anchor.diff:  xserver-common,xorg-server,xserver-xorg-driver-ati,xorg,, common files used by various X servers,Standard System Utilities,0,0,0,,,
   xserver-xorg-core,xorg-server,xserver-xorg-driver-ati,xorg,, Xorg X server - core server,Standard System Utilities,0,0,0,X development is transitioning towards Wayland.,,
   xz-utils,,xz-utils,xz-utils,, XZ-format compression utilities,Standard System Utilities,0,1,0,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. HAS Home Page, public code repo http://git.tukaani.org/?p=xz.git;a=summary - fairly active by small # of committers.  Some mailing list activity.  No bug tracker found. ++",,
  -zlib1g,zlib,zlib,zlib,, compression library - runtime,Standard System Utilities,0,1,0,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. HAS Home Page, has mailing list zlib@gzip.org, NO issue tracker, Latest release April 2013 (old). +++",,
  -analog,,AnalogCAmie,analog,, web server log analyzer,Web Server,1,0,0,"Web log analyzer, analyzes attacker-provided data.  Could conceivably be way to attack via maliciously-formatted data for logging.",Analyzes data provided by potential attackers,
  -apache2,,apache,apache2,, Apache HTTP Server metapackage,Web Server,1,0,0,"Vitally important.  Note, however, that there's already large development & review team in place.",,
  -apache2-doc,apache2,apache,apache2,, Apache HTTP Server documentation,Web Server,0,0,0,,,
  -apache2-mpm-worker,apache2,apache,apache2,, Apache HTTP Server - high speed threaded model,Web Server,1,0,0,"Vitally important.  Note, however, that there's already large development & review team in place.",,
  -apache2-utils,apache2,apache,apache2,, utility programs for webservers,Web Server,1,0,0,"Vitally important.  Note, however, that there's already large development & review team in place.",,
  -apache2.2-bin,apache2,apache,apache2,, Apache HTTP Server common binary files,Web Server,1,0,0,,,
  -apache2.2-common,apache2,apache,apache2,, Apache HTTP Server common files,Web Server,1,0,0,,,
  -libapr1,apr,apr,apr,, Apache Portable Runtime Library,Web Server,0,1,0,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  However, it's not as clear that the LDAP library in it is as actively managed. HAS Home Page, HAS Mailing List, Issue tracker https://bz.apache.org/bugzilla/enter_bug.cgi?product=APR \++",,
  -libaprutil1,apr-util,apr,apr,, Apache Portable Runtime Utility Library,Web Server,0,1,0,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  However, it's not as clear that the LDAP library in it is as actively managed. HAS Home Page, HAS Mailing List, Issue tracker https://bz.apache.org/bugzilla/enter_bug.cgi?product=APR \++",,
  -libaprutil1-dbd-sqlite3,apr-util,apr,apr,, Apache Portable Runtime Utility Library - SQLite3 Driver,Web Server,0,0,0,,,
  -libaprutil1-ldap,apr-util,apr,apr,, Apache Portable Runtime Utility Library - LDAP Driver,Web Server,1,0,0,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  The LDAP driver is maintained as part of APR, http://apr.apache.org/ The APR-util version 1.5.4 was released September 22, 2014, so it is actively maintained. They use the apache.org repo and subversion; apr-util has been merged into main trunk, making it a little harder to see LDAP specifics to determine if the LDAP portion is active. Mailing list dev@apr.apache.org seems active. ++",,
  -libgd2-noxpm,libgd2,libgd,libgd,, GD Graphics Library version 2 (without XPM support),Web Server,0,1,0,,,
  -libjpeg8,,libjpeg,libjpeg,, Independent JPEG Group's JPEG runtime library,Web Server,0,1,0,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can download as tarball, NO issue tracker, latest version/activity Jan 2014, NO mailing list +++",,
  -libpng12-0,libpng,libpng,libpng,, PNG library - runtime,Web Server,0,1,0,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can Access Source code, Not much activity - just warnings about CVEs that were fixed. +++",,
  -ssl-cert,,debconf,debconf,, simple debconf wrapper for OpenSSL,Web Server,1,0,0,See OpenSSL.,,
  -task-web-server,tasksel,tasksel,tasksel,, Web server,Web Server,0,0,0,,,
  -,,,,,,,,,,,,
  -coolkey,,,coolkey,,,,0,1,0,"Smart card drivers.  Not used in many environments, but critically important for security in other environments.  Activity unclear. Managed via Fedora packaging active here: https://apps.fedoraproject.org/packages/coolkey but that is not where the real code is maintained. Important for users of PKCS#11, but slightly specialized. http://pkgs.fedoraproject.org/gitweb/?p=coolkey.git http://pkg-coolkey.alioth.debian.org/ ++",,
