anchor.diff:  easy to use and uniform interface to access the content of font
   files.
   FreeType 2 is released under two open-source licenses: our own
  -BSD-like FreeType License and the GPL.",http://savannah.nongnu.org/projects/freetype/,http://sourceforge.net/projects/freetype/files/latest/download,16,109,301821,C,ftl gpl ,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",167684,C,Shared Library,0,1,0,7,"Dangerous.  Processes data from network, including fonts embedded in websites. Main site http://www.freetype.org/ Last release FreeType 2.5.5, 2014-12-30. Git repo. Very active git repo by multiple contributors. ++"
  -libgcrypt11,,1.5.0-5+deb7u2,LGPL Crypto library - runtime library,http://directory.fsf.org/project/libgcrypt/,2,https://security-tracker.debian.org/tracker/source-package/libgcrypt11,https://www.openhub.net/projects/libgcrypt,libgcrypt,Libgcrypt is a general purpose crypto library based on the code used in GnuPG.,http://www.gnupg.org,http://www.gnupg.org/download/index.html#libgcrypt,8,28,150704,C,gpl lgpl ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",163321,C,Shared Library,0,1,0,7,"Crypto library, security-relevant. LGPL crypto library. Part of GnuPG (GNU Privacy Guard). http://ftp.gnupg.org/gcrypt/libgcrypt/. Already selected by CII. ++"
  -libgeoip1,geoip,1.4.8+dfsg-3,non-DNS IP-to-country resolver library,http://www.maxmind.com/,0,https://security-tracker.debian.org/tracker/source-package/geoip,https://www.openhub.net/projects/geoip,MaxMind GeoIP,"MaxMind GeoIP is a set of APIs for looking up the location of an IP address, including the country, region, city, latitude, and longitude. Free GeoLite databases are available at http://www.maxmind.com/app/geolitecity",http://sourceforge.net/projects/geoip,,0,2,83883,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,156657,C,Shared Library,0,1,0,7,Should not be security-relevant.
  -libgmp10,gmp,2:5.0.5+dfsg-2,Multiprecision arithmetic library,http://gmplib.org/,0,https://security-tracker.debian.org/tracker/source-package/gmp,https://www.openhub.net/projects/gmp,GMP,"GMP is a free library for arbitrary precision arithmetic, operating on signed integers, rational numbers, and floating point numbers. There is no practical limit to the precision except the ones implied by the available memory in the machine GMP runs on. GMP has a rich set of functions, and the functions have a regular interface.",http://gmplib.org/,http://ftp.sunet.se/pub/gnu/gmp/,0,17,209398,C,lgpl3 ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,122633,C,Shared Library,0,1,0,7,Multi-precision can be security-relevant if used to process crypto data.
  -libgpg-error0,libgpg-error,1.10-3.1,library for common error values and messages in GnuPG components,http://www.gnupg.org/related_software/libgpg-error/,0,https://security-tracker.debian.org/tracker/source-package/libgpg-error,https://www.openhub.net/projects/libgpg-error,libgpg-error,"This is a library that defines common error values for all GnuPG components.  Among these are GPG, GPGSM, GPGME, GPG-Agent, libgcrypt, Libksba, DirMngr, Pinentry, SmartCard Daemon and more.",,,6,16,44016,shell script,lgpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,169763,C,Shared Library,0,1,0,7,See GNUPG.
  -libidn11,libidn,1.25-2,"GNU Libidn library, implementation of IETF IDN specifications",https://www.gnu.org/software/libidn/,0,https://security-tracker.debian.org/tracker/source-package/libidn,https://www.openhub.net/projects/libidn,LibIDN,"GNU Libidn is an implementation of the Stringprep, Punycode and IDNA specifications defined by the IETF Internationalized Domain Names (IDN) working group, used for internationalized domain names. The C library is available under the GNU Lesser General Public License.
  -
  -The library contains a generic Stringprep implementation that does Unicode 3.2 NFKC normalization, mapping and prohibitation of characters, and bidirectional character handling. Profiles for iSCSI, Kerberos 5, Nameprep, SASL and XMPP are included. Punycode and ASCII Compatible Encoding (ACE) via IDNA are supported.",http://www.gnu.org/software/libidn/,,1,4,101881,C,gpl lgpl ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,168599,C,Shared Library,0,1,0,7,"Libidn's purpose is to encode and decode internationalized domain names; this data may come straight from attackers (e.g., in web page links, etc.)."
  -libisc84,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,ISC Shared Library used by BIND,,32,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,6,46,635185,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,104904,C,Shared Library,0,1,0,7,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  -libisccc80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Command Channel Library used by BIND,,32,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,6,46,635185,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,105745,C,Shared Library,0,1,0,7,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  -libisccfg82,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Config File Handling Library used by BIND,,32,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,6,46,635185,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,105598,C,Shared Library,0,1,0,7,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  -libk5crypto3,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - Crypto Library,http://web.mit.edu/kerberos/,43,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,26,91,386862,C,mit ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161580,,,0,1,0,7,Kerberos.
  -libkeyutils1,keyutils,1.5.5-3+deb7u1,Linux Key Management Utilities (library),http://people.redhat.com/~dhowells/keyutils/,0,https://security-tracker.debian.org/tracker/source-package/keyutils,https://www.openhub.net/projects/keyutils,keyutils,Linux Key Management Utilities,https://github.com/pld-linux/keyutils,,2,4,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Small development team,167697,C,Shared Library,0,1,0,7,"Manages authorization and encryption keys required to perform secure operations. Public Repo, NO bug tracker, NO mailing list. ++"
  -libkrb5support0,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - Support library,http://web.mit.edu/kerberos/,43,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,26,91,386862,C,mit ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161587,,,0,1,0,7,Kerberos.
