anchor.diff:  
   It provides standard crypto blocks for: AES, Camellia, SHA-1, SHA-256, SHA512, X.509 certificates, etc. as well as higher lever protocols: SSL v3, TLS v1.0, TLS v1.1 and TLS v1.2.
   
  -PolarSSL has been ported on a number of architectures, including ARM, PowerPC, MIPS, and Motorola 68000. Its already small memory footprint can be easily reduced to 50k for a basic SSL client or server, by modifying a single .h configuration file. PolarSSL is currently used in several open-source (GPL) and closed-source projects, such as Adobe's flash player.",https://polarssl.org,https://polarssl.org/download,17,27,78084,C,commercial_license gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",29,,devel-lib,1,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 0, Language: 2, Exposure: 2 , Data only: 0",SSL/TLS library.  Protocol is important.  This implementation is less widely used.
  -yum,,3.2.25-2,Advanced front-end for rpm,http://yum.baseurl.org/,1,https://security-tracker.debian.org/tracker/source-package/yum,https://www.openhub.net/projects/yum,yum,Yum is an automatic updater and package installer/remover for rpm systems. It automatically computes dependencies and figures out what things should occur to install packages. It makes it easier to maintain groups of machines without having to manually update each one using rpm.,http://yum.baseurl.org/,http://yum.baseurl.org/wiki/releases,3,98,148840,Python,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,782,python,program,1,0,0,7,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 0, Language: 0, Exposure: 2 , Data only: 0","This is used by RPM-based systems to download/install programs.
  -It is anticipated that this will be replaced with DNF in
  -Fedora at least (https://lwn.net/Articles/580223/)."
  -openvpn,,2.2.1-8+deb7u3,virtual private network daemon,http://www.openvpn.net/,2,https://security-tracker.debian.org/tracker/source-package/openvpn,https://www.openhub.net/projects/openvpn,OpenVPN,"OpenVPN is a robust and highly configurable VPN (Virtual Private Network) daemon which can be used to securely link two or more private networks using an encrypted tunnel over the Internet. OpenVPN's principal strengths include wide cross-platform portability, excellent stability, support for dynamic IP addresses and NAT, adaptive link compression, single TCP/UDP port usage, a modular design that offloads most crypto tasks to the OpenSSL library, and relatively easy installation that in most cases doesn't require a special kernel module.",http://openvpn.net,http://openvpn.net/download.html,24,81,328250,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",28165,,,1,0,0,7,"Website points: 0, CVE: 2, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",
  -clamav,,0.98.5+dfsg-0+deb7u1,anti-virus utility for Unix - command-line interface,http://www.clamav.net/,33,https://security-tracker.debian.org/tracker/source-package/clamav,https://www.openhub.net/projects/clamav,Clam AntiVirus,"Clam AntiVirus (ClamAV) is an anti-virus toolkit for Unix. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a commandline scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use in your own software.",https://github.com/vrtadmin/clamav-devel,https://github.com/vrtadmin/clamav-devel/downloads,8,163,2910592,C++,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",12595,c,program,1,1,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 0, Language: 2, Exposure: 2 , Data only: 0",
  +PolarSSL has been ported on a number of architectures, including ARM, PowerPC, MIPS, and Motorola 68000. Its already small memory footprint can be easily reduced to 50k for a basic SSL client or server, by modifying a single .h configuration file. PolarSSL is currently used in several open-source (GPL) and closed-source projects, such as Adobe's flash player.",https://polarssl.org,https://polarssl.org/download,17,27,78084,C,commercial_license gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",40,,devel-lib,1,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 0, Language: 2, Exposure: 2 , Data only: 0",SSL/TLS library.  Protocol is important.  This implementation is less widely used.
  +libsqlite3-0,sqlite3,3.7.13-1+deb7u1,SQLite 3 shared library,http://www.sqlite.org/,5,https://security-tracker.debian.org/tracker/source-package/sqlite3,https://www.openhub.net/projects/sqlite,SQLite,"SQLite is a small C library that implements a self-contained, embeddable, zero-configuration SQL database engine. Implements most of SQL92 and ACID (atomic, consistent, isolated, and durable) transactions; no setup or administration needed.",http://sqlite.org/,http://sqlite.org/download.html,4,30,235125,C,Public_Domain,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,174910,c,shared-lib,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +libtirpc1,libtirpc,0.2.2-5,transport-independent RPC library,,1,https://security-tracker.debian.org/tracker/source-package/libtirpc,https://www.openhub.net/projects/libtirpc,libtirpc,Libtirpc is a port of Suns Transport-Independent RPC library to Linux. It's being developed by the Bull GNU/Linux NFSv4 project. Note: The SVN Repository on this site is *not* used. Use the git://git.infradead.org/~steved/libtirpc.git GIT tree,http://sourceforge.net/projects/libtirpc,,9,31,18347,C,,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",128917,,shared-lib,1,0,0,7,"Website points: 0, CVE: 1, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0","RPC library, used by NFS."
  +libuuid1,util-linux,2.20.1-5.3,Universally Unique ID library,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",175845,c,shared-lib,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +libx11-6,libx11,2:1.5.0-1+deb7u1,X11 client-side library,,4,https://security-tracker.debian.org/tracker/source-package/libx11,https://www.openhub.net/projects/libx11,libX11,git://anongit.freedesktop.org/xorg/lib/libX11,https://github.com/mirror/libX11,https://github.com/mirror/libX11/downloads,7,136,221808,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",173636,c,shared-lib,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +libxfont1,libxfont,1:1.4.5-4,X11 font rasterisation library,,8,https://security-tracker.debian.org/tracker/source-package/libxfont,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  +
  +The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org,http://www.x.org/wiki/Releases/Download,163,1196,3316063,C,BSD-3-Clause mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",115152,,shared-lib,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +linux-base,,3.5,Linux image base package,,0,https://security-tracker.debian.org/tracker/source-package/linux-base,,,,,,,,,,,,,,,166753,c,metapackage,0,0,0,7,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",These are small scripts and utilities for the Linux kernel.
  +linux-libc-dev,linux,3.2.63-2+deb7u2,Linux support headers for userspace development,,403,https://security-tracker.debian.org/tracker/source-package/linux,https://www.openhub.net/projects/linux,Linux Kernel,"Linux is a free software kernel, which combined with the GNU libraries, core utils and shell form the GNU/Linux operating system.
  +
  +!!!PLEASE!!! DO NOT REMOVE git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git enlistment. It contains historical pre-2.6.12 commit data.",http://kernel.org/,,3714,14514,18036029,C,GNU_General_Public_License_v2_0_only,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",113488,,,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +login,shadow,1:4.1.5.1-1,system login tools,http://pkg-shadow.alioth.debian.org/,2,https://security-tracker.debian.org/tracker/source-package/shadow,https://www.openhub.net/projects/shadow-tool-suite,Shadow Tool Suite,"The shadow tool suite contains the following commands among others: login, passwd, useradd, groupadd.",http://pkg-shadow.alioth.debian.org/,http://pkg-shadow.alioth.debian.org/download.php,7,20,127125,C,bsd,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",175846,c,program,0,0,1,7,"Website points: 0, CVE: 2, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Front door for local login. Has Home Page, part of shadow tool suite, Latest release May 2014, Public Repo, Somewhat active mailing list, NO issue tracker. ++"
  +mount,util-linux,2.20.1-5.3,Tools for mounting and manipulating filesystems,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",175755,c,program,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +openvpn,,2.2.1-8+deb7u3,virtual private network daemon,http://www.openvpn.net/,2,https://security-tracker.debian.org/tracker/source-package/openvpn,https://www.openhub.net/projects/openvpn,OpenVPN,"OpenVPN is a robust and highly configurable VPN (Virtual Private Network) daemon which can be used to securely link two or more private networks using an encrypted tunnel over the Internet. OpenVPN's principal strengths include wide cross-platform portability, excellent stability, support for dynamic IP addresses and NAT, adaptive link compression, single TCP/UDP port usage, a modular design that offloads most crypto tasks to the OpenSSL library, and relatively easy installation that in most cases doesn't require a special kernel module.",http://openvpn.net,http://openvpn.net/download.html,24,81,328250,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",32347,,,1,0,0,7,"Website points: 0, CVE: 2, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",
  +python-chardet,chardet,2.0.1-2,universal character encoding detector,http://chardet.feedparser.org/,0,https://security-tracker.debian.org/tracker/source-package/chardet,https://www.openhub.net/projects/chardet,chardet,,,,0,1,176656,XSL Transformation,,,,,,146283,python,devel-lib,0,0,0,7,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 2, Language: 0, Exposure: 0 , Data only: 0",
  +python-debianbts,,1.11,Python interface to Debian's Bug Tracking System,,0,https://security-tracker.debian.org/tracker/source-package/python-debianbts,https://www.openhub.net/projects/python-debianbts,python-debianbts,,,,2,4,281,Python,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,132254,python,program,0,0,0,7,"Website points: 1, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 0, Exposure: 0 , Data only: 0",
  +python2.6,,2.6.8-1.1,Interactive high-level object-oriented language (version 2.6),,26,https://security-tracker.debian.org/tracker/source-package/python2.6,https://www.openhub.net/projects/python,Python programming language,"Python is a dynamic, object-oriented programming language that can be used for many kinds of software development. It offers strong support for integration with other languages and tools, comes with extensive standard libraries, and can be learned in a few days. Many Python programmers report substantial productivity gains and feel the language encourages the development of better code.",https://www.python.org,https://www.python.org/downloads/,53,207,998525,Python,python_software_foundation,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",100209,c,devel-lib,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +python2.7,,2.7.3-6+deb7u2,Interactive high-level object-oriented language (version 2.7),,24,https://security-tracker.debian.org/tracker/source-package/python2.7,https://www.openhub.net/projects/python,Python programming language,"Python is a dynamic, object-oriented programming language that can be used for many kinds of software development. It offers strong support for integration with other languages and tools, comes with extensive standard libraries, and can be learned in a few days. Many Python programmers report substantial productivity gains and feel the language encourages the development of better code.",https://www.python.org,https://www.python.org/downloads/,53,207,998525,Python,python_software_foundation,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",146101,c,shared-lib,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  +qemu,,1.1.2+dfsg-6a+deb7u6,fast processor emulator,http://www.qemu.org/,66,https://security-tracker.debian.org/tracker/source-package/qemu,https://www.openhub.net/projects/qemu,QEMU,"QEMU is a generic and open source machine emulator and virtualizer.
  +
  +When used as a machine emulator, QEMU can run OSes and programs made for one machine on a different machine. By using dynamic translation, it achieves very good performance.
  +
  +When used as a virtualizer, QEMU achieves near native performances by executing the guest code directly on the host CPU.",http://www.qemu.org/,http://wiki.qemu.org/Download,319,937,939991,C,bsd gpl lgpl Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Very large, active development team",9219,,,0,0,1,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",
  +rpm,,4.10.0-5+deb7u1,package manager for RPM,http://rpm.org/,11,https://security-tracker.debian.org/tracker/source-package/rpm,https://www.openhub.net/projects/rpm,RPM,"The RPM Package Manager (RPM) is a powerful command line driven package management system capable of installing, uninstalling, verifying, querying, and updating computer software packages. Each software package consists of an archive of files along with information about the package like its version, a description, and the like. There is also a library API, permitting advanced developers to manage such transactions from programming languages such as C or Python.",http://rpm.org,http://wiki.rpm.org/Download,16,102,67656,C,gpl lgpl21_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",23790,c,program,0,1,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","This is used by RPM-based systems to install programs.  Here we refer to the version at rpm.org (used by Fedora, Red Hat Enterprise Linux, CentOS, SUSE).  (Note that there is a fork by the original RPM maintainer (Jeff Johnson) at rpm5.org, used by some organizations.)  Has ticket tracker, many long-opened defect tickets. Latest release 2014-10-09.
  +Repo publicly available in git, see: http://rpm.org/wiki/GetSource and a number of commits in 2015 (and before)."
   subversion,,1.6.17dfsg-4+deb7u6,Advanced version control system,http://subversion.apache.org/,30,https://security-tracker.debian.org/tracker/source-package/subversion,https://www.openhub.net/projects/subversion,Apache Subversion,"Subversion has rapidly become the version control standard and it is rapidly replacing open source and commercial solutions around the world.
   Subversion enables globally distributed software development teams to efficiently version and share source code. The open source Subversion project was started in early 2000 by CollabNet, the primary corporate sponsor of Subversion.
   