  -gnutls-bin,,gnutls,gnutls-bin,,,,1,0,0,See GnuTLS.,,
  -libopencryptoki0,,,libopencryptoki0,,,,0,1,0,,,
  -libpolarssl-runtime,,polarssl,libpolarssl,,,,1,0,0,SSL/TLS library.  Protocol is important.  This implementation is less widely used.,,
  -bouncycastle,,5523,bouncycastle,,,,1,0,0,,,
  -libressl,,libressl,libressl,,,,1,0,0,"Fork of OpenSSL. HAS Home Page, Can Download as tarball,  VERY Active on Github https://github.com/libressl-portable/portable ++",,
  -,,,,,,,,,,,,
  +yum,,yum,,,,,1,0,0,"This is used by RPM-based systems to download/install programs. It is anticipated that this will be replaced with DNF in Fedora at least (https://lwn.net/Articles/580223/).",,
   zip,,infozip,zip,,,,0,1,0,,,
  -unzip,,infozip,unzip,,,,0,1,0,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can Download Binaries, NO issue tracker. +++",,
  -lzma,,lzmautils,lzma,,,,0,1,0,,,
  -,,,,,,,,,,,,
  -ntp,,,ntp,,,,1,0,0,"Directly connects to network and open to attack. HAS Home Page, NO issue tracker, Has Mailing list, public repo. CII investing. ++",,
  -bootp,,,bootp,,,,1,0,0,Bootp has basic seucurity issues.,,
  -curl,,curl,curl,,,,1,0,0,Telnet is a fundamentally insecure protocol and is being phased out.,,
  -,,,,,,,,,,,,
  -binutils-dev,,binutils,binutils-dev,,,,0,0,0,,,
  -,,,,,,,,,,,,
  -libpng3,,libpng,libpng3,,,,0,1,0,,,
  -libpng,,libpng,libpng,,,,0,1,0,,,
  -libzrtp,,,libzrtp,,,,0,1,0,Unclear how widely this is used.,Voice encryption/decryption,
  -libgif4,,giflib,libgif4,,,,0,1,0,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Active issue tracker, Mailing list, public repo. ++",,
  -,,,,,,,,,,,,
  -libzrtpcpp2,,,libzrtpcpp2,,,,0,1,0,,Voice encryption/decryption,
  -,,,,,,,,,,,,
  -sendmail,sendmail,4536,,,,,1,0,0,"This is a widely-used mail transfer agent (MTA). Sendmail main site https://www.sendmail.com/sm/open_source/
  -No public repo found.  However, they have tarball “snapshots”; on 2015-03-13 the current snapshot was 2015-03-06. This indicates active development, but its development seems opaque so difficult to say more. Version 8.15.1 posted 2014-12-06.",,
  -libapache2-mod-gnutls ,mod-gnutls,mod_gnutls,,,,,1,0,0,"This is in widespread use for SSL/TLS on webservers; it uses GnuTLS instead of OpenSSL.  Old website http://www.outoforder.cc/projects/apache/mod_gnutls/ points to newer site ""https://mod.gnutls.org/?outoforder-ref"".  At newer site the mailing list has a few relevant postings/month, though the March 2015 postings raise concerns about dropped patches.  The bug tracker is badly spammed and one seems to be fixing/addressing it.  Last release 17-Feb-2014.  This looks like it badly needs help. +++ ",,
  -postfix,,postfix,,,,,1,0,0,"This is a widely-used mail transfer agent (MTA).
  -Postfix was created by Wietse Venema, main site www.postfix.org.  On February 8, 2015 Postfix released 3.0.0, so currently active.  Developer mailing list postfix-devel has activity. (e.g., http://news.gmane.org/gmane.mail.postfix.devel/cutoff=2948).  There is no public repo; Wietse (the lead developer) does not want to allow any external review before formal release, as noted in https://groups.google.com/forum/#!topic/mailing.postfix.users/6Kkel3J_nv4 (The Debian package may be an obsolete fork; the Debian package has been assembled by LaMont Jones from sources available from http://www.postfix.org, and can be cloned from git via: git clone git://git.debian.org/~lamont/postfix.git.  Changes on http://anonscm.debian.org/cgit/users/lamont/postfix.git/log/ in git stop in 2011.) ++",,
  -cryptsetup,,cryptsetup,,,,,0,0,1,"This is used to set up disk encryption (at rest), e.g., Linux Unified Key Setup (LUKS).  Home page http://code.google.com/p/cryptsetup , uses git. Tracker in active use.  Latest version 1.6.6 released 2014-08-16.  Development ongoing; 8 commits in February 2015. ++",,
  -yum,,yum,,,,,1,0,0,"This is used by RPM-based systems to download/install programs.
  -It is anticipated that this will be replaced with DNF in
  -Fedora at least (https://lwn.net/Articles/580223/).",,
  -rpm,,rpm,,,,,0,1,0,"This is used by RPM-based systems to install programs.  Here we refer to the version at rpm.org (used by Fedora, Red Hat Enterprise Linux, CentOS, SUSE).  (Note that there is a fork by the original RPM maintainer (Jeff Johnson) at rpm5.org, used by some organizations.)  Has ticket tracker, many long-opened defect tickets. Latest release 2014-10-09.