  -liblzma5,xz-utils,5.1.1alpha+20120614-2,XZ-format compression library,http://tukaani.org/xz/,0,https://security-tracker.debian.org/tracker/source-package/xz-utils,https://www.openhub.net/projects/xz-utils,XZ Utils,"XZ Utils is free general-purpose data compression software with high compression ratio. XZ Utils were written for POSIX-like systems, but also work on some not-so-POSIX systems. XZ Utils are the successor to LZMA Utils.",http://tukaani.org/xz/,,4,13,27105,C,gpl lgpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Average size development team,135947,C,,0,1,0,7,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. Has Home page, public repo, Fairly active ML http://www.mail-archive.com/xz-devel@tukaani.org/, NO bug tracker ++"
  -libp11-kit0,p11-kit,0.12-3,Library for loading and coordinating access to PKCS#11 modules - runtime,http://p11-glue.freedesktop.org/p11-kit.html,0,https://security-tracker.debian.org/tracker/source-package/p11-kit,https://www.openhub.net/projects/p11-kit,p11-kit,"Provides a way to load and enumerate PKCS#11 modules. Provides a standard configuration setup for installing PKCS#11 modules in such a way that they're discoverable.
  -
  -Also solves problems with coordinating the use of PKCS#11 by different components or libraries living in the same process.",http://p11-glue.freedesktop.org/p11-kit.html,http://p11-glue.freedesktop.org/releases/,10,22,57110,C,bsd ,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,"Large, active development team",136021,C,Shared Library,0,1,0,7,"Manages security keys. Has Home page, Bug Tracker https://bugs.freedesktop.org/enter_bug.cgi?product=p11-glue, ML http://lists.freedesktop.org/archives/p11-glue/ fairly active ++"
  -libpam-modules-bin,pam,1.1.3-7.1,Pluggable Authentication Modules for PAM - helper binaries,http://pam.sourceforge.net/,14,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,8,20,56988,C,BSD-3-Clause gpl gpl3 ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",135322,C,Shared Library,0,1,0,7,"Critical central role for authentication.  Real site is http://www.linux-pam.org/ (Debian lists as http://pam.sourceforge.net/ but that points to https://fedorahosted.org/linux-pam/ which points to this). It has a somewhat active mailing list, and an active issue tracker where issues are clearly opened and closed. Stable version is somewhat old (2013); recent changes in git though relatively small (https://git.fedorahosted.org/cgit/linux-pam.git/) ++"
  -libpcre3,pcre3,1:8.30-5,Perl 5 Compatible Regular Expression Library - runtime files,,1,https://security-tracker.debian.org/tracker/source-package/pcre3,https://www.openhub.net/projects/pcre,PCRE,"The PCRE (Perl Compatible Regular Expressions) library is a set of functions that implement regular expression pattern matching using the same syntax and semantics as Perl 5. PCRE has its own native API, as well as a set of wrapper functions that correspond to the POSIX regular expression API. The PCRE library is free, even for building commercial software.",http://www.pcre.org/,,3,4,96416,C,BSD-3-Clause ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168728,C,Shared Library,0,1,0,7,"Regexes are widely used for security-relevant input validation. Has Home page, Bug Tracker http://bugs.exim.org/buglist.cgi?product=PCRE NOT very active, public repo http://sourceforge.net/projects/pcre/files/ ++"
  -libsasl2-2,cyrus-sasl2,2.1.25.dfsg1-6+deb7u1,Cyrus SASL - authentication abstraction library,http://www.cyrusimap.org/,1,https://security-tracker.debian.org/tracker/source-package/cyrus-sasl2,https://www.openhub.net/projects/12134,Cyrus SASL,"SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. If its use is negotiated, a security layer is inserted between the protocol and the connection.
  -
  -Cyrus SASL is the reference implementation of SASL.",http://asg.web.cmu.edu/sasl/,http://ftp.andrew.cmu.edu/pub/cyrus-mail/,2,20,90759,C,Carnegie_Mellon_Licence ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168686,C,Shared Library,0,1,0,7,"Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++"
  -libsasl2-modules,cyrus-sasl2,2.1.25.dfsg1-6+deb7u1,Cyrus SASL - pluggable authentication modules,http://www.cyrusimap.org/,1,https://security-tracker.debian.org/tracker/source-package/cyrus-sasl2,https://www.openhub.net/projects/12134,Cyrus SASL,"SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. If its use is negotiated, a security layer is inserted between the protocol and the connection.
  -
  -Cyrus SASL is the reference implementation of SASL.",http://asg.web.cmu.edu/sasl/,http://ftp.andrew.cmu.edu/pub/cyrus-mail/,2,20,90759,C,Carnegie_Mellon_Licence ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,157085,C,Plugin,0,1,0,7,"Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++"
  -libselinux1,libselinux,2.1.9-5,SELinux runtime shared libraries,,0,https://security-tracker.debian.org/tracker/source-package/libselinux,https://www.openhub.net/projects/selinux,Security-enhanced Linux,"This is a public forum for the NSA Security-Enhanced Linux project. This is not intended to replace NSA's work or official website but rather to allow broader participation in extending and adapting SELinux for distributions.
  -
  -SELinux normally comes with your Linux distribution. It is unusual for an ordinary user to install it manually.