  
positive.code:     * Interoperability (Compliance with SSH 1.3, 1.5, and 2.0 protocol Standards)
      * SFTP client and server support in both SSH1 and SSH2 protocols.
      * Kerberos and AFS Ticket Passing
      * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,23,92,69047,C,BSD-3-Clause,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",126416,c,program,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Vital for security. CII already investing in this. ++
  openssl,,1.0.1e-2+deb7u13,Secure Socket Layer (SSL) binary and related cryptographic tools,,87,https://security-tracker.debian.org/tracker/source-package/openssl,https://www.openhub.net/projects/openssl,OpenSSL,"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and dev",http://www.openssl.org/,http://www.openssl.org//source/,107,177,437855,C,OpenSSL_License,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",151637,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Critical, in wide use.  OpenSSL is already funded by CII. ++"
  procps,,1:3.3.3-3,/proc file system utilities,http://gitorious.org/procps,0,https://security-tracker.debian.org/tracker/source-package/procps,https://www.openhub.net/projects/procps,Procps - The /proc file system utilities,"procps is the package that has a bunch of small useful utilities that give information about processes using the /proc filesystem. The package includes the programs ps, top, vmstat, w, kill, free, slabtop, and skill.
  
  Version 3 includes NPTL thread support, a rewritten top, many bug fixes, performance improvements, and new features.",http://procps.sourceforge.net/,http://procps.sourceforge.net/download.html,0,2,15622,C,lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,153940,c,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  reportbug,,6.4.4+deb7u1,reports bugs in the Debian distribution,http://alioth.debian.org/projects/reportbug/,1,https://security-tracker.debian.org/tracker/source-package/reportbug,https://www.openhub.net/projects/reportbug,reportbug,,http://alioth.debian.org/projects/reportbug,,1,23,8566,Python,mit,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Only a single active developer,134872,python,program,1,0,0,8,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 0, Exposure: 2 , Data only: 0",
  rsyslog,,5.8.11-3+deb7u2,reliable system and kernel logging daemon,http://www.rsyslog.com/,9,https://security-tracker.debian.org/tracker/source-package/rsyslog,https://www.openhub.net/projects/rsyslog,rsyslog,"Rsyslog is an enhanced multi-threaded syslogd supporting, among others, MySQL, syslog/tcp, RFC 3195, permitted sender lists, filtering on any message part, and fine grain output format control. It is quite compatible to stock sysklogd and can be used as a drop-in replacement. Its advanced features make it suitable for enterprise-class, encryption protected syslog relay chains while at the same time being very easy to setup for the novice user. 
  