  -Repo publicly available in git, see: http://rpm.org/wiki/GetSource and a number of commits in 2015 (and before).",,
  -,,,,,,,,,,,,
  -fail2ban,fail2ban,fail2ban,fail2ban, https://api.github.com/repos/fail2ban/fail2ban/issues,ban hosts that cause multiple authentication errors,,0,1,1,"Used on 10% of Debian installations according to popcon thus millions of users,Monitors and parses log files and  executes commands to manipulate firewalls based on parsed logfiles (thus possibility of injection) usually runs as root",,
  -glib-networking,,glib-networking,glib-networking,"https://bugzilla.gnome.org/buglist.cgi?quicksearch=component:network product:""glib""", network-related giomodules for GLib,,1,0,0,"TLS API. Implements its own certificate verification. No support for certificate revocation. No active developers.,Implements GLib's TLS API, most notably used by libsoup (used by all GNOME applications, WebKitGTK+, etc.). It uses GnuTLS internally.",,
  -openvpn,,openvpn,openvpn,https://community.openvpn.net/openvpn/report,virtual private network daemon,Standard System Utilities,1,0,0,,,
  -clamav,,clamav,clamav,https://bugzilla.clamav.net/,anti-virus utility for Unix - command-line interface,,1,1,0,,,
  -dnsmasq,,dnsmasq,dnsmasq,,Small caching DNS proxy and DHCP/TFTP server,,1,1,0,,,
  -encfs,,6347,encfs,https://github.com/vgough/encfs/issues,encrypted virtual filesystem,,0,0,0,,,
  -ffmpeg,,ffmpeg,ffmpeg,https://trac.ffmpeg.org/query?status=new&status=open&status=reopened&col=id&col=summary&col=status&col=type&col=component&col=version&col=time&col=changetime&order=priority&report=1,"Tools for transcoding, streaming and playing of multimedia files",,0,1,0,,,
  -owncloud,,owncloud,owncloud,https://github.com/owncloud/core/issues,"cloud storage for files, music, contacts, calendars, and many more",Standard System Utilities,1,0,0,,,
  -qemu,,qemu,qemu,https://bugs.launchpad.net/qemu/,fast processor emulator,,0,0,1,,,
  -rsync,,rsync,rsync,https://rsync.samba.org/bugzilla.html,"fast, versatile, remote (and local) file-copying tool",Standard System Utilities,1,0,0,,,
  -samba,,samba,samba,https://bugzilla.samba.org/,"SMB/CIFS file, print, and login server for Unix",,1,0,0,,,
  -virt-manager,,virt-manager,virt-manager,https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&classification=Community&component=virt-manager&product=Virtualization%20Tools,desktop application for managing virtual machines,Standard System Utilities,1,0,0,,,
  -git,,git,,,,,0,1,0,,,
  -subversion,,subversion,,,,,0,1,0,,,
  -mercurial,,mercurial,,,,,0,1,0,,,
  -bzr,,bzr-svn,,,,,0,1,0,,,
  -parted,,gparted,,,,,0,0,1,,,
  -vlc,,vlc,,,,,0,1,0,,,
  -libgbm1,mesa,mesa,mesa,https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa,generic buffer management API – runtime,Desktop,0,0,0,,marking potential privilege escalation out of ignorance – graphics libraries tend to have direct access to graphics drivers which are highly privileged.,
  -libglapi-mesa,mesa,mesa,mesa,https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa,free implementation of the GL API – shared library,Desktop,0,0,0,,,
  -libgles2-mesa-dev,mesa,mesa,mesa,https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa,free implementation of the OpenGL|ES 2.x API -- development files,Desktop,0,0,0,,,
  -libmirclientplatform-mesa,mir,mir,mir,https://launchpad.net/ubuntu/+source/mir/+bugs,Display server for Ubuntu – client library,N/A,0,0,0,,not in Debian,
  -libpthread-stubs0-dev,libpthread-stubs,libpthread-stubs,libpthread-stubs,https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=no&src=libpthread-stubs,"pthread stubs not provided by native libc, development files",Software Development Libraries,0,0,0,,"no upstream, last commit in Debian source repo was 2 years ago",
  -libsigsegv2,libsigsegv,libsigsegv,libsigsegv,http://savannah.gnu.org/bugs/?group=libsigsegv,Library for handling page faults in a portable way,Server,0,0,0,,,
  -libwayland-client0,wayland,wayland,wayland,https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa,wayland compositor infrastructure - client library,Desktop,0,0,0,,,
  -libwayland-server0,wayland,wayland,wayland,https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa,wayland compositor infrastructure - server library,Desktop,0,0,0,,,
  -libx11-xcb1,libx11,libxcb,libxcb,,Xlib/XCB interface library,Desktop,0,0,0,,xcb.freedesktop.org,