  -
  -The proposed logo is not the official SELinux logo.",http://sourceforge.net/projects/selinux,,10,55,102735,C,gpl3_or_later ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",169736,C,Shared Library,0,0,1,7,SELinux vital for security on systems using it (there are many).  Many of the critical parts are in the kernel.
  -libsm6,libsm,2:1.2.1-2,X11 Session Management library,,0,https://security-tracker.debian.org/tracker/source-package/libsm,,,,,,,,,,,,,,,137348,,Shared Library,0,0,0,7,Just stores X11 sessions for later use.
  -libxml2,,2.8.0+dfsg1-7+wheezy2,GNOME XML library,http://xmlsoft.org/,18,https://security-tracker.debian.org/tracker/source-package/libxml2,https://www.openhub.net/projects/libxml2,libxml2,"Libxml2 is the XML C parser and toolkit developed for the Gnome project (but usable outside of the Gnome platform).
  -
  -Includes the xmllint tool for checking documents for well-formedness, validating documents against a DTD or XML Schema, and pretty printing XML input.",http://www.xmlsoft.org/,http://www.xmlsoft.org/downloads.html,26,215,501531,C,mit ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",168006,,,0,1,0,7,"Processes attacker-provided data. HAS Home Page, Has bug tracker https://bugzilla.gnome.org/buglist.cgi?product=libxml2 which is very active. ++"
  -login,shadow,1:4.1.5.1-1,system login tools,http://pkg-shadow.alioth.debian.org/,2,https://security-tracker.debian.org/tracker/source-package/shadow,https://www.openhub.net/projects/shadow-tool-suite,Shadow Tool Suite,"The shadow tool suite contains the following commands among others: login, passwd, useradd, groupadd.",http://pkg-shadow.alioth.debian.org/,http://pkg-shadow.alioth.debian.org/download.php,4,17,127116,C,bsd ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,169894,C,Program,0,0,1,7,"Front door for local login. Has Home Page, part of shadow tool suite, Latest release May 2014, Public Repo, Somewhat active mailing list, NO issue tracker. ++"
  +BSD-like FreeType License and the GPL.",http://www.freetype.org/,http://sourceforge.net/projects/freetype/files/latest/download,11,111,302226,C,ftl gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",167684,,,0,1,0,7,"Dangerous.  Processes data from network, including fonts embedded in websites. Main site http://www.freetype.org/ Last release FreeType 2.5.5, 2014-12-30. Git repo. Very active git repo by multiple contributors. ++"
  +libgcrypt11,,1.5.0-5+deb7u2,LGPL Crypto library - runtime library,http://directory.fsf.org/project/libgcrypt/,4,https://security-tracker.debian.org/tracker/source-package/libgcrypt11,https://www.openhub.net/projects/libgcrypt,libgcrypt,Libgcrypt is a general purpose crypto library based on the code used in GnuPG.,http://www.gnupg.org,http://www.gnupg.org/download/index.html#libgcrypt,8,28,155486,C,gpl lgpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",163321,,,0,1,0,7,"Crypto library, security-relevant. LGPL crypto library. Part of GnuPG (GNU Privacy Guard). http://ftp.gnupg.org/gcrypt/libgcrypt/. Already selected by CII. ++"
  +libgdbm3,gdbm,1.8.3-11,GNU dbm database routines (runtime version),http://directory.fsf.org/project/gdbm/,0,https://security-tracker.debian.org/tracker/source-package/gdbm,https://www.openhub.net/projects/libgdbm,libgdbm,GNU dbm is a set of database routines that use extendible hashing and works similar to the standard UNIX dbm routines.,http://www.gnu.org/software/gdbm/,http://www.gnu.org.ua/software/gdbm/download.html,1,2,10735,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,169846,C,Shared Library,0,0,0,7,
  +libgpm2,gpm,1.20.4-6,General Purpose Mouse - shared library,http://www.nico.schottelius.org/software/gpm/,0,https://security-tracker.debian.org/tracker/source-package/gpm,https://www.openhub.net/projects/gpm,gpm,The gpm (general purpose mouse) daemon tries to be a useful mouse server for applications running on the Linux console. It provides console cut and paste operations.,http://www.nico.schottelius.org/software/gpm/,http://www.nico.schottelius.org/software/gpm/,2,15,10286,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Small development team,163729,,,0,0,0,7,
  +libisc84,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,ISC Shared Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",104904,,,0,1,0,7,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  +libisccc80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Command Channel Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",105745,,,0,1,0,7,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  +libisccfg82,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Config File Handling Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",105598,,,0,1,0,7,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++"
  +libk5crypto3,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - Crypto Library,http://web.mit.edu/kerberos/,45,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,21,96,388789,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161580,,,0,1,0,7,Kerberos.
  +libkrb5support0,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - Support library,http://web.mit.edu/kerberos/,45,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,21,96,388789,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161587,,,0,1,0,7,Kerberos.
  +liblockfile-bin,liblockfile,1.09-5,support binaries for and cli utilities based on liblockfile,,0,https://security-tracker.debian.org/tracker/source-package/liblockfile,https://www.openhub.net/projects/liblockfile,liblockfile,"NFS-safe locking library, includes dotlockfile program",https://github.com/pld-linux/liblockfile,,1,4,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Only a single active developer,127707,C,,0,0,0,7,
  +liblockfile1,liblockfile,1.09-5,NFS-safe locking library,,0,https://security-tracker.debian.org/tracker/source-package/liblockfile,https://www.openhub.net/projects/liblockfile,liblockfile,"NFS-safe locking library, includes dotlockfile program",https://github.com/pld-linux/liblockfile,,1,4,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Only a single active developer,159805,C,Shared Library,0,0,0,7,
  +libncurses5,ncurses,5.9-10,shared libraries for terminal handling,http://invisible-island.net/ncurses/,0,https://security-tracker.debian.org/tracker/source-package/ncurses,https://www.openhub.net/projects/ncurses,GNU Ncurses,"The Ncurses (new curses) library is a free software emulation of curses in System V Release 4.0, and more. It uses Terminfo format, supports pads and color and multiple highlights and forms characters and function-key mapping, and has all the other SYSV-curses enhancements over BSD Curses.
