745,C,Shared Library,0,1,0,7,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  libisccfg82,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Config File Handling Library used by BIND,,32,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,6,46,635185,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,105598,C,Shared Library,0,1,0,7,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  libk5crypto3,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - Crypto Library,http://web.mit.edu/kerberos/,43,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,26,91,386862,C,mit ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161580,,,0,1,0,7,Kerberos.
  libkeyutils1,keyutils,1.5.5-3+deb7u1,Linux Key Management Utilities (library),http://people.redhat.com/~dhowells/keyutils/,0,https://security-tracker.debian.org/tracker/source-package/keyutils,https://www.openhub.net/projects/keyutils,keyutils,Linux Key Management Utilities,https://github.com/pld-linux/keyutils,,2,4,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Small development team,167697,C,Shared Library,0,1,0,7,"Manages authorization and encryption keys required to perform secure operations. Public Repo, NO bug tracker, NO mailing list. ++"
  libkrb5support0,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - Support library,http://web.mit.edu/kerberos/,43,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,26,91,386862,C,mit ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161587,,,0,1,0,7,Kerberos.
  liblzma5,xz-utils,5.1.1alpha+20120614-2,XZ-format compression library,http://tukaani.org/xz/,0,https://security-tracker.debian.org/tracker/source-package/xz-utils,https://www.openhub.net/projects/xz-utils,XZ Utils,"XZ Utils is free general-purpose data compression software with high compression ratio. XZ Utils were written for POSIX-like systems, but also work on some not-so-POSIX systems. XZ Utils are the successor to LZMA Utils.",http://tukaani.org/xz/,,4,13,27105,C,gpl lgpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Average size development team,135947,C,,0,1,0,7,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. Has Home page, public repo, Fairly active ML http://www.mail-archive.com/xz-devel@tukaani.org/, NO bug tracker ++"
  libp11-kit0,p11-kit,0.12-3,Library for loading and coordinating access to PKCS#11 modules - runtime,http://p11-glue.freedesktop.org/p11-kit.html,0,https://security-tracker.debian.org/tracker/source-package/p11-kit,https://www.openhub.net/projects/p11-kit,p11-kit,"Provides a way to load and enumerate PKCS#11 modules. Provides a standard configuration setup for installing PKCS#11 modules in such a way that they're discoverable.
  
  Also solves problems with coordinating the use of PKCS#11 by different components or libraries living in the same process.",http://p11-glue.freedesktop.org/p11-kit.html,http://p11-glue.freedesktop.org/releases/,10,22,57110,C,bsd ,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,"Large, active development team",136021,C,Shared Library,0,1,0,7,"Manages security keys. Has Home page, Bug Tracker https://bugs.freedesktop.org/enter_bug.cgi?product=p11-glue, ML http://lists.freedesktop.org/archives/p11-glue/ fairly active ++"
  libpam-modules-bin,pam,1.1.3-7.1,Pluggable Authentication Modules for PAM - helper binaries,http://pam.sourceforge.net/,14,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,8,20,56988,C,BSD-3-Clause gpl gpl3 ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",135322,C,Shared Library,0,1,0,7,"Critical central role for authentication.  Real site is http://www.linux-pam.org/ (Debian lists as http://pam.sourceforge.net/ but that points to https://fedorahosted.org/linux-pam/ which points to this). It has a somewhat active mailing list, and an active issue tracker where issues are clearly opened and closed. Stable version is somewhat old (2013); recent changes in git though relatively small (https://git.fedorahosted.org/cgit/linux-pam.git/) ++"
  libpcre3,pcre3,1:8.30-5,Perl 5 Compatible Regular Expression Library - runtime files,,1,https://security-tracker.debian.org/tracker/source-package/pcre3,https://www.openhub.net/projects/pcre,PCRE,"The PCRE (Perl Compatible Regular Expressions) library is a set of functions that implement regular expression pattern matching using the same syntax and semantics as Perl 5. PCRE has its own native API, as well as a set of wrapper functions that correspond to the POSIX regular expression API. The PCRE library is free, even for building commercial software.",http://www.pcre.org/,,3,4,96416,C,BSD-3-Clause ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168728,C,Shared Library,0,1,0,7,"Regexes are widely used for security-relevant input validation. Has Home page, Bug Tracker http://bugs.exim.org/buglist.cgi?product=PCRE NOT very active, public repo http://sourceforge.net/projects/pcre/files/ ++"
  libsasl2-2,cyrus-sasl2,2.1.25.dfsg1-6+deb7u1,Cyrus SASL - authentication abstraction library,http://www.cyrusimap.org/,1,https://security-tracker.debian.org/tracker/source-package/cyrus-sasl2,https://www.openhub.net/projects/12134,Cyrus SASL,"SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. If its use is negotiated, a security layer is inserted between the protocol and the connection.
  