  -libxau-dev,libxau,,libxau,,X11 authorisation library,Desktop,0,0,0,,"Not on Open Hub, couldn't find a bug tracker",
  -libxau6,libxau,,libxau,,X11 authorisation library,Desktop,0,0,0,,"Not on Open Hub, couldn't find a bug tracker",
  -libxcb-dri2-0,libxcb,libxcb,libxcb,,"X C Binding, dri2 extension",Desktop,0,0,0,,Couldn't find a bug tracker,
  -libxcb-xfixes0,libxcb,libxcb,libxcb,,"X C Binding, xfixes extension",Desktop,0,0,0,,Couldn't find a bug tracker,
  -libxcb-xkb-dev,libxcb,libxcb,libxcb,,"X C Binding, XKEYBOARD extension",Desktop,0,0,0,,Couldn't find a bug tracker,
  -libxcb-xkb1,libxcb,libxcb,libxcb,,"X C Binding, XKEYBOARD extension",Desktop,0,0,0,,Couldn't find a bug tracker,
  -libxcb1,libxcb,libxcb,libxcb,,X C Binding,Desktop,0,0,0,,Couldn't find a bug tracker,
  -libxcb1-dev,libxcb,libxcb,libxcb,,X C Binding development files,Desktop,0,0,0,,Couldn't find a bug tracker,
  -mingw-w64-i686-dev,mingw-w64,mingw-w64,mingw-w64,http://sourceforge.net/p/mingw-w64/bugs/,Development environment targeting 23- and 64-bit Windows,,0,0,0,,Couldn't find a bug tracker,
  -mingw-w64-x86-64-dev,mingw-w64,mingw-w64,mingw-w64,http://sourceforge.net/p/mingw-w64/bugs/,,,0,0,0,,Couldn't find a bug tracker,
  -musl,musl,musl,musl,,standard C library development files,,0,0,0,,"No bug tracker, uses mailing list",
  -libtxc-dxtn-s2tc0,s2tc,,libtxc-dxtn-s2tc,https://github.com/divVerent/s2tc/issues,Texture compression library for Mesa,Desktop,0,0,0,,Not on Open Hub,
  -libjs-angularjs,angular.js,angularjs,angular.js,https://github.com/angular/angular.js/issues,lets you write client-side web applications as if you had a smarter browser,web,1,1,1,,
  -ansible,ansible,ansible-ssh,ansible,https://github.com/ansible/ansible/issues,"Configuration management, deployment, and task execution system",admin,1,0,1,,
  -libjs-bootstrap,twitter-bootstrap3,bootstrap-from-twitter,bootstrap,https://github.com/twitter/bootstrap/issues,"HTML, CSS and JS framework",web,1,1,1,,
  -buildbot,buildbot,buildbot,buildbot,http://trac.buildbot.net,system to automate compile/test cycle,devel,1,1,1,,
  -python-celery-common,celery,celery,celery,https://github.com/celery/celery/issues,async task/job queue based on message passing (common files),python,1,1,1,,
  -ckeditor,ckeditor,ckeditor,ckeditor,https://dev.ckeditor.com/,text editor which can be embedded into web pages,web,1,1,1,,
  -clang-3.5,clang-3.5,llvm-toolchain-3.5,clang,https://llvm.org/bugs/,"C, C++ and Objective-C compiler (LLVM based)",devel,0,0,0,,
  -llvm-3.5,llvm-toolchain-3.5,llvm,llvm,https://llvm.org/bugs/,"C, C++ and Objective-C compiler (LLVM based)",devel,0,0,0,,
  -libjs-codemirror,codemirror-js,CodeMirror,codemirror,https://github.com/codemirror/codemirror/issues,Javascript editor interface for code-like content,web,1,1,1,,
  -python3-django,python-django,django,django,https://code.djangoproject.com/,High-level Python web development framework,python,1,1,1,,
  -python-djangorestframework,djangorestframework,djangorestframework,djangorestframework,https://github.com/tomchristie/django-rest-framework/issues,"Web APIs for Django, made easy",python,1,1,1,,
  -elasticsearch,elasticsearch,elasticsearch,elasticsearch,https://github.com/elastic/elasticsearch/issues,"Open Source, Distributed, RESTful Search Engine",web,1,1,1,,
  -emacs,Emacs-defaults,emacs,emacs,http://debbugs.gnu.org/,GNU Emacs editor,editors,1,1,1,,Markings based on a 2007 remote priv escation to Admin which is listed in emacs list of CVEs
  -python3-flake8,python-flake8,flake8,flake8,https://gitlab.com/pycqa/flake8/issues,code checker using pep8 and pyflakes,python,0,0,0,,
  -python-flask,flask,flask,flask,https://github.com/mitsuhiko/flask/issues,"micro web framework based on Werkzeug, Jinja2 and good intention",python,1,1,1,,
  -fonts-font-awesome,fonts-font-awesome,font-awesome,font-awesome,https://github.com/FontAwesome/Font-Awesome/issues,iconic font designed for use with Twitter Bootstrap,fonts,0,0,0,,
  -git,git,git,git,,"fast, scalable, distributed revision control system",vcs,1,1,0,,Does not appear to have an issue tracker
  -gunicorn,gunicorn,gunicorn,gunicorn,https://github.com/benoitc/gunicorn/issues,Event-based HTTP/WSGI server,httpd,1,1,1,,designed to be behind a buffering front end server (nginx)
  -libharfbuzz0b,harfbuzz,harfbuzz,harfbuzz,https://github.com/behdad/harfbuzz/issues,OpenType text shaping engine,libs,0,1,0,,