  Over time, rsyslog has become the default syslogd for the many distributions.",http://www.rsyslog.com/,http://www.rsyslog.com/Downloads-index-req-viewdownload-cid-1-orderby-dateD.phtml,52,160,196201,C,gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",146784,c,program,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Processes data from untrusted users.  Important today; as systemd becomes more used, its use may lessen but still important for merging data sources. Project page http://www.rsyslog.com/ Official repo on GitHub, https://github.com/rsyslog This is an active multi-person project; in the one-month period February 12, 2015     March 12, 2015, excluding merges, 7 authors have pushed 27 commits to master and 40 commits to all branches. On master, 37 files have changed and there have been 677 additions and 216 deletions. ++"
  sysvinit,,2.88dsf-41+deb7u1,System-V-like init utilities,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/sysvinit,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,118418,c,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  sysvinit-utils,sysvinit,2.88dsf-41+deb7u1,System-V-like utilities,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/sysvinit,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,153872,c,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  tcpd,tcp-wrappers,7.6.q-24,Wietse Venema's TCP wrapper utilities,,0,https://security-tracker.debian.org/tracker/source-package/tcp-wrappers,,,,,,,,,,,,,,,146665,c,program,1,0,0,8,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Exposed to the network (wraps incoming requests). Has some security-relevant functions. Relatively small.
  time,,1.7-24,GNU time program for measuring CPU resource usage,http://www.gnu.org/software/time,0,https://security-tracker.debian.org/tracker/source-package/time,https://www.openhub.net/projects/time,OpenTimeCE,An implementation of the full set of time_t functions in time.h from the C Standard Library for Windows CE.,http://time.codeplex.com,,0,3,1637,XAML,mit,Stable Y-O-Y development activity,"Young, but established codebase",Very few source code comments,No recent development activity,134918,c,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  vim-tiny,vim,2:7.3.547-7,Vi IMproved - enhanced vi editor - compact version,http://www.vim.org/,1,https://security-tracker.debian.org/tracker/source-package/vim,https://www.openhub.net/projects/vim,Vim,"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. It's useful whether you're already using vi or using a different editor.",http://www.vim.org/,http://www.vim.org/download.php,1,12,844733,C,Vim_License,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,148502,c,program,0,0,0,8,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  whois,,5.1.1~deb7u1,intelligent WHOIS client,,0,https://security-tracker.debian.org/tracker/source-package/whois,,,,,,,,,,,,,,,141125,c,program,1,0,0,8,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Less commonly used.
  apache2,,2.2.22-13+deb7u3,Apache HTTP Server metapackage,http://httpd.apache.org/,47,https://security-tracker.debian.org/tracker/source-package/apache2,https://www.openhub.net/projects/apache,Apache HTTP Server,"The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.",http://httpd.apache.org/,http://httpd.apache.org/download.cgi,30,117,1760653,C,apache_2,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",57663,c,metapackage,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Vitally important.  Note, however, that there's already large development & review team in place."
  apache2-utils,apache2,2.2.22-13+deb7u3,utility programs for webservers,http://httpd.apache.org/,47,https://security-tracker.debian.org/tracker/source-package/apache2,https://www.openhub.net/projects/apache,Apache HTTP Server,"The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.",http://httpd.apache.org/,http://httpd.apache.org/download.cgi,30,117,1760653,C,apache_2,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",68140,c,program,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Vitally important.  Note, however, that there's already large development & review team in place."
  lzma,,9.22-2,Compression and decompression in the LZMA format - command line utility,http://www.7-zip.org/sdk.html,0,https://security-tracker.debian.org/tracker/source-package/lzma,https://www.openhub.net/projects/lzmautils,LZMA Utils,gzip- and zlib-like interfaces for LZMA compression from 7-Zip,http://sourceforge.net/projects/lzmautils,,0,2,9659,C++,,,,,,16987,c,program,0,1,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 0, Language: 2, Exposure: 1 , Data only: 0",
  curl,,7.26.0-1+wheezy11,command line tool for transferring data with URL syntax,http://curl.haxx.se,27,https://security-tracker.debian.org/tracker/source-package/curl,https://www.openhub.net/projects/curl,cURL,"curl is a command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, Gopher, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMB, SMTP, SMTPS, Telnet and TFTP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, HTTP/2, cookies, user+password authentication (Basic, Plain, Digest, CRAM-MD5, NTLM, Negotiate and Kerberos), file transfer resume, proxy tunneling and more.",http://curl.haxx.se/,http://curl.haxx.se/download.html,100,345,216504,C,mit,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",58874,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Telnet is a fundamentally insecure protocol and is being phased out.
  samba,,2:3.6.6-6+deb7u4,"SMB/CIFS file, print, and login server for Unix",http://www.samba.org,36,https://security-tracker.debian.org/tracker/source-package/samba,https://www.openhub.net/projects/samba,Samba,"Samba is an Open Source/Free Software suite that provides file and print services to all manner of SMB/CIFS clients, including the numerous versions of Microsoft Windows operating systems.",http://www.samba.org,http://samba.org/samba/download/,83,357,1601907,C,gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",35986,c,program,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",
  apt,,0.9.7.9+deb7u6,commandline package manager,,15,https://security-tracker.debian.org/tracker/source-package/apt,https://www.openhub.net/projects/apt,apt - Advanced Package Tool,"Debian's next generation front-end for the dpkg package manager. It provides the apt-get utility and APT dselect method that provides a simpler, safer way to install and upgrade packages.
  
  APT features complete installation ordering, multiple source capability
  and several other unique features.",https://wiki.debian.org/Apt,http://packages.qa.debian.org/a/apt.html,30,120,71636,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",153955,c++,program,0,1,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  apt-utils,apt,0.9.7.9+deb7u6,package managment related utility programs,,15,https://security-tracker.debian.org/tracker/source-package/apt,https://www.openhub.net/projects/apt,apt - Advanced Package Tool,"Debian's next generation front-end for the dpkg package manager. It provides the apt-get utility and APT dselect method that provides a simpler, safer way to install and upgrade packages.
  
  APT features complete installation ordering, multiple source capability
  and several other unique features.",https://wiki.debian.org/Apt,http://packages.qa.debian.org/a/apt.html,30,120,71636,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",153729,c++,program,0,1,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  aptitude,,0.6.8.2-1,terminal-based package manager,http://aptitude.alioth.debian.org/,0,https://security-tracker.debian.org/tracker/source-package/aptitude,https://www.openhub.net/projects/aptitude,Aptitude,"Aptitude's goal is to be a highly configurable console frontend for the Debian Advanced Package Tool, based heavily on hierarchical display of information about packages.",http://aptitude.alioth.debian.org/,http://packages.qa.debian.org/a/aptitude.html,2,38,139612,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,151211,c++,program,0,0,0,7,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  aptitude-common,aptitude,0.6.8.2-1,architecture indepedent files for the aptitude package manager,http://aptitude.alioth.debian.org/,0,https://security-tracker.debian.org/tracker/source-package/aptitude,https://www.openhub.net/projects/aptitude,Aptitude,"Aptitude's goal is to be a highly configurable console frontend for the Debian Advanced Package Tool, based heavily on hierarchical display of information about packages.",http://aptitude.alioth.debian.org/,http://packages.qa.debian.org/a/aptitude.html,2,38,139612,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,124609,,,0,0,0,7,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  at,,3.1.13-2+deb7u1,Delayed job execution and batch processing,,0,https://security-tracker.debian.org/tracker/source-package/at,https://www.openhub.net/projects/at,,,,,,,,,,,,,,135674,c,program,0,0,1,7,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Could potentially enable local privilege escalation.
  binutils,,2.22-8,"GNU assembler, linker and binary utilities",,9,https://security-tracker.debian.org/tracker/source-package/binutils,https://www.openhub.net/projects/binutils,GNU binutils,"The GNU linker and related programs and libraries: ar, as, gprof, ld, nm, ranlib, strip, libbfd.  You depend on this utterly.",http://www.gnu.org/software/binutils/,http://ftp.gnu.org/gnu/binutils/,173,569,4635179,C,gpl3,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Very large, active development team",115428,c,program,0,0,1,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Vital software for a running system.  Active maintenance.  Includes many subcomponents; some components might need review, but hard to tell because they're managed as a group."
  coreutils,,8.13-3.5,GNU core utilities,http://gnu.org/software/coreutils,7,https://security-tracker.debian.org/tracker/source-package/coreutils,https://www.openhub.net/projects/coreutils,GNU Core Utilities,"The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU Operating System.
  