  Cyrus SASL is the reference implementation of SASL.",http://asg.web.cmu.edu/sasl/,http://ftp.andrew.cmu.edu/pub/cyrus-mail/,2,20,90759,C,Carnegie_Mellon_Licence ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168686,C,Shared Library,0,1,0,7,"Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++"
  libsasl2-modules,cyrus-sasl2,2.1.25.dfsg1-6+deb7u1,Cyrus SASL - pluggable authentication modules,http://www.cyrusimap.org/,1,https://security-tracker.debian.org/tracker/source-package/cyrus-sasl2,https://www.openhub.net/projects/12134,Cyrus SASL,"SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. If its use is negotiated, a security layer is inserted between the protocol and the connection.
  
  Cyrus SASL is the reference implementation of SASL.",http://asg.web.cmu.edu/sasl/,http://ftp.andrew.cmu.edu/pub/cyrus-mail/,2,20,90759,C,Carnegie_Mellon_Licence ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,157085,C,Plugin,0,1,0,7,"Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++"
  libselinux1,libselinux,2.1.9-5,SELinux runtime shared libraries,,0,https://security-tracker.debian.org/tracker/source-package/libselinux,https://www.openhub.net/projects/selinux,Security-enhanced Linux,"This is a public forum for the NSA Security-Enhanced Linux project. This is not intended to replace NSA's work or official website but rather to allow broader participation in extending and adapting SELinux for distributions.
  
  SELinux normally comes with your Linux distribution. It is unusual for an ordinary user to install it manually.
  
  The proposed logo is not the official SELinux logo.",http://sourceforge.net/projects/selinux,,10,55,102735,C,gpl3_or_later ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",169736,C,Shared Library,0,0,1,7,SELinux vital for security on systems using it (there are many).  Many of the critical parts are in the kernel.
  libsm6,libsm,2:1.2.1-2,X11 Session Management library,,0,https://security-tracker.debian.org/tracker/source-package/libsm,,,,,,,,,,,,,,,137348,,Shared Library,0,0,0,7,Just stores X11 sessions for later use.
  libxml2,,2.8.0+dfsg1-7+wheezy2,GNOME XML library,http://xmlsoft.org/,18,https://security-tracker.debian.org/tracker/source-package/libxml2,https://www.openhub.net/projects/libxml2,libxml2,"Libxml2 is the XML C parser and toolkit developed for the Gnome project (but usable outside of the Gnome platform).
  