  -hunspell,hunspell,hunspell,hunspell,http://sourceforge.net/p/hunspell/bugs,spell checker and morphological analyzer,text,0,0,0,,Lots of unprocessed bugs in the bug tracker
  -libhyphen0,hyphen,hyphen,hyphen,http://sourceforge.net/p/hunspell/bugs,ALTLinux hyphenation library,libs,0,0,0,,Moved to github but no issues in issue tracker
  -libjemalloc1,jemalloc,jemalloc,jemalloc,https://github.com/jemalloc/jemalloc/issues,General-purpose scalable concurrent malloc(3),libs,0,0,0,,
  -libjs-jquery,jquery,jQuery,jquery,https://github.com/jquery/jquery/issues,JavaScript library for dynamic web applications,web,1,1,1,,
  -python-kombu,kombu,kombu,kombu,https://github.com/celery/kombu,AMQP Messaging Framework for Python,,1,1,1,,
  -libjpeg62-turbo,libjpeg-turbo,libjpeg-turbo,libjpeg-turbo,https://github.com/libjpeg-turbo/libjpeg-turbo/issues,Libjpeg-turbo JPEG runtime library,libs,0,1,0,,
  -libvpx1,libvpx,libvpx,libvpx,https://bugs.chromium.org/p/webm/issues,VP8 and VP9 video codec,libs,0,1,0,,
  -libjs-lodash,node-lodash,lodash,lodash,https://github.com/lodash/lodash/issues,Lo-dash is a Javascript utility library,web,1,1,1,,
  -mailman,mailman,mailman,mailman,https://bugs.launchpad.net/mailman/,"Powerful, web-based mailing list manager",mail,1,1,1,,
  -mediawiki,mediawiki,mediawiki,mediawiki,https://phabricator.wikimedia.org/,website engine for collaborative work,web,1,1,1,,
  -mysql-server,mysql-5.6,mysql,mysql,http://bugs.mysql.com/,MySQL database server binaries and system database setup,database,1,1,1,,
  -nagios3,nagios3,nagios,nagios,https://support.nagios.com/forum/,host/service/network monitoring and management system,net,1,1,1,,User forum rather than bug tracker
  -netsniff-ng,netsniff-ng,netsniff-ng,netsniff-ng,https://github.com/netsniff-ng/netsniff-ng/issues,Linux network packet sniffer toolkit,net,1,1,1,,
  -nodejs,nodejs,node,node.js,https://github.com/nodejs/node/issues,evented I/O for V8 javascript,web,1,1,1,,
  -inspircd,inspircd,inspircd,inspircd,https://github.com/inspircd/inspircd/issues,Modular IRCd written in C++,net,1,1,1,,
  -pdf.js-common,pdf.js,pdf_js,pdf.js,https://github.com/mozilla/pdf.js/issues,Portable Document Format (PDF) viewer,web,1,1,1,,
  -pep8,pep8,pep8,pep8,https://github.com/PyCQA/pep8/issues,Python PEP 8 code style checker,python,0,0,0,,
  -python-pip,python-pip,pip,Python pip,https://github.com/pypa/pip/issues,alternative Python package installer,python,1,1,1,,
  -pocketsphinx,pocketsphinx,534,CMU Sphinx,http://sourceforge.net/p/cmusphinx/bugs/,Speech recognition tool,sound,1,1,1,,
  -postgresql-9.4,postgresql-9.4,postgres,postgres,http://www.postgresql.org/support/submitbug/,Object-relational SQL database,database,1,1,1,,
  -puppet-common,puppet,puppet,puppet,https://tickets.puppetlabs.com/secure/Dashboard.jspa,configuration management system,admin,1,1,1,,
  -pyflakes,pyflakes,pyflakes,pyflakes,https://bugs.launchpad.net/pyflakes/+filebug,passive checker of Python 2 and 3 programs,,0,0,0,,
  -python-pytest,python-pytest,pytest,pytest,https://github.com/pytest-dev/pytest/issues,"Simple, powerful testing in Python",python,0,0,0,,
  -rabbitmq-server,rabbitmq-server,rabbitmq,rabbitmq,https://github.com/rabbitmq/rabbitmq-server/issues,AMQP server written in Erlang,net,1,1,1,,
  -python-requests,requests,requests,Python-requests,https://github.com/kennethreitz/requests/issues,"elegant and simple HTTP library for Python2, built for human beings",,1,1,1,,
  -node-stylus,node-stylus,stylus,stylus,https://github.com/stylus/stylus/issues,"Robust, expressive, and feature-rich CSS superset – Node.js module",web,1,1,1,,
  -suricata,suricata,suricata-engine,suricata,https://redmine.openinfosecfoundation.org/projects/suricata/issues,Next Generation Intrusion Detection and Prevention Tool,net,1,1,1,,
  -vagrant,vagrant,vagrantup,vagrant,https://github.com/mitchellh/vagrant/issues,Tool for building and distributing virtualized development environments,admin,1,1,1,,
  -valgrind,valgrind,valgrind,valgrind,http://valgrind.org/support/bug_reports.html,instrumentation framework for building dynamic analysis tools,devel,0,0,0,,
  -libwebrtc-audio-processing-0,webrtc-audio-processing,webrtc,webrtc,https://bugs.chromium.org/p/webrtc/issues/list,AudioProcessing module from the WebRTC project,libs,1,1,1,,Debian package is a subset of the project
  -wordpress,wordpress,wordpress,wordpress,https://core.trac.wordpress.org/,weblog manager,web,1,1,1,,