  Specifically, this package includes:
  
negative.code: easy to use and uniform interface to access the content of font
  files.
  FreeType 2 is released under two open-source licenses: our own
  BSD-like FreeType License and the GPL.",http://www.freetype.org/,http://sourceforge.net/projects/freetype/files/latest/download,11,111,302226,C,ftl gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",173869,c,shared-lib,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Dangerous.  Processes data from network, including fonts embedded in websites. Main site http://www.freetype.org/ Last release FreeType 2.5.5, 2014-12-30. Git repo. Very active git repo by multiple contributors. ++"
  libgcrypt11,,1.5.0-5+deb7u2,LGPL Crypto library - runtime library,http://directory.fsf.org/project/libgcrypt/,4,https://security-tracker.debian.org/tracker/source-package/libgcrypt11,https://www.openhub.net/projects/libgcrypt,libgcrypt,Libgcrypt is a general purpose crypto library based on the code used in GnuPG.,http://www.gnupg.org,http://www.gnupg.org/download/index.html#libgcrypt,8,28,155486,C,gpl lgpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",129985,,,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Crypto library, security-relevant. LGPL crypto library. Part of GnuPG (GNU Privacy Guard). http://ftp.gnupg.org/gcrypt/libgcrypt/. Already selected by CII. ++"
  libgdbm3,gdbm,1.8.3-11,GNU dbm database routines (runtime version),http://directory.fsf.org/project/gdbm/,0,https://security-tracker.debian.org/tracker/source-package/gdbm,https://www.openhub.net/projects/libgdbm,libgdbm,GNU dbm is a set of database routines that use extendible hashing and works similar to the standard UNIX dbm routines.,http://www.gnu.org/software/gdbm/,http://www.gnu.org.ua/software/gdbm/download.html,1,2,10735,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,175812,c,shared-lib,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libgpm2,gpm,1.20.4-6,General Purpose Mouse - shared library,http://www.nico.schottelius.org/software/gpm/,0,https://security-tracker.debian.org/tracker/source-package/gpm,https://www.openhub.net/projects/gpm,gpm,The gpm (general purpose mouse) daemon tries to be a useful mouse server for applications running on the Linux console. It provides console cut and paste operations.,http://www.nico.schottelius.org/software/gpm/,http://www.nico.schottelius.org/software/gpm/,2,15,10286,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Small development team,169482,c,shared-lib,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libisc84,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,ISC Shared Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",76818,,,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  libisccc80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Command Channel Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",77385,,,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  libisccfg82,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Config File Handling Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",77208,,,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  libk5crypto3,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - Crypto Library,http://web.mit.edu/kerberos/,45,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,21,96,388789,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",168797,c,shared-lib,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0",Kerberos.
  libkrb5support0,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - Support library,http://web.mit.edu/kerberos/,45,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,21,96,388789,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",168801,c,shared-lib,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0",Kerberos.
  liblockfile-bin,liblockfile,1.09-5,support binaries for and cli utilities based on liblockfile,,0,https://security-tracker.debian.org/tracker/source-package/liblockfile,https://www.openhub.net/projects/liblockfile,liblockfile,"NFS-safe locking library, includes dotlockfile program",https://github.com/pld-linux/liblockfile,,1,4,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Only a single active developer,138581,c,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  liblockfile1,liblockfile,1.09-5,NFS-safe locking library,,0,https://security-tracker.debian.org/tracker/source-package/liblockfile,https://www.openhub.net/projects/liblockfile,liblockfile,"NFS-safe locking library, includes dotlockfile program",https://github.com/pld-linux/liblockfile,,1,4,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Only a single active developer,164629,c,shared-lib,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libncurses5,ncurses,5.9-10,shared libraries for terminal handling,http://invisible-island.net/ncurses/,0,https://security-tracker.debian.org/tracker/source-package/ncurses,https://www.openhub.net/projects/ncurses,GNU Ncurses,"The Ncurses (new curses) library is a free software emulation of curses in System V Release 4.0, and more. It uses Terminfo format, supports pads and color and multiple highlights and forms characters and function-key mapping, and has all the other SYSV-curses enhancements over BSD Curses.
  
  The ncurses code was developed under GNU/Linux. It has been in use for some time with OpenBSD as the system curses library, and on FreeBSD and NetBSD as an external package. It should port easily to any ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
  
  The distribution includes the library and support utilities, including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Full manual pages are provided for the library and tools.
  
  The Ncurses distribution is available via anonymous FTP at the GNU distribution site",http://www.gnu.org/software/ncurses/,http://ftp.gnu.org/pub/gnu/ncurses,1,2,219912,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,175849,c,shared-lib,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libncursesw5,ncurses,5.9-10,shared libraries for terminal handling (wide character support),http://invisible-island.net/ncurses/,0,https://security-tracker.debian.org/tracker/source-package/ncurses,https://www.openhub.net/projects/ncurses,GNU Ncurses,"The Ncurses (new curses) library is a free software emulation of curses in System V Release 4.0, and more. It uses Terminfo format, supports pads and color and multiple highlights and forms characters and function-key mapping, and has all the other SYSV-curses enhancements over BSD Curses.
  
  The ncurses code was developed under GNU/Linux. It has been in use for some time with OpenBSD as the system curses library, and on FreeBSD and NetBSD as an external package. It should port easily to any ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
  
  The distribution includes the library and support utilities, including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Full manual pages are provided for the library and tools.
  
  The Ncurses distribution is available via anonymous FTP at the GNU distribution site",http://www.gnu.org/software/ncurses/,http://ftp.gnu.org/pub/gnu/ncurses,1,2,219912,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,175827,c,shared-lib,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libnewt0.52,newt,0.52.14-11.1,Not Erik's Windowing Toolkit - text mode windowing with slang,https://fedorahosted.org/newt/,0,https://security-tracker.debian.org/tracker/source-package/newt,https://www.openhub.net/projects/newt,Ne.W.T.,NEthack With Tiles - A graphical interface for NetHack and Slash'EM,http://www.darkarts.co.za/newt,,1,1,698779,C,nethack,,,,,175389,c,shared-lib,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libpam-modules-bin,pam,1.1.3-7.1,Pluggable Authentication Modules for PAM - helper binaries,http://pam.sourceforge.net/,15,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,7,20,57169,C,BSD-3-Clause gpl gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",147454,c,plugin,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Critical central role for authentication.  Real site is http://www.linux-pam.org/ (Debian lists as http://pam.sourceforge.net/ but that points to https://fedorahosted.org/linux-pam/ which points to this). It has a somewhat active mailing list, and an active issue tracker where issues are clearly opened and closed. Stable version is somewhat old (2013); recent changes in git though relatively small (https://git.fedorahosted.org/cgit/linux-pam.git/) ++"
  libpipeline1,libpipeline,1.2.1-1,pipeline manipulation library,http://libpipeline.nongnu.org/,0,https://security-tracker.debian.org/tracker/source-package/libpipeline,https://www.openhub.net/projects/libpipeline,libpipeline,"libpipeline is a C library for setting up and running pipelines of processes, without needing to involve shell command-line parsing which is often error-prone and insecure.",http://libpipeline.nongnu.org/,,1,6,87488,C,gpl3,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,147386,,shared-lib,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libpng12-0,libpng,1.2.49-1,PNG library - runtime,http://libpng.org/pub/png/libpng.html,20,https://security-tracker.debian.org/tracker/source-package/libpng,https://www.openhub.net/projects/libpng,libpng,"libpng is the official PNG reference library. It supports almost all PNG features, is extensible, and has been extensively tested for over 17 years.
  