  +
  +The ncurses code was developed under GNU/Linux. It has been in use for some time with OpenBSD as the system curses library, and on FreeBSD and NetBSD as an external package. It should port easily to any ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
  +
  +The distribution includes the library and support utilities, including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Full manual pages are provided for the library and tools.
  +
  +The Ncurses distribution is available via anonymous FTP at the GNU distribution site",http://www.gnu.org/software/ncurses/,http://ftp.gnu.org/pub/gnu/ncurses,1,2,219912,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,169897,C,Shared Library,0,0,0,7,
  +libncursesw5,ncurses,5.9-10,shared libraries for terminal handling (wide character support),http://invisible-island.net/ncurses/,0,https://security-tracker.debian.org/tracker/source-package/ncurses,https://www.openhub.net/projects/ncurses,GNU Ncurses,"The Ncurses (new curses) library is a free software emulation of curses in System V Release 4.0, and more. It uses Terminfo format, supports pads and color and multiple highlights and forms characters and function-key mapping, and has all the other SYSV-curses enhancements over BSD Curses.
  +
  +The ncurses code was developed under GNU/Linux. It has been in use for some time with OpenBSD as the system curses library, and on FreeBSD and NetBSD as an external package. It should port easily to any ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
  +
  +The distribution includes the library and support utilities, including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Full manual pages are provided for the library and tools.
  +
  +The Ncurses distribution is available via anonymous FTP at the GNU distribution site",http://www.gnu.org/software/ncurses/,http://ftp.gnu.org/pub/gnu/ncurses,1,2,219912,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,169864,C,Shared Library,0,0,0,7,
  +libnewt0.52,newt,0.52.14-11.1,Not Erik's Windowing Toolkit - text mode windowing with slang,https://fedorahosted.org/newt/,0,https://security-tracker.debian.org/tracker/source-package/newt,https://www.openhub.net/projects/newt,Ne.W.T.,NEthack With Tiles - A graphical interface for NetHack and Slash'EM,http://www.darkarts.co.za/newt,,1,1,698779,C,nethack,,,,,169443,C,Shared Library,0,0,0,7,
  +libpam-modules-bin,pam,1.1.3-7.1,Pluggable Authentication Modules for PAM - helper binaries,http://pam.sourceforge.net/,15,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,7,20,57169,C,BSD-3-Clause gpl gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",135322,C,Shared Library,0,1,0,7,"Critical central role for authentication.  Real site is http://www.linux-pam.org/ (Debian lists as http://pam.sourceforge.net/ but that points to https://fedorahosted.org/linux-pam/ which points to this). It has a somewhat active mailing list, and an active issue tracker where issues are clearly opened and closed. Stable version is somewhat old (2013); recent changes in git though relatively small (https://git.fedorahosted.org/cgit/linux-pam.git/) ++"
  +libpipeline1,libpipeline,1.2.1-1,pipeline manipulation library,http://libpipeline.nongnu.org/,0,https://security-tracker.debian.org/tracker/source-package/libpipeline,https://www.openhub.net/projects/libpipeline,libpipeline,"libpipeline is a C library for setting up and running pipelines of processes, without needing to involve shell command-line parsing which is often error-prone and insecure.",http://libpipeline.nongnu.org/,,1,6,87488,C,gpl3,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,135239,,Shared Library,0,0,0,7,
  +libpopt0,popt,1.16-7,lib for parsing cmdline parameters,http://rpm5.org/,0,https://security-tracker.debian.org/tracker/source-package/popt,https://www.openhub.net/projects/popt,popt,"popt is a command line option parsing library. While it is similiar
  +to getopt, it contains a number of enhancements, including:
  +
  +1) popt is fully reentrant
  +2) popt can parse arbitrary argv[] style arrays while getopt(3) makes this quite difficult
  +3) popt allows users to alias command line arguments
  +4) popt provides convience functions for parsing strings into argv[] style arrays",http://rpm5.org,http://rpm5.org/files/popt/,1,15,6165,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,169833,C,Shared Library,0,0,0,7,
  +libreadline6,readline6,6.2+dfsg-0.1,"GNU readline and history libraries, run-time libraries",,1,https://security-tracker.debian.org/tracker/source-package/readline6,,,,,,,,,,,,,,,161846,C,Shared Library,0,0,0,7,"Typically interactive same-user use, so unlikely to be security issue."