  -nginx,nginx,nginx,nginx,https://trac.nginx.org/nginx/,"small, powerful, scalable web/proxy server",httpd,1,1,1,,
  +zlib1g,zlib,,zlib,, compression library - runtime,Standard System Utilities,0,1,0,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. HAS Home Page, has mailing list zlib@gzip.org, NO issue tracker, Latest release April 2013 (old). +++",,
  
positive.code: debianutils,,debian-installer-utils,debianutils,, Miscellaneous utilities specific to Debian,Standard System Utilities,0,0,0,"Collection of small tools.The tempfile(1) command is security-relevant (temp file mistakes are a common security vulnerability) but is relatively small, and usually the problem is a failure to use tempfile(1) or similar.",,
  dictionaries-common,,dict-common,dict-common,, Common utilities for spelling dictionary tools,Standard System Utilities,0,0,0,,,
  diffutils,,diffutils,diffutils,, File comparison utilities,Standard System Utilities,0,0,0,,,
  discover,,,discover,, hardware identification system,Standard System Utilities,0,0,0,"Conceivably a local exploit opportunity, but not likely.",,
  discover-data,,,discover-data,, Data lists for Discover hardware detection system,Standard System Utilities,0,0,0,,,
  dkms,,dkms-framework,dkms,, Dynamic Kernel Module Support Framework,Standard System Utilities,0,0,1,,,
  dmidecode,,dmidecode,dmidecode,, SMBIOS/DMI table decoder,Standard System Utilities,0,0,0,,,
  dmsetup,lvm2 (2.02.95-8),device-mapper,lvm2,, Linux Kernel Device Mapper userspace library,Standard System Utilities,0,0,0,,,
  dnsutils,bind9,bind,bind9,, Clients provided with BIND,Standard System Utilities,1,0,0,Bind9 is critical for security. It does have active development. ++,,
  doc-debian,,doc-debian,doc-debian,, Debian Project documentation and other documents,Standard System Utilities,0,0,0,,,
  dpkg,,dpkg,dpkg,, Debian package management system,Standard System Utilities,1,0,0,"Should primarily be managing data from trusted source; if it ensures data source okay, less risky.",,
  e2fslibs,e2fsprogs,e2fsprogs,e2fslibs,, ext2/ext3/ext4 file system libraries,Standard System Utilities,0,0,0,,,
  e2fsprogs,,e2fsprogs,e2fsprogs,, ext2/ext3/ext4 file system utilities,Standard System Utilities,0,0,0,,,
  eject,,eject,eject,, ejects CDs and operates CD-Changers under Linux,Standard System Utilities,0,0,0,,,
  exim4,,exim,exim4,, metapackage to ease Exim MTA (v4) installation,Standard System Utilities,1,0,0,"This is an MTA, thus has to process untrustworthy data.  Mailing lists, bugzilla tracker, public git repo. Active history of CVE issues and fixes. Active with 16 contributors in last year. ++",Exim may be used to contact network,
  exim4-base,exim4,exim,exim,, support files for all Exim MTA (v4) packages,Standard System Utilities,1,0,0,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++",,
  exim4-config,exim4,exim,exim,, configuration for the Exim MTA (v4),Standard System Utilities,1,0,0,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++",,
  exim4-daemon-light,exim4,exim,exim,, lightweight Exim MTA (v4) daemon,Standard System Utilities,1,0,0,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++",,
  fakeroot,,6854,fakeroot,, tool for simulating superuser privileges,Standard System Utilities,0,0,0,,,
  file,,file,libmagic1,," Determines file type using ""magic"" numbers",Standard System Utilities,0,0,0,,,
  findutils,,findutils,findutils,," utilities for finding files--find, xargs",Standard System Utilities,0,0,0,,,
  ftp,netkit-ftp,,netkit-ftp,, classical file transfer client,Standard System Utilities,1,0,0,"Ftp isn't secure by itself, and the ftp client is less commonly used now.  That said, it certainly is used and connects to the wide Internet.",Extinct upstream per http://metadata.ftp-master.debian.org/changelogs//main/n/netkit-ftp/netkit-ftp_0.17-27_copyright and ftp://ftp.uk.linux.org/pub/linux/Networking/netkit/,
  gcc,gcc-defaults (1.120),gcc,gcc,, GNU C compiler,Standard System Utilities,0,0,0,,,
  gcc-4.6,,gcc,gcc,, GNU C compiler,Standard System Utilities,0,0,0,,,
  gcc-4.6-base,gcc-4.6,gcc,gcc,," GCC, the GNU Compiler Collection (base package)",Standard System Utilities,0,0,0,,,
  gcc-4.7,,gcc,gcc,, GNU C compiler,Standard System Utilities,0,0,0,,,
  gcc-4.7-base,gcc-4.7,gcc,gcc,," GCC, the GNU Compiler Collection (base package)",Standard System Utilities,0,0,0,,,
  geoip-database,,geoipdb,geoipdb,, IP lookup command line tools that use the GeoIP library (country database),Standard System Utilities,1,0,0,,,