  libpng is available as ANSI C source code and requires zlib 1.0.4 or later (1.2.3 or 1.1.4 recommended due to potential security vulnerabilities in earlier versions). In addition to the main library sources, libpng includes the rpng, rpng2 and wpng demo programs, the pngminus demo program, a subset of Willem van Schaik's PngSuite test images, and Willem's VisualPng demo program.  Configure, CMake, Visualc projects, and various makefiles are included for building libpng.
  
  Libpng is under the libpng license.",http://www.libpng.org/pub/png/libpng.html,http://sourceforge.net/project/showfiles.php?group_id=5624,5,10,407995,C,libpng,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,161259,c,shared-lib,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can Access Source code, Not much activity - just warnings about CVEs that were fixed. +++"
  libpopt0,popt,1.16-7,lib for parsing cmdline parameters,http://rpm5.org/,0,https://security-tracker.debian.org/tracker/source-package/popt,https://www.openhub.net/projects/popt,popt,"popt is a command line option parsing library. While it is similiar
  to getopt, it contains a number of enhancements, including:
  
  1) popt is fully reentrant
  2) popt can parse arbitrary argv[] style arrays while getopt(3) makes this quite difficult
  3) popt allows users to alias command line arguments
  4) popt provides convience functions for parsing strings into argv[] style arrays",http://rpm5.org,http://rpm5.org/files/popt/,1,15,6165,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,175782,c,shared-lib,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libreadline6,readline6,6.2+dfsg-0.1,"GNU readline and history libraries, run-time libraries",,1,https://security-tracker.debian.org/tracker/source-package/readline6,,,,,,,,,,,,,,,168989,c,shared-lib,0,0,0,8,"Website points: 1, CVE: 1, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0","Typically interactive same-user use, so unlikely to be security issue."
  libslang2,slang2,2.2.4-15,S-Lang programming library - runtime version,http://www.jedsoft.org/slang/,0,https://security-tracker.debian.org/tracker/source-package/slang2,https://www.openhub.net/projects/s-lang,S-Lang,"S-Lang is a multi-platform programming library designed to allow creation of robust multi-platform software. It provides facilities required by interactive applications, including display/screen management, keyboard input, and keymaps. A major feature of the library is the S-Lang interpreter that may be easily embedded into a program to make it extensible. The interpreter may also be used in a stand-alone fashion through the use of slsh, which is part of the S-Lang distribution.",http://www.jedsoft.org/slang,http://www.jedsoft.org/slang/download.html,2,4,115067,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Small development team,175800,,shared-lib,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libtasn1-3,,2.13-2+deb7u1,Manage ASN.1 structures (runtime),http://www.gnu.org/software/libtasn1/,6,https://security-tracker.debian.org/tracker/source-package/libtasn1-3,,,,,,,,,,,,,,,123177,,,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 2, Popularity: 2, Language: 0, Exposure: 1 , Data only: 0","Important because X.509 certificates (standard for certificates) use ASN.1. A Gnu project, git repo and mailing list available from home page. No issue tracker found. Search on 'security' in mailing list archives shows a few messages from Debian using security-related compiler flags. Debian security page shows a history of CVE's being fixed, most recent in 2014. OpenHub page at https://www.openhub.net/p/libtasn1 gives stats. Active effort of one developer, with others contributing as recently as 9 months ago. ++"
  libtinfo5,ncurses,5.9-10,shared low-level terminfo library for terminal handling,http://invisible-island.net/ncurses/,0,https://security-tracker.debian.org/tracker/source-package/ncurses,https://www.openhub.net/projects/ncurses,GNU Ncurses,"The Ncurses (new curses) library is a free software emulation of curses in System V Release 4.0, and more. It uses Terminfo format, supports pads and color and multiple highlights and forms characters and function-key mapping, and has all the other SYSV-curses enhancements over BSD Curses.
  
  The ncurses code was developed under GNU/Linux. It has been in use for some time with OpenBSD as the system curses library, and on FreeBSD and NetBSD as an external package. It should port easily to any ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
  
  The distribution includes the library and support utilities, including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Full manual pages are provided for the library and tools.
  
  The Ncurses distribution is available via anonymous FTP at the GNU distribution site",http://www.gnu.org/software/ncurses/,http://ftp.gnu.org/pub/gnu/ncurses,1,2,219912,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,148323,c,shared-lib,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libuuid-perl,,0.02-5,Perl extension for using UUID interfaces as defined in e2fsprogs,http://search.cpan.org/dist/UUID/,0,https://security-tracker.debian.org/tracker/source-package/libuuid-perl,https://www.openhub.net/projects/data-uuid,data-uuid,perl library for generating universally unique identifiers,http://github.com/rjbs/data-uuid,,2,13,1118,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Small development team,167587,perl,devel-lib,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libwrap0,tcp-wrappers,7.6.q-24,Wietse Venema's TCP wrappers library,,0,https://security-tracker.debian.org/tracker/source-package/tcp-wrappers,,,,,,,,,,,,,,,175573,c,shared-lib,0,1,0,8,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0",Exposed to the network (wraps incoming requests). Has some security-relevant functions. Relatively small.
  libxml2,,2.8.0+dfsg1-7+wheezy2,GNOME XML library,http://xmlsoft.org/,19,https://security-tracker.debian.org/tracker/source-package/libxml2,https://www.openhub.net/projects/libxml2,libxml2,"Libxml2 is the XML C parser and toolkit developed for the Gnome project (but usable outside of the Gnome platform).
  
  Includes the xmllint tool for checking documents for well-formedness, validating documents against a DTD or XML Schema, and pretty printing XML input.",http://www.xmlsoft.org/,http://www.xmlsoft.org/downloads.html,26,220,501621,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",174051,,,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Processes attacker-provided data. HAS Home Page, Has bug tracker https://bugzilla.gnome.org/buglist.cgi?product=libxml2 which is very active. ++"
  m4,,1.4.16-3,a macro processing language,http://www.gnu.org/software/m4/,0,https://security-tracker.debian.org/tracker/source-package/m4,https://www.openhub.net/projects/m4,GNU M4,"GNU M4 is an implementation of the traditional Unix macro processor. It is mostly SVR4 compatible although it has some extensions (for example, handling more than 9 positional parameters to macros). GNU m4 also has built-in functions for including files, running shell commands, doing arithmetic, etc.",http://www.gnu.org/software/m4/,https://savannah.gnu.org/projects/m4/,3,16,79426,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,158703,c,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  mawk,,1.3.3-17,a pattern scanning and text processing language,,0,https://security-tracker.debian.org/tracker/source-package/mawk,https://www.openhub.net/projects/mawk,mawk,"An interpreter for the AWK Programming Language. 
  