  Includes the xmllint tool for checking documents for well-formedness, validating documents against a DTD or XML Schema, and pretty printing XML input.",http://www.xmlsoft.org/,http://www.xmlsoft.org/downloads.html,26,215,501531,C,mit ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",168006,,,0,1,0,7,"Processes attacker-provided data. HAS Home Page, Has bug tracker https://bugzilla.gnome.org/buglist.cgi?product=libxml2 which is very active. ++"
  login,shadow,1:4.1.5.1-1,system login tools,http://pkg-shadow.alioth.debian.org/,2,https://security-tracker.debian.org/tracker/source-package/shadow,https://www.openhub.net/projects/shadow-tool-suite,Shadow Tool Suite,"The shadow tool suite contains the following commands among others: login, passwd, useradd, groupadd.",http://pkg-shadow.alioth.debian.org/,http://pkg-shadow.alioth.debian.org/download.php,4,17,127116,C,bsd ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,169894,C,Program,0,0,1,7,"Front door for local login. Has Home Page, part of shadow tool suite, Latest release May 2014, Public Repo, Somewhat active mailing list, NO issue tracker. ++"
  logrotate,,3.8.1-4,Log rotation utility,,6,https://security-tracker.debian.org/tracker/source-package/logrotate,https://www.openhub.net/projects/logrotate,logrotate,A logrotate alternative; easier to use.,http://sourceforge.net/projects/logrotate,,,,,,,,,,,169736,,Program,0,0,1,7,"Moves logs, but doesn't seriously analyze them, so attack opportunities reduced."
  mime-support,,3.52-1,"MIME files 'mime.types' & 'mailcap', and support programs",,1,https://security-tracker.debian.org/tracker/source-package/mime-support,,,,,,,,,,,,,,,168503,Perl,Program,0,0,0,7,Processes potentially untrustworthy files.
  tar,,1.26+dfsg-0.1,GNU version of the tar archiving utility,,1,https://security-tracker.debian.org/tracker/source-package/tar,https://www.openhub.net/projects/tar,GNU tar,"The Tar program provides the ability to create tar archives, as well as various other kinds of manipulation.",http://savannah.gnu.org/projects/tar/,,7,21,23449,C,gpl ,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",169899,,,0,1,0,7,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. Has Home page, mailing list, Public Repo git://git.savannah.gnu.org/tar.git, uses ""technical support"" for issue tracking (could be confusing).  Does have changes in git repo, but only a few a month and typically small. ++"
  x11-common,xorg,1:7.7+3~deb7u1,X Window System (X.Org) infrastructure,,2,https://security-tracker.debian.org/tracker/source-package/xorg,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  
  The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org/wiki/,http://www.x.org/wiki/Releases/Download,150,1146,3305416,C,BSD-3-Clause mit ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",142707,"sh, bash, ksh, tcsh and other shells",,0,0,1,7,X development is transitioning towards Wayland.
  xserver-xorg-core,xorg-server,2:1.12.4-6+deb7u5,Xorg X server - core server,,24,https://security-tracker.debian.org/tracker/source-package/xorg-server,https://www.openhub.net/projects/xserver-xorg-driver-ati,xserver-xorg-driver-ati,,,,12,165,49507,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",99612,C,Program,0,0,0,7,X development is transitioning towards Wayland.
  xz-utils,,5.1.1alpha+20120614-2,XZ-format compression utilities,http://tukaani.org/xz/,0,https://security-tracker.debian.org/tracker/source-package/xz-utils,https://www.openhub.net/projects/xz-utils,XZ Utils,"XZ Utils is free general-purpose data compression software with high compression ratio. XZ Utils were written for POSIX-like systems, but also work on some not-so-POSIX systems. XZ Utils are the successor to LZMA Utils.",http://tukaani.org/xz/,,4,13,27105,C,gpl lgpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Average size development team,161482,C,,0,1,0,7,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. HAS Home Page, public code repo http://git.tukaani.org/?p=xz.git;a=summary - fairly active by small # of committers.  Some mailing list activity.  No bug tracker found. ++"
  zlib1g,zlib,1:1.2.7.dfsg-13,compression library - runtime,http://zlib.net/,0,https://security-tracker.debian.org/tracker/source-package/zlib,https://www.openhub.net/projects/zlib,zlib,"zlib is designed to be a free, general-purpose, legally unencumbered -- that is, not covered by any patents -- lossless data-compression library for use on virtually any computer hardware and operating system. The zlib data format is itself portable across platforms. Unlike the LZW compression method used in Unix compress(1) and in the GIF image format, the compression method currently used in zlib essentially never expands the data. (LZW can double or triple the file size in extreme cases.) zlib's memory footprint is also independent of the input data and can be reduced, if necessary, at some cost in compression.",http://www.zlib.net/,http://www.zlib.net/,0,20,36295,C,zlib_libpng ,Decreasing Y-O-Y development activity,"Young, but established codebase",Well-commented source code,No recent development activity,169896,C,Shared Library,0,1,0,7,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. HAS Home Page, has mailing list zlib@gzip.org, NO issue tracker, Latest release April 2013 (old). +++"
  analog,,2:6.0-19.1,web server log analyzer,http://www.analog.cx/,0,https://security-tracker.debian.org/tracker/source-package/analog,https://www.openhub.net/projects/AnalogCAmie,Analog C:Amie Edition,"Analog was created by Stephen Turner in 1995 as a multi-purpose, multi-platform log file analyser. He maintained the project until 2004, at which point he ceased to update the project. In 2007, as a long-term user of Analog and in light of the release of Windows Vista that could not be identified by Analog, C:Amie has undertaken to maintain Analog and to keep its detection current.",http://camie.dyndns.org/analog/,http://camie.dyndns.org/analog/download/,,,,,,,,,,23315,,Program,1,0,0,7,"Web log analyzer, analyzes attacker-provided data.  Could conceivably be way to attack via maliciously-formatted data for logging."
  apache2-mpm-worker,apache2,2.2.22-13+deb7u3,Apache HTTP Server - high speed threaded model,http://httpd.apache.org/,42,https://security-tracker.debian.org/tracker/source-package/apache2,https://www.openhub.net/projects/apache,Apache HTTP Server,"The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.",http://httpd.apache.org/,http://httpd.apache.org/download.cgi,30,115,1742162,C,apache_2 ,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",16235,C,Program,1,0,0,7,"Vitally important.  Note, however, that there's already large development & review team in place."
  libapr1,apr,1.4.6-3+deb7u1,Apache Portable Runtime Library,http://apr.apache.org/,3,https://security-tracker.debian.org/tracker/source-package/apr,https://www.openhub.net/projects/apr,Apache Portable Runtime,"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.",http://apr.apache.org/,,13,66,417288,C,apache_2 ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",125815,C,Shared Library,0,1,0,7,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  However, it's not as clear that the LDAP library in it is as actively managed. HAS Home Page, HAS Mailing List, Issue tracker https://bz.apache.org/bugzilla/enter_bug.cgi?product=APR \++"
  libaprutil1,apr-util,1.4.1-3,Apache Portable Runtime Utility Library,http://apr.apache.org/,1,https://security-tracker.debian.org/tracker/source-package/apr-util,https://www.openhub.net/projects/apr,Apache Portable Runtime,"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.",http://apr.apache.org/,,13,66,417288,C,apache_2 ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",125468,C,Shared Library,0,1,0,7,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  However, it's not as clear that the LDAP library in it is as actively managed. HAS Home Page, HAS Mailing List, Issue tracker https://bz.apache.org/bugzilla/enter_bug.cgi?product=APR \++"
  libjpeg8,,8d-1+deb7u1,Independent JPEG Group's JPEG runtime library,,2,https://security-tracker.debian.org/tracker/source-package/libjpeg8,https://www.openhub.net/projects/libjpeg,libjpeg,A widely used free library for JPEG image compression.,http://www.ijg.org,http://www.ijg.org,0,5,58006,C,IJG ,Stable Y-O-Y development activity,Well-established codebase,Very well-commented source code,No recent development activity,118088,C,Shared Library,0,1,0,7,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can download as tarball, NO issue tracker, latest version/activity Jan 2014, NO mailing list +++"
  libpng12-0,libpng,1.2.49-1,PNG library - runtime,http://libpng.org/pub/png/libpng.html,20,https://security-tracker.debian.org/tracker/source-package/libpng,https://www.openhub.net/projects/libpng,libpng,"libpng is the official PNG reference library. It supports almost all PNG features, is extensible, and has been extensively tested for over 17 years.
  