  gettext-base,gettext,gettext,gettext,, GNU Internationalization utilities for the base system,Standard System Utilities,0,0,0,,,
  gnupg,,gnupg,gnupg,, GNU privacy guard - a free PGP replacement,Standard System Utilities,0,1,0,Vital for protecting email (CII has already invested with a one-time investment) ++,,
  gpgv,gnupg,gnupg,gnupg,, GNU privacy guard - signature verification tool,Standard System Utilities,0,1,0,Vital for protecting email (CII has already invested with a one-time investment) ++,,
  grep,,grep,grep,," GNU grep, egrep and fgrep",Standard System Utilities,0,0,0,,,
  groff-base,groff,groff,groff,, GNU troff text-formatting system (base system components),Standard System Utilities,0,0,0,,,
  grub-common,grub2,grub,grub,, GRand Unified Bootloader (common files),Standard System Utilities,0,0,0,,,
  grub-pc,grub2,grub,grub,," GRand Unified Bootloader, version 2 (PC/BIOS version)",Standard System Utilities,0,0,0,,,
  grub-pc-bin,grub2,grub,grub,," GRand Unified Bootloader, version 2 (PC/BIOS binaries)",Standard System Utilities,0,0,0,,,
  grub2-common,grub2,grub,grub,, GRand Unified Bootloader (common files for version 2),Standard System Utilities,0,0,0,,,
  gzip,,gzip,gzip,, GNU compression utilities,Standard System Utilities,0,1,0,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. http://www.gnu.org/software/gzip/ Maintained on Savannah (http://savannah.gnu.org/projects/gzip/) using git. Last formal release was years ago (June 2013).  Multiple contributors, but not many. Current git contributions, but only a few a month (2015-02-08, 2015-01-02, 2014-11-10, 2014-10-10), and most seem to be small/trivial (document and syntax tweaks). +++",,
  hostname,,,,, utility to set/show the host name or domain name,Standard System Utilities,0,0,0,Relatively small functionality.,"originally FSF project, appears to be maintained separately",
  iamerican,ispell,,ispell,, American English dictionary for ispell (standard version),Standard System Utilities,0,0,0,,,
  ibritish,ispell,,ispell,, British English dictionary for ispell (standard version),Standard System Utilities,0,0,0,,,
  ienglish-common,ispell,,ispell,, Common files for British and American ispell dictionaries,Standard System Utilities,0,0,0,,,
  
negative.code: libnewt0.52,newt,newt,newt,, Not Erik's Windowing Toolkit - text mode windowing with slang,Standard System Utilities,0,0,0,,,
  libnfnetlink0,libnfnetlink,libnfnetlink,libnfnetlink,, Netfilter netlink library,Standard System Utilities,1,0,0,"Typically the user is already trusted, and the runtime for netlink is part of the kernel, so vulnerabilities would typically not be here.",,
  libnfsidmap2,libnfsidmap,,libnfsidmap,, NFS idmapping library,Standard System Utilities,1,0,0,"Important for NFS, amount of use unclear.",,
  libopencryptoki0,,,libopencryptoki0,,,,0,1,0,,,
  libp11-kit0,p11-kit,p11-kit,libp11,, Library for loading and coordinating access to PKCS#11 modules - runtime,Standard System Utilities,0,1,0,"Manages security keys. Has Home page, Bug Tracker https://bugs.freedesktop.org/enter_bug.cgi?product=p11-glue, ML http://lists.freedesktop.org/archives/p11-glue/ fairly active ++",,
  libpam0g,pam,linux-pam,pam,, Pluggable Authentication Modules library,Standard System Utilities,1,0,0,Critical central role for authentication, not very active.  Concerning. ++,
  libpam-modules-bin,pam,linux-pam,pam,, Pluggable Authentication Modules for PAM - helper binaries,Standard System Utilities,0,1,0,"Critical central role for authentication.  Real site is http://www.linux-pam.org/ (Debian lists as http://pam.sourceforge.net/ but that points to https://fedorahosted.org/linux-pam/ which points to this). It has a somewhat active mailing list, and an active issue tracker where issues are clearly opened and closed. Stable version is somewhat old (2013); recent changes in git though relatively small (https://git.fedorahosted.org/cgit/linux-pam.git/) ++",,
  libpam-modules,pam,linux-pam,pam,, Pluggable Authentication Modules for PAM,Standard System Utilities,1,0,0,"Critical central role for authentication.  Real site is http://www.linux-pam.org/ (Debian lists as http://pam.sourceforge.net/ but that points to https://fedorahosted.org/linux-pam/ which points to this). It has a somewhat active mailing list, and an active issue tracker where issues are clearly opened and closed. Stable version is somewhat old (2013); recent changes in git though relatively small (https://git.fedorahosted.org/cgit/linux-pam.git/) ++",,