  Originally written by Mike Brennan when gawk was not widely known, it remains the fastest free and decent AWK implementation to date.",http://invisible-island.net/mawk/mawk.html,http://invisible-island.net/datafiles/release/mawk.tar.gz,2,5,33481,C,GNU_General_Public_License_v2_0_only,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,175495,c,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  mlocate,,0.23.1-1,quickly find files on the filesystem based on their name,http://carolina.mff.cuni.cz/~trmac/blog/mlocate,0,https://security-tracker.debian.org/tracker/source-package/mlocate,https://www.openhub.net/projects/mlocate,mlocate,"mlocate is a new locate implementation. The  m  stands for  merging : updatedb reuses the existing database to avoid rereading most of the file system, which makes updatedb faster and does not trash the system caches as much.
  
  The locate(1) utility is intended to be completely compatible to slocate. It also attempts to be compatible to GNU locate, when it does not conflict with slocate compatibility.",https://fedorahosted.org/mlocate,https://fedorahosted.org/mlocate/wiki/MlocateDownloads,1,51,3392,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,151204,c,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  mutt,,1.5.21-6.2+deb7u3,"text-based mailreader supporting MIME, GPG, PGP and threading",http://www.mutt.org/,3,https://security-tracker.debian.org/tracker/source-package/mutt,https://www.openhub.net/projects/mutt,mutt,"Mutt is a small but very powerful text-based mail client for Unix operating systems.
  
  Though written from scratch, Mutt's initial interface was based largely on the ELM mail client. To a large extent, Mutt is still very ELM-like in presentation of information in menus (and in fact, ELM users will find it quite painless to switch as the default key bindings are identical). As development progressed, features found in other popular clients such as PINE and MUSH have been added, the result being a hybrid, or ""mutt.""",http://www.mutt.org/,http://www.mutt.org/download.html,7,210,94261,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",153928,,,1,0,0,8,"Website points: 0, CVE: 2, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0",Rarely used in practice
  ncurses-bin,ncurses,5.9-10,terminal-related programs and man pages,http://invisible-island.net/ncurses/,0,https://security-tracker.debian.org/tracker/source-package/ncurses,https://www.openhub.net/projects/ncurses,GNU Ncurses,"The Ncurses (new curses) library is a free software emulation of curses in System V Release 4.0, and more. It uses Terminfo format, supports pads and color and multiple highlights and forms characters and function-key mapping, and has all the other SYSV-curses enhancements over BSD Curses.
  
  The ncurses code was developed under GNU/Linux. It has been in use for some time with OpenBSD as the system curses library, and on FreeBSD and NetBSD as an external package. It should port easily to any ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
  
  The distribution includes the library and support utilities, including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Full manual pages are provided for the library and tools.
  
  The Ncurses distribution is available via anonymous FTP at the GNU distribution site",http://www.gnu.org/software/ncurses/,http://ftp.gnu.org/pub/gnu/ncurses,1,2,219912,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,175851,c,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  passwd,shadow,1:4.1.5.1-1,change and administer password and group data,http://pkg-shadow.alioth.debian.org/,2,https://security-tracker.debian.org/tracker/source-package/shadow,https://www.openhub.net/projects/shadow-tool-suite,Shadow Tool Suite,"The shadow tool suite contains the following commands among others: login, passwd, useradd, groupadd.",http://pkg-shadow.alioth.debian.org/,http://pkg-shadow.alioth.debian.org/download.php,7,20,127125,C,bsd,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",175849,c,program,1,0,0,8,"Website points: 0, CVE: 2, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0",Critical for security; unclear if undicovered vulnerabilities are likely to be here.
  psmisc,,22.19-1+deb7u1,utilities that use the proc file system,http://psmisc.sf.net/,0,https://security-tracker.debian.org/tracker/source-package/psmisc,https://www.openhub.net/projects/psmisc,psmisc,"This PSmisc package is a set of some small useful utilities that use the proc filesystem. We're not about changing the world, but providing the system administrator with some help in common tasks.
  
  There is options for using SELinux if you need it and fuser understands IPv6. It also speaks various languages using the gettext facilities.",http://psmisc.sourceforge.net/,http://psmisc.sourceforge.net/,3,21,9265,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Small development team,170761,c,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  python-soappy,,0.12.0-4,SOAP Support for Python,http://pywebsvcs.sourceforge.net/,2,https://security-tracker.debian.org/tracker/source-package/python-soappy,https://www.openhub.net/projects/python-soappy,python-soappy,,,,0,7,8587,Python,,Stable Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,132671,python,app-data,1,0,0,8,"Website points: 0, CVE: 2, 12-month contributor: 5, Popularity: 2, Language: 0, Exposure: 2 , Data only: -3",
  python-support,,1.0.15,automated rebuilding support for Python modules,,0,https://security-tracker.debian.org/tracker/source-package/python-support,https://www.openhub.net/projects/python-support,python-support,,,,0,4,1031,Python,,Stable Y-O-Y development activity,Well-established codebase,Few source code comments,No recent development activity,165759,python,program,0,0,0,8,"Website points: 1, CVE: 0, 12-month contributor: 5, Popularity: 2, Language: 0, Exposure: 0 , Data only: 0",
  rpcbind,,0.2.0-8,converts RPC program numbers into universal addresses,http://sourceforge.net/projects/rpcbind/,2,https://security-tracker.debian.org/tracker/source-package/rpcbind,https://www.openhub.net/projects/rpcbind,RPCBind,The rpcbind utility is a server that converts RPC program numbers into universal addresses. Note: The SVN Repository on this site is *not* used. Use the git://git.infradead.org/~steved/rpcbind.git GIT tree,http://sourceforge.net/projects/rpcbind,,,,,,,,,,,127830,,program,1,0,0,8,"Website points: 0, CVE: 2, 12-month contributor: 2, Popularity: 2, Language: 0, Exposure: 2 , Data only: 0","IPC communication, including network communcation from untrustworthy sources."
  samba,,2:3.6.6-6+deb7u4,"SMB/CIFS file, print, and login server for Unix",http://www.samba.org,36,https://security-tracker.debian.org/tracker/source-package/samba,https://www.openhub.net/projects/samba,Samba,"Samba is an Open Source/Free Software suite that provides file and print services to all manner of SMB/CIFS clients, including the numerous versions of Microsoft Windows operating systems.",http://www.samba.org,http://samba.org/samba/download/,83,357,1601907,C,gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",40000,c,program,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",
  traceroute,,1:2.0.18-3,Traces the route taken by packets over an IPv4/IPv6 network,http://traceroute.sourceforge.net/,0,https://security-tracker.debian.org/tracker/source-package/traceroute,,,,,,,,,,,,,,,175056,c,program,1,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0","Attackers could conceivably reply with attack (using malicious packets), that'd be sneaky."
  virtualbox-guest-x11,virtualbox,4.1.18-dfsg-2+deb7u3,x86 virtualization solution - X11 guest utilities,http://www.virtualbox.org/,27,https://security-tracker.debian.org/tracker/source-package/virtualbox,https://www.openhub.net/projects/virtualbox,Oracle VM VirtualBox,"Oracle VM VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. VirtualBox is an extremely feature rich, high performance product for enterprise customers.
  
  VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,5615,,app-data,0,0,1,8,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: -3",
  virtualbox-ose-guest-x11,virtualbox,4.1.18-dfsg-2+deb7u3,transitional package for virtualbox-guest-x11,http://www.virtualbox.org/,27,https://security-tracker.debian.org/tracker/source-package/virtualbox,https://www.openhub.net/projects/virtualbox,Oracle VM VirtualBox,"Oracle VM VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. VirtualBox is an extremely feature rich, high performance product for enterprise customers.
  
  VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,3792,,app-data,0,0,1,8,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: -3",
  vlc,,2.0.3-5+deb7u1,multimedia player and streamer,http://www.videolan.org/vlc/,47,https://security-tracker.debian.org/tracker/source-package/vlc,https://www.openhub.net/projects/vlc,VLC media player,"VLC - the cross-platform media player and streaming server
  
  VLC media player is a highly portable multimedia player for various audio and video formats (MPEG-1, MPEG-2, MPEG-4, DivX, mp3, ogg, ...) as well as DVDs, VCDs, and various streaming protocols. It can also be used as a server to stream in unicast or multicast in IPv4 or IPv6 on a high-bandwidth network.",http://videolan.org/,http://www.videolan.org/vlc/,102,709,612716,C,gpl lgpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",55630,c,program,0,1,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0",
  wget,,1.13.4-3+deb7u2,retrieves files from the web,http://www.gnu.org/software/wget/,2,https://security-tracker.debian.org/tracker/source-package/wget,https://www.openhub.net/projects/wget,Wget,"GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.",http://www.gnu.org/software/wget/,http://ftp.gnu.org/pub/gnu/wget/,35,119,41658,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",175676,,,1,0,0,8,"Website points: 0, CVE: 2, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0","Directly processes potentially-malicious data from the Internet, often used in scripts. GNU project. https://www.gnu.org/software/wget/ Actual development on GNU's Savannah using git and its bugtracker, http://savannah.gnu.org/projects/wget/ Actively developed, many patches. wget-1.16.3 released 2015-03-09 on downloads. Note that this is directly exposed to attack.  It has some code documentation (e.g., http://wget.addictivecode.org/NavigatingTheSource), but it warns that it can be fairly hard to follow, contains a fair number of hacks, and functionality that was ""tacked on"" (which is not good for security). ++"
  whiptail,newt,0.52.14-11.1,Displays user-friendly dialog boxes from shell scripts,https://fedorahosted.org/newt/,0,https://security-tracker.debian.org/tracker/source-package/newt,https://www.openhub.net/projects/newt,Ne.W.T.,NEthack With Tiles - A graphical interface for NetHack and Slash'EM,http://www.darkarts.co.za/newt,,1,1,698779,C,nethack,,,,,175209,c,program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  xauth,,1:1.0.7-1,X authentication utility,,0,https://security-tracker.debian.org/tracker/source-package/xauth,,,,,,,,,,,,,,,166229,c,program,0,0,1,8,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","X Authentication - might enable local privilege escalation.  Home Page: http://www.x.org/ There are current efforts to replace this (e.g., Wayland, Mir). Public code repo is mentioned in dev docs, but clone URL is never stated. Probably given out on request. One nice thing... www.x.org/wiki/Development/Security/ ++"
  xserver-common,xorg-server,2:1.12.4-6+deb7u5,common files used by various X servers,,27,https://security-tracker.debian.org/tracker/source-package/xorg-server,https://www.openhub.net/projects/xserver-xorg-driver-ati,xserver-xorg-driver-ati,,,,12,165,49507,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",98546,,,0,0,0,8,"Website points: 1, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  xserver-xorg-core,xorg-server,2:1.12.4-6+deb7u5,Xorg X server - core server,,27,https://security-tracker.debian.org/tracker/source-package/xorg-server,https://www.openhub.net/projects/xserver-xorg-driver-ati,xserver-xorg-driver-ati,,,,12,165,49507,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",98944,,,0,0,0,8,"Website points: 1, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",X development is transitioning towards Wayland.
  adduser,,3.113+nmu3,add and remove users and groups,http://alioth.debian.org/projects/adduser/,0,https://security-tracker.debian.org/tracker/source-package/adduser,https://www.openhub.net/projects/adduser,adduser,,,,0,4,2646,Perl,,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,No recent development activity,175839,perl,program,0,0,0,7,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 2, Language: 0, Exposure: 0 , Data only: 0",
  apt-listchanges,,2.85.11,package change history notification tool,,0,https://security-tracker.debian.org/tracker/source-package/apt-listchanges,https://www.openhub.net/projects/8066,apt-listchanges,"apt-listchanges is a tool to show what has been changed in a new
   version of a Debian package, as compared to the version currently
   installed on the system.  It does this by extracting the relevant
   entries from the Debian changelog file, and the NEWS.Debian file.
   .
   It can be run on several .deb archives at a time to get a list of all
   of the changes that would be effected by installing or upgrading a
   group of packages.  It can be configured to do this automatically
   during upgrades using apt.",http://packages.debian.org/apt-listchanges,http://packages.debian.org/apt-listchanges,0,2,994,Python,gpl,,,,,141939,python,program,0,0,0,7,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 2, Language: 0, Exposure: 0 , Data only: 0",
  bc,bc (1.06.95-2),1.06.95-2+b1,The GNU bc arbitrary precision calculator language,,0,https://security-tracker.debian.org/tracker/source-package/bc,,,,,,,,,,,,,,,159178,c,program,0,0,0,7,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",Use relatively rare.  Unlikely to process data from attacker.
  bsdutils,util-linux (2.20.1-5.3),1:2.20.1-5.3,Basic utilities from 4.4BSD-Lite,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",175849,c,program,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  busybox,,1:1.20.0-7,Tiny utilities for small and embedded systems,http://www.busybox.net,5,https://security-tracker.debian.org/tracker/source-package/busybox,https://www.openhub.net/projects/busybox,BusyBox,"BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. The utilities in BusyBox generally have fewer options than their full-featured GNU cousins; however, the options that are included provide the expected functionality and behave very much like their GNU counterparts. BusyBox provides a fairly complete environment for any small or embedded system.
  