  libpng is available as ANSI C source code and requires zlib 1.0.4 or later (1.2.3 or 1.1.4 recommended due to potential security vulnerabilities in earlier versions). In addition to the main library sources, libpng includes the rpng, rpng2 and wpng demo programs, the pngminus demo program, a subset of Willem van Schaik's PngSuite test images, and Willem's VisualPng demo program.  Configure, CMake, Visualc projects, and various makefiles are included for building libpng.
  
  Libpng is under the libpng license.",http://www.libpng.org/pub/png/libpng.html,http://sourceforge.net/project/showfiles.php?group_id=5624,4,9,401845,C,libpng ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,153194,C,Shared Library,0,1,0,7,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can Access Source code, Not much activity - just warnings about CVEs that were fixed. +++"
  ssl-cert,,1.0.32,simple debconf wrapper for OpenSSL,,0,https://security-tracker.debian.org/tracker/source-package/ssl-cert,https://www.openhub.net/projects/debconf,debconf,,,,4,21,9380,Perl,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,135045,,Program,1,0,0,7,See OpenSSL.
  gnutls-bin,gnutls26 (2.12.20-8+deb7u2),3.0.22-3+really2.12.20-8+deb7u2,GNU TLS library - commandline utilities,http://www.gnutls.org/,17,https://security-tracker.debian.org/tracker/source-package/gnutls26,https://www.openhub.net/projects/gnutls,GnuTLS,"GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. It is aimed to be portable and efficient with focus on security and interoperability.",http://www.gnutls.org,,24,72,190431,C,gpl3_or_later lgpl21_or_later ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",3291,C,Program,1,0,0,7,See GnuTLS.
  libpolarssl-runtime,polarssl,1.2.9-1~deb7u3,lightweight crypto and SSL/TLS library,http://polarssl.org,13,https://security-tracker.debian.org/tracker/source-package/polarssl,https://www.openhub.net/projects/polarssl,PolarSSL,"PolarSSL is a light-weight open-source cryptographic library for embedded systems.
  
  Its designed to be:
  
negative.code:     * Interoperability (Compliance with SSH 1.3, 1.5, and 2.0 protocol Standards)
      * SFTP client and server support in both SSH1 and SSH2 protocols.
      * Kerberos and AFS Ticket Passing
      * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,23,92,69047,C,BSD-3-Clause,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",140377,,Application Data,0,0,0,0,
  openssh-blacklist-extra,openssh-blacklist,0.4.1+nmu1,list of non-default blacklisted OpenSSH RSA and DSA keys,,0,https://security-tracker.debian.org/tracker/source-package/openssh-blacklist,https://www.openhub.net/projects/openssh,OpenSSH,"OpenSSH is a free SSH/SecSH protocol suite providing encryption for network services like remote login or remote file transfer.
  
  The following is a list of OpenSSH features:
  