  +libslang2,slang2,2.2.4-15,S-Lang programming library - runtime version,http://www.jedsoft.org/slang/,0,https://security-tracker.debian.org/tracker/source-package/slang2,https://www.openhub.net/projects/s-lang,S-Lang,"S-Lang is a multi-platform programming library designed to allow creation of robust multi-platform software. It provides facilities required by interactive applications, including display/screen management, keyboard input, and keymaps. A major feature of the library is the S-Lang interpreter that may be easily embedded into a program to make it extensible. The interpreter may also be used in a stand-alone fashion through the use of slsh, which is part of the S-Lang distribution.",http://www.jedsoft.org/slang,http://www.jedsoft.org/slang/download.html,2,4,115067,C,gpl3_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Small development team,169837,,Shared Library,0,0,0,7,
  +libtasn1-3,,2.13-2+deb7u1,Manage ASN.1 structures (runtime),http://www.gnu.org/software/libtasn1/,6,https://security-tracker.debian.org/tracker/source-package/libtasn1-3,,,,,,,,,,,,,,,153250,,,0,1,0,7,"Important because X.509 certificates (standard for certificates) use ASN.1. A Gnu project, git repo and mailing list available from home page. No issue tracker found. Search on 'security' in mailing list archives shows a few messages from Debian using security-related compiler flags. Debian security page shows a history of CVE's being fixed, most recent in 2014. OpenHub page at https://www.openhub.net/p/libtasn1 gives stats. Active effort of one developer, with others contributing as recently as 9 months ago. ++"
  +libtinfo5,ncurses,5.9-10,shared low-level terminfo library for terminal handling,http://invisible-island.net/ncurses/,0,https://security-tracker.debian.org/tracker/source-package/ncurses,https://www.openhub.net/projects/ncurses,GNU Ncurses,"The Ncurses (new curses) library is a free software emulation of curses in System V Release 4.0, and more. It uses Terminfo format, supports pads and color and multiple highlights and forms characters and function-key mapping, and has all the other SYSV-curses enhancements over BSD Curses.
  +
  +The ncurses code was developed under GNU/Linux. It has been in use for some time with OpenBSD as the system curses library, and on FreeBSD and NetBSD as an external package. It should port easily to any ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
  +
  +The distribution includes the library and support utilities, including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Full manual pages are provided for the library and tools.
  +
  +The Ncurses distribution is available via anonymous FTP at the GNU distribution site",http://www.gnu.org/software/ncurses/,http://ftp.gnu.org/pub/gnu/ncurses,1,2,219912,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,136380,C,Shared Library,0,0,0,7,
  +libuuid-perl,,0.02-5,Perl extension for using UUID interfaces as defined in e2fsprogs,http://search.cpan.org/dist/UUID/,0,https://security-tracker.debian.org/tracker/source-package/libuuid-perl,https://www.openhub.net/projects/data-uuid,data-uuid,perl library for generating universally unique identifiers,http://github.com/rjbs/data-uuid,,2,13,1118,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Small development team,160564,Perl,Development Library,0,0,0,7,
  +libwrap0,tcp-wrappers,7.6.q-24,Wietse Venema's TCP wrappers library,,0,https://security-tracker.debian.org/tracker/source-package/tcp-wrappers,,,,,,,,,,,,,,,169717,C,Shared Library,0,1,0,7,Exposed to the network (wraps incoming requests). Has some security-relevant functions. Relatively small.
  +libxml2,,2.8.0+dfsg1-7+wheezy2,GNOME XML library,http://xmlsoft.org/,19,https://security-tracker.debian.org/tracker/source-package/libxml2,https://www.openhub.net/projects/libxml2,libxml2,"Libxml2 is the XML C parser and toolkit developed for the Gnome project (but usable outside of the Gnome platform).
  +
  +Includes the xmllint tool for checking documents for well-formedness, validating documents against a DTD or XML Schema, and pretty printing XML input.",http://www.xmlsoft.org/,http://www.xmlsoft.org/downloads.html,26,220,501621,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",168006,,,0,1,0,7,"Processes attacker-provided data. HAS Home Page, Has bug tracker https://bugzilla.gnome.org/buglist.cgi?product=libxml2 which is very active. ++"
   logrotate,,3.8.1-4,Log rotation utility,,6,https://security-tracker.debian.org/tracker/source-package/logrotate,https://www.openhub.net/projects/logrotate,logrotate,A logrotate alternative; easier to use.,http://sourceforge.net/projects/logrotate,,,,,,,,,,,169736,,Program,0,0,1,7,"Moves logs, but doesn't seriously analyze them, so attack opportunities reduced."
  -mime-support,,3.52-1,"MIME files 'mime.types' & 'mailcap', and support programs",,1,https://security-tracker.debian.org/tracker/source-package/mime-support,,,,,,,,,,,,,,,168503,Perl,Program,0,0,0,7,Processes potentially untrustworthy files.
  -tar,,1.26+dfsg-0.1,GNU version of the tar archiving utility,,1,https://security-tracker.debian.org/tracker/source-package/tar,https://www.openhub.net/projects/tar,GNU tar,"The Tar program provides the ability to create tar archives, as well as various other kinds of manipulation.",http://savannah.gnu.org/projects/tar/,,7,21,23449,C,gpl ,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",169899,,,0,1,0,7,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. Has Home page, mailing list, Public Repo git://git.savannah.gnu.org/tar.git, uses ""technical support"" for issue tracking (could be confusing).  Does have changes in git repo, but only a few a month and typically small. ++"
  -x11-common,xorg,1:7.7+3~deb7u1,X Window System (X.Org) infrastructure,,2,https://security-tracker.debian.org/tracker/source-package/xorg,https://www.openhub.net/projects/x,X.Org,"X.Org provides an open source implementation of the network-transparent X Window System, as well as working on the standard itself.
  -
  -The development work is being done as part of the freedesktop.org community, sponsored by the X.Org Foundation.",http://www.x.org/wiki/,http://www.x.org/wiki/Releases/Download,150,1146,3305416,C,BSD-3-Clause mit ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",142707,"sh, bash, ksh, tcsh and other shells",,0,0,1,7,X development is transitioning towards Wayland.