  BusyBox has been written with size-optimization and limited resources in mind. It is also extremely modular so you can easily include or exclude commands (or features) at compile time. This makes it easy to customize your embedd",http://busybox.net/,http://busybox.net/download.html,41,250,175036,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",172930,,program,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  dnsmasq,,2.62-3+deb7u1,Small caching DNS proxy and DHCP/TFTP server,,3,https://security-tracker.debian.org/tracker/source-package/dnsmasq,https://www.openhub.net/projects/dnsmasq,Dnsmasq,"Dnsmasq is a lightweight, easy to configure DNS forwarder and DHCP server. It is designed to provide DNS and, optionally, DHCP, to a small network. It can serve the names of local machines which are not in the global DNS. The DHCP server integrates with the DNS server and allows machines with DHCP-allocated addresses to appear in the DNS with names configured either in each host or in a central configuration file. Dnsmasq supports static and dynamic DHCP leases and BOOTP/TFTP for network booting of diskless machines.",http://www.thekelleys.org.uk/dnsmasq/doc.html,http://www.thekelleys.org.uk/dnsmasq/doc.html,31,55,30256,C,gpl gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Very large, active development team",4871,c,program,1,1,0,7,"Website points: 0, CVE: 2, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",
  ffmpeg,libav,6:0.8.16-1,"Multimedia player, server, encoder and transcoder (transitional package)",http://libav.org/,188,https://security-tracker.debian.org/tracker/source-package/libav,https://www.openhub.net/projects/ffmpeg,FFmpeg,"FFmpeg is a complete solution to record, convert and stream audio and video. It includes libavcodec, the leading audio/video codec library. FFmpeg is mostly developed under Linux, but portable to operating systems, including Windows.",http://www.ffmpeg.org/,http://www.ffmpeg.org/download.html,305,1321,886911,C,lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Very large, active development team",22984,c,program,0,1,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",
  git,,1:1.7.10.4-1+wheezy1,"fast, scalable, distributed revision control system",http://git-scm.com/,3,https://security-tracker.debian.org/tracker/source-package/git,https://www.openhub.net/projects/git,Git,"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals.",http://git-scm.com/,http://git-scm.com/downloads,173,1345,366634,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",72047,shell,program,0,1,0,7,"Website points: 0, CVE: 2, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0",
  hostname,,3.11,utility to set/show the host name or domain name,,0,https://security-tracker.debian.org/tracker/source-package/hostname,,,,,,,,,,,,,,,175848,c,program,0,0,0,7,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",Relatively small functionality.
  installation-report,,2.49,system installation report,,0,https://security-tracker.debian.org/tracker/source-package/installation-report,https://www.openhub.net/projects/installation-report,installation-report,,,,2,66,468,shell script,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,169061,shell,program,0,0,0,7,"Website points: 1, CVE: 0, 12-month contributor: 4, Popularity: 2, Language: 0, Exposure: 0 , Data only: 0",
  less,,444-4,pager program similar to more,http://www.greenwoodsoftware.com/less/,1,https://security-tracker.debian.org/tracker/source-package/less,,,,,,,,,,,,,,,171054,c,program,0,0,0,7,"Website points: 0, CVE: 1, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",Less likely to be a security vulnerability :-).
  libacl1,acl,2.2.51-8,Access control list shared library,http://savannah.nongnu.org/projects/acl/,0,https://security-tracker.debian.org/tracker/source-package/acl,,,,,,,,,,,,,,,175850,c,shared-lib,0,0,1,7,"Website points: 0, CVE: 0, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Access control-related, so of concern."
  libapr1,apr,1.4.6-3+deb7u1,Apache Portable Runtime Library,http://apr.apache.org/,3,https://security-tracker.debian.org/tracker/source-package/apr,https://www.openhub.net/projects/apr,Apache Portable Runtime,"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.",http://apr.apache.org/,,14,67,419947,C,apache_2,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",125231,c,shared-lib,0,1,0,7,"Website points: 0, CVE: 2, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 1 , Data only: 0","Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  However, it's not as clear that the LDAP library in it is as actively managed. HAS Home Page, HAS Mailing List, Issue tracker https://bz.apache.org/bugzilla/enter_bug.cgi?product=APR \++"
  libaprutil1-ldap,apr-util,1.4.1-3,Apache Portable Runtime Utility Library - LDAP Driver,http://apr.apache.org/,1,https://security-tracker.debian.org/tracker/source-package/apr-util,https://www.openhub.net/projects/apr,Apache Portable Runtime,"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.",http://apr.apache.org/,,14,67,419947,C,apache_2,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",109773,c,shared-lib,1,0,0,7,"Website points: 0, CVE: 1, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0","Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  The LDAP driver is maintained as part of APR, http://apr.apache.org/ The APR-util version 1.5.4 was released September 22, 2014, so it is actively maintained. They use the apache.org repo and subversion; apr-util has been merged into main trunk, making it a little harder to see LDAP specifics to determine if the LDAP portion is active. Mailing list dev@apr.apache.org seems active. ++"
  libblkid1,util-linux,2.20.1-5.3,block device id library,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",175852,c,shared-lib,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libept1.4.12,libept,1.0.9,High-level library for managing Debian package information,,0,https://security-tracker.debian.org/tracker/source-package/libept,,,,,,,,,,,,,,,128570,c++,devel-lib,0,0,0,7,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0","Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  libgl1-mesa-dri,mesa,8.0.5-4+deb7u2,free implementation of the OpenGL API -- DRI modules,http://mesa3d.sourceforge.net/,4,https://security-tracker.debian.org/tracker/source-package/mesa,https://www.openhub.net/projects/mesa,Mesa,"Mesa is an open-source implementation of the OpenGL specification - a system for rendering interactive 3D graphics.
  
  A variety of device drivers allows Mesa to be used in many different environments ranging from software emulation to complete hardware acceleration for modern GPUs.
  
  Mesa ties into several other open-source projects: the Direct Rendering Infrastructure and X.org to provide OpenGL support to users of X on Linux, FreeBSD and other operating systems.",http://sourceforge.net/projects/mesa3d,,167,682,1037410,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",115688,,shared-lib,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libgpgme11,gpgme1.0,1.2.0-1.4+deb7u1,GPGME - GnuPG Made Easy,,1,https://security-tracker.debian.org/tracker/source-package/gpgme1.0,https://www.openhub.net/projects/gpgme,GPGME,"GnuPG Made Easy (GPGME) is a library designed to make access to GnuPG easier for applications. It provides a High-Level Crypto API for encryption, decryption, signing, signature verification and key management. Currently it uses GnuPG as its backend but the API isn't restricted to this engine; in fact we have already developed a backend for CMS (S/MIME).",http://www.gnupg.org/gpgme.html,http://www.gnupg.org/download/index.html#gpgme,4,16,71180,C,lgpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,154299,c,shared-lib,1,0,0,7,"Website points: 0, CVE: 1, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 2 , Data only: 0","Vital for protecting email (see gpg) Git repo available. Issue tracker site uses self-signed cert; it's concerning that a user would have to compromise the HTTPS security model just to view and interact with the bug tracker. Openhub doesn't reflect their mailing lists in *multiple languages*. Appears to be actively maintained mostly by one dev, but notably just got donations supporting him for the next 2-3 years. ++"
  libgssglue1,libgssglue,0.4-2,mechanism-switch gssapi library,http://www.citi.umich.edu/projects/nfsv4/linux/,1,https://security-tracker.debian.org/tracker/source-package/libgssglue,,,,,,,,,,,,,,,101975,,shared-lib,1,0,0,7,"Website points: 0, CVE: 1, 12-month contributor: 2, Popularity: 2, Language: 0, Exposure: 2 , Data only: 0",Vital for systems that use it; amount of use unclear.
  liblocale-gettext-perl,liblocale-gettext-perl (1.05-7),1.05-7+b1,module using libc functions for internationalization in Perl,http://search.cpan.org/dist/gettext/gettext.pm,0,https://security-tracker.debian.org/tracker/source-package/liblocale-gettext-perl,https://www.openhub.net/projects/catatylstgettex,Catalyst::Plugin::I18N::Gettext,The Perl module Catalyst::Plugin::I18N::Gettext is a internationalization plugin using GNU gettext in the Catalyst framework without using module Locale::Maketext.,http://sourceforge.net/projects/catatylstgettex/,,0,1,290,Perl,,Stable Y-O-Y development activity,Short source control history,Average number of code comments,No recent development activity,175708,perl,devel-lib,0,0,0,7,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 2, Language: 0, Exposure: 0 , Data only: 0",
  libmount1,util-linux,2.20.1-5.3,block device id library,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,81,405,120553,C,bsd gpl3_or_later lgpl21_or_later Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",147667,c,shared-lib,0,0,0,7,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 2, Language: 2, Exposure: 0 , Data only: 0",
  libpolarssl-runtime,polarssl,1.2.9-1~deb7u3,lightweight crypto and SSL/TLS library,http://polarssl.org,13,https://security-tracker.debian.org/tracker/source-package/polarssl,https://www.openhub.net/projects/polarssl,PolarSSL,"PolarSSL is a light-weight open-source cryptographic library for embedded systems.
  
  Its designed to be:
  