  libpam-runtime,pam,linux-pam,pam,, Runtime support for the PAM library,Standard System Utilities,0,1,0,,,
  libpci3,pciutils,pciutils,pciutils,, Linux PCI Utilities (shared library),Standard System Utilities,0,0,0,,"PCI requires physical access, not just local execution",
  libpciaccess0,libpciaccess,pci-utility,pci-utility,, Generic PCI access library for X,Standard System Utilities,0,0,0,,,
  libpcre3,pcre3,pcre,pcre,, Perl 5 Compatible Regular Expression Library - runtime files,Standard System Utilities,0,1,0,"Regexes are widely used for security-relevant input validation. Has Home page, Bug Tracker http://bugs.exim.org/buglist.cgi?product=PCRE NOT very active, public repo http://sourceforge.net/projects/pcre/files/ ++",Regexes often used for input validation,
  libpipeline1,libpipeline,libpipeline,libpipeline,, pipeline manipulation library,Standard System Utilities,0,0,0,,,
  libpixman-1-0,pixman,pixman,pixman,, pixel-manipulation library for X and cairo,Standard System Utilities,0,0,0,,,
  libpng12-0,libpng,libpng,libpng,, PNG library - runtime,Web Server,0,1,0,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can Access Source code, Not much activity - just warnings about CVEs that were fixed. +++",,
  libpng3,,libpng,libpng3,,,,0,1,0,,,
  libpng,,libpng,libpng,,,,0,1,0,,,
  libpolarssl-runtime,,polarssl,libpolarssl,,,,1,0,0,SSL/TLS library.  Protocol is important.  This implementation is less widely used.,,
  libpopt0,popt,popt,popt,, lib for parsing cmdline parameters,Standard System Utilities,0,0,0,,,
  libprocps0,procps,procps,procps,, library for accessing process information from /proc,Standard System Utilities,0,0,0,,,
  libpth20,pth,,libpth,, The GNU Portable Threads,Standard System Utilities,0,0,0,,,
  libpthread-stubs0-dev,libpthread-stubs,libpthread-stubs,libpthread-stubs,https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=no&src=libpthread-stubs,"pthread stubs not provided by native libc, development files",Software Development Libraries,0,0,0,,"no upstream, last commit in Debian source repo was 2 years ago",
  libquadmath0,gcc-4.7,gcc,gcc,, GCC Quad-Precision Math Library,Standard System Utilities,0,0,0,,,
  libreadline6,readline6,,readline6,," GNU readline and history libraries, run-time libraries",Standard System Utilities,0,0,0,"Typically interactive same-user use, so unlikely to be security issue.",,
  libressl,,libressl,libressl,,,,1,0,0,"Fork of OpenSSL. HAS Home Page, Can Download as tarball,  VERY Active on Github https://github.com/libressl-portable/portable ++",,
  libsasl2-2,cyrus-sasl2,12134,libsasl2-2,, Cyrus SASL - authentication abstraction library,Standard System Utilities,0,1,0,"Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++",,
  libsasl2-modules,cyrus-sasl2,12134,libsasl2-2,, Cyrus SASL - pluggable authentication modules,Standard System Utilities,0,1,0,"Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++",,
  libselinux1,libselinux,selinux,selinux,, SELinux runtime shared libraries,Standard System Utilities,0,0,1,SELinux vital for security on systems using it (there are many).  Many of the critical parts are in the kernel.,,
  libsemanage1,libsemanage,libsemanage,libsemanage, https://api.github.com/repos/pld-linux/libsemanage/issues, SELinux policy management library,Standard System Utilities,0,0,0,,,
  libsemanage-common,libsemanage,libsemanage,libsemanage, https://api.github.com/repos/pld-linux/libsemanage/issues, Common files for SELinux policy management libraries,Standard System Utilities,0,0,1,,,
  libsepol1,libsepol,serefpolicy,serefpolicy,, SELinux library for manipulating binary security policies,Standard System Utilities,0,0,0,,,
  libsigc++-2.0-0c2a,libsigc++-2.0,libsigc,libsigc,, type-safe Signal Framework for C++ - runtime,Standard System Utilities,0,0,0,,,
  libsigsegv2,libsigsegv,libsigsegv,libsigsegv,http://savannah.gnu.org/bugs/?group=libsigsegv,Library for handling page faults in a portable way,Server,0,0,0,,,
  libslang2,slang2,s-lang,slang,, S-Lang programming library - runtime version,Standard System Utilities,0,0,0,,,
  libsm6,libsm,,libsm,, X11 Session Management library,Standard System Utilities,0,0,0,Just stores X11 sessions for later use.,,
  libsqlite3-0,sqlite3,sqlite,sqlite,, SQLite 3 shared library,Standard System Utilities,0,0,0,,,
  