  -xserver-xorg-core,xorg-server,2:1.12.4-6+deb7u5,Xorg X server - core server,,24,https://security-tracker.debian.org/tracker/source-package/xorg-server,https://www.openhub.net/projects/xserver-xorg-driver-ati,xserver-xorg-driver-ati,,,,12,165,49507,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",99612,C,Program,0,0,0,7,X development is transitioning towards Wayland.
  -xz-utils,,5.1.1alpha+20120614-2,XZ-format compression utilities,http://tukaani.org/xz/,0,https://security-tracker.debian.org/tracker/source-package/xz-utils,https://www.openhub.net/projects/xz-utils,XZ Utils,"XZ Utils is free general-purpose data compression software with high compression ratio. XZ Utils were written for POSIX-like systems, but also work on some not-so-POSIX systems. XZ Utils are the successor to LZMA Utils.",http://tukaani.org/xz/,,4,13,27105,C,gpl lgpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Average size development team,161482,C,,0,1,0,7,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. HAS Home Page, public code repo http://git.tukaani.org/?p=xz.git;a=summary - fairly active by small # of committers.  Some mailing list activity.  No bug tracker found. ++"
  -zlib1g,zlib,1:1.2.7.dfsg-13,compression library - runtime,http://zlib.net/,0,https://security-tracker.debian.org/tracker/source-package/zlib,https://www.openhub.net/projects/zlib,zlib,"zlib is designed to be a free, general-purpose, legally unencumbered -- that is, not covered by any patents -- lossless data-compression library for use on virtually any computer hardware and operating system. The zlib data format is itself portable across platforms. Unlike the LZW compression method used in Unix compress(1) and in the GIF image format, the compression method currently used in zlib essentially never expands the data. (LZW can double or triple the file size in extreme cases.) zlib's memory footprint is also independent of the input data and can be reduced, if necessary, at some cost in compression.",http://www.zlib.net/,http://www.zlib.net/,0,20,36295,C,zlib_libpng ,Decreasing Y-O-Y development activity,"Young, but established codebase",Well-commented source code,No recent development activity,169896,C,Shared Library,0,1,0,7,"Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. HAS Home Page, has mailing list zlib@gzip.org, NO issue tracker, Latest release April 2013 (old). +++"
  -analog,,2:6.0-19.1,web server log analyzer,http://www.analog.cx/,0,https://security-tracker.debian.org/tracker/source-package/analog,https://www.openhub.net/projects/AnalogCAmie,Analog C:Amie Edition,"Analog was created by Stephen Turner in 1995 as a multi-purpose, multi-platform log file analyser. He maintained the project until 2004, at which point he ceased to update the project. In 2007, as a long-term user of Analog and in light of the release of Windows Vista that could not be identified by Analog, C:Amie has undertaken to maintain Analog and to keep its detection current.",http://camie.dyndns.org/analog/,http://camie.dyndns.org/analog/download/,,,,,,,,,,23315,,Program,1,0,0,7,"Web log analyzer, analyzes attacker-provided data.  Could conceivably be way to attack via maliciously-formatted data for logging."
  -apache2-mpm-worker,apache2,2.2.22-13+deb7u3,Apache HTTP Server - high speed threaded model,http://httpd.apache.org/,42,https://security-tracker.debian.org/tracker/source-package/apache2,https://www.openhub.net/projects/apache,Apache HTTP Server,"The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.",http://httpd.apache.org/,http://httpd.apache.org/download.cgi,30,115,1742162,C,apache_2 ,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",16235,C,Program,1,0,0,7,"Vitally important.  Note, however, that there's already large development & review team in place."
  -libapr1,apr,1.4.6-3+deb7u1,Apache Portable Runtime Library,http://apr.apache.org/,3,https://security-tracker.debian.org/tracker/source-package/apr,https://www.openhub.net/projects/apr,Apache Portable Runtime,"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.",http://apr.apache.org/,,13,66,417288,C,apache_2 ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",125815,C,Shared Library,0,1,0,7,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  However, it's not as clear that the LDAP library in it is as actively managed. HAS Home Page, HAS Mailing List, Issue tracker https://bz.apache.org/bugzilla/enter_bug.cgi?product=APR \++"
  -libaprutil1,apr-util,1.4.1-3,Apache Portable Runtime Utility Library,http://apr.apache.org/,1,https://security-tracker.debian.org/tracker/source-package/apr-util,https://www.openhub.net/projects/apr,Apache Portable Runtime,"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.",http://apr.apache.org/,,13,66,417288,C,apache_2 ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",125468,C,Shared Library,0,1,0,7,"Important. The general Apache Portable Runtime (APR) appears to be actively maintained.  However, it's not as clear that the LDAP library in it is as actively managed. HAS Home Page, HAS Mailing List, Issue tracker https://bz.apache.org/bugzilla/enter_bug.cgi?product=APR \++"
  -libjpeg8,,8d-1+deb7u1,Independent JPEG Group's JPEG runtime library,,2,https://security-tracker.debian.org/tracker/source-package/libjpeg8,https://www.openhub.net/projects/libjpeg,libjpeg,A widely used free library for JPEG image compression.,http://www.ijg.org,http://www.ijg.org,0,5,58006,C,IJG ,Stable Y-O-Y development activity,Well-established codebase,Very well-commented source code,No recent development activity,118088,C,Shared Library,0,1,0,7,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can download as tarball, NO issue tracker, latest version/activity Jan 2014, NO mailing list +++"
  +m4,,1.4.16-3,a macro processing language,http://www.gnu.org/software/m4/,0,https://security-tracker.debian.org/tracker/source-package/m4,https://www.openhub.net/projects/m4,GNU M4,"GNU M4 is an implementation of the traditional Unix macro processor. It is mostly SVR4 compatible although it has some extensions (for example, handling more than 9 positional parameters to macros). GNU m4 also has built-in functions for including files, running shell commands, doing arithmetic, etc.",http://www.gnu.org/software/m4/,https://savannah.gnu.org/projects/m4/,3,16,79426,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,154235,C,,0,0,0,7,
  +mawk,,1.3.3-17,a pattern scanning and text processing language,,0,https://security-tracker.debian.org/tracker/source-package/mawk,https://www.openhub.net/projects/mawk,mawk,"An interpreter for the AWK Programming Language. 
  +
  +Originally written by Mike Brennan when gawk was not widely known, it remains the fastest free and decent AWK implementation to date.",http://invisible-island.net/mawk/mawk.html,http://invisible-island.net/datafiles/release/mawk.tar.gz,2,5,33481,C,GNU_General_Public_License_v2_0_only,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,169562,C,,0,0,0,7,
  +mlocate,,0.23.1-1,quickly find files on the filesystem based on their name,http://carolina.mff.cuni.cz/~trmac/blog/mlocate,0,https://security-tracker.debian.org/tracker/source-package/mlocate,https://www.openhub.net/projects/mlocate,mlocate,"mlocate is a new locate implementation. The  m  stands for  merging : updatedb reuses the existing database to avoid rereading most of the file system, which makes updatedb faster and does not trash the system caches as much.
  +
  +The locate(1) utility is intended to be completely compatible to slocate. It also attempts to be compatible to GNU locate, when it does not conflict with slocate compatibility.",https://fedorahosted.org/mlocate,https://fedorahosted.org/mlocate/wiki/MlocateDownloads,1,51,3392,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,145934,C,,0,0,0,7,
  +mutt,,1.5.21-6.2+deb7u3,"text-based mailreader supporting MIME, GPG, PGP and threading",http://www.mutt.org/,3,https://security-tracker.debian.org/tracker/source-package/mutt,https://www.openhub.net/projects/mutt,mutt,"Mutt is a small but very powerful text-based mail client for Unix operating systems.
  +
  +Though written from scratch, Mutt's initial interface was based largely on the ELM mail client. To a large extent, Mutt is still very ELM-like in presentation of information in menus (and in fact, ELM users will find it quite painless to switch as the default key bindings are identical). As development progressed, features found in other popular clients such as PINE and MUSH have been added, the result being a hybrid, or ""mutt.""",http://www.mutt.org/,http://www.mutt.org/download.html,7,210,94261,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",148965,C,,1,0,0,7,Rarely used in practice
  +ncurses-bin,ncurses,5.9-10,terminal-related programs and man pages,http://invisible-island.net/ncurses/,0,https://security-tracker.debian.org/tracker/source-package/ncurses,https://www.openhub.net/projects/ncurses,GNU Ncurses,"The Ncurses (new curses) library is a free software emulation of curses in System V Release 4.0, and more. It uses Terminfo format, supports pads and color and multiple highlights and forms characters and function-key mapping, and has all the other SYSV-curses enhancements over BSD Curses.
  +
  +The ncurses code was developed under GNU/Linux. It has been in use for some time with OpenBSD as the system curses library, and on FreeBSD and NetBSD as an external package. It should port easily to any ANSI/POSIX-conforming UNIX. It has even been ported to OS/2 Warp!
  +
  +The distribution includes the library and support utilities, including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Full manual pages are provided for the library and tools.
  +
  +The Ncurses distribution is available via anonymous FTP at the GNU distribution site",http://www.gnu.org/software/ncurses/,http://ftp.gnu.org/pub/gnu/ncurses,1,2,219912,C,mit,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Only a single active developer,169897,C,Program,0,0,0,7,
  +passwd,shadow,1:4.1.5.1-1,change and administer password and group data,http://pkg-shadow.alioth.debian.org/,2,https://security-tracker.debian.org/tracker/source-package/shadow,https://www.openhub.net/projects/shadow-tool-suite,Shadow Tool Suite,"The shadow tool suite contains the following commands among others: login, passwd, useradd, groupadd.",http://pkg-shadow.alioth.debian.org/,http://pkg-shadow.alioth.debian.org/download.php,7,20,127125,C,bsd,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",169894,C,,1,0,0,7,Critical for security; unclear if undicovered vulnerabilities are likely to be here.
  +psmisc,,22.19-1+deb7u1,utilities that use the proc file system,http://psmisc.sf.net/,0,https://security-tracker.debian.org/tracker/source-package/psmisc,https://www.openhub.net/projects/psmisc,psmisc,"This PSmisc package is a set of some small useful utilities that use the proc filesystem. We're not about changing the world, but providing the system administrator with some help in common tasks.
  +
  +There is options for using SELinux if you need it and fuser understands IPv6. It also speaks various languages using the gettext facilities.",http://psmisc.sourceforge.net/,http://psmisc.sourceforge.net/,3,21,9265,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Small development team,164833,C,Program,0,0,0,7,
  +python-soappy,,0.12.0-4,SOAP Support for Python,http://pywebsvcs.sourceforge.net/,2,https://security-tracker.debian.org/tracker/source-package/python-soappy,https://www.openhub.net/projects/python-soappy,python-soappy,,,,0,7,8587,Python,,Stable Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,122669,,Application Data,1,0,0,7,
  +python-support,,1.0.15,automated rebuilding support for Python modules,,0,https://security-tracker.debian.org/tracker/source-package/python-support,https://www.openhub.net/projects/python-support,python-support,,,,0,4,1031,Python,,Stable Y-O-Y development activity,Well-established codebase,Few source code comments,No recent development activity,160212,,,0,0,0,7,
  +rpcbind,,0.2.0-8,converts RPC program numbers into universal addresses,http://sourceforge.net/projects/rpcbind/,2,https://security-tracker.debian.org/tracker/source-package/rpcbind,https://www.openhub.net/projects/rpcbind,RPCBind,The rpcbind utility is a server that converts RPC program numbers into universal addresses. Note: The SVN Repository on this site is *not* used. Use the git://git.infradead.org/~steved/rpcbind.git GIT tree,http://sourceforge.net/projects/rpcbind,,,,,,,,,,,117570,,,1,0,0,7,"IPC communication, including network communcation from untrustworthy sources."
  +traceroute,,1:2.0.18-3,Traces the route taken by packets over an IPv4/IPv6 network,http://traceroute.sourceforge.net/,0,https://security-tracker.debian.org/tracker/source-package/traceroute,,,,,,,,,,,,,,,169058,C,Program,1,0,0,7,"Attackers could conceivably reply with attack (using malicious packets), that'd be sneaky."
  +wget,,1.13.4-3+deb7u2,retrieves files from the web,http://www.gnu.org/software/wget/,2,https://security-tracker.debian.org/tracker/source-package/wget,https://www.openhub.net/projects/wget,Wget,"GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.",http://www.gnu.org/software/wget/,http://ftp.gnu.org/pub/gnu/wget/,35,119,41658,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",169664,C,,1,0,0,7,"Directly processes potentially-malicious data from the Internet, often used in scripts. GNU project. https://www.gnu.org/software/wget/ Actual development on GNU's Savannah using git and its bugtracker, http://savannah.gnu.org/projects/wget/ Actively developed, many patches. wget-1.16.3 released 2015-03-09 on downloads. Note that this is directly exposed to attack.  It has some code documentation (e.g., http://wget.addictivecode.org/NavigatingTheSource), but it warns that it can be fairly hard to follow, contains a fair number of hacks, and functionality that was ""tacked on"" (which is not good for security). ++"
  +whiptail,newt,0.52.14-11.1,Displays user-friendly dialog boxes from shell scripts,https://fedorahosted.org/newt/,0,https://security-tracker.debian.org/tracker/source-package/newt,https://www.openhub.net/projects/newt,Ne.W.T.,NEthack With Tiles - A graphical interface for NetHack and Slash'EM,http://www.darkarts.co.za/newt,,1,1,698779,C,nethack,,,,,169275,C,,0,0,0,7,
  +xauth,,1:1.0.7-1,X authentication utility,,0,https://security-tracker.debian.org/tracker/source-package/xauth,,,,,,,,,,,,,,,160270,C,,0,0,1,7,"X Authentication - might enable local privilege escalation.  Home Page: http://www.x.org/ There are current efforts to replace this (e.g., Wayland, Mir). Public code repo is mentioned in dev docs, but clone URL is never stated. Probably given out on request. One nice thing... www.x.org/wiki/Development/Security/ ++"
  +xml-core,,0.13+nmu2,XML infrastructure and XML catalog file support,,0,https://security-tracker.debian.org/tracker/source-package/xml-core,https://www.openhub.net/projects/perl-xml-simple,XML::Simple,"XML::Simple is a Perl module that makes it really easy to read and write XML files. It was originally developed for the purpose of reading and writing config files in XML format, many people find it useful for other purposes.",http://search.cpan.org/dist/XML-Simple/,,0,1,4350,Perl,Artistic_License_2_0 gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,No recent development activity,155949,Perl,,0,1,0,7,
  +xserver-common,xorg-server,2:1.12.4-6+deb7u5,common files used by various X servers,,27,https://security-tracker.debian.org/tracker/source-package/xorg-server,https://www.openhub.net/projects/xserver-xorg-driver-ati,xserver-xorg-driver-ati,,,,12,165,49507,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",98643,,,0,0,0,7,
  +xserver-xorg-core,xorg-server,2:1.12.4-6+deb7u5,Xorg X server - core server,,27,https://security-tracker.debian.org/tracker/source-package/xorg-server,https://www.openhub.net/projects/xserver-xorg-driver-ati,xserver-xorg-driver-ati,,,,12,165,49507,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",99612,,,0,0,0,7,X development is transitioning towards Wayland.
  +apache2-mpm-worker,apache2,2.2.22-13+deb7u3,Apache HTTP Server - high speed threaded model,http://httpd.apache.org/,47,https://security-tracker.debian.org/tracker/source-package/apache2,https://www.openhub.net/projects/apache,Apache HTTP Server,"The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.",http://httpd.apache.org/,http://httpd.apache.org/download.cgi,30,117,1760653,C,apache_2,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",16235,C,Program,1,0,0,7,"Vitally important.  Note, however, that there's already large development & review team in place."
   libpng12-0,libpng,1.2.49-1,PNG library - runtime,http://libpng.org/pub/png/libpng.html,20,https://security-tracker.debian.org/tracker/source-package/libpng,https://www.openhub.net/projects/libpng,libpng,"libpng is the official PNG reference library. It supports almost all PNG features, is extensible, and has been extensively tested for over 17 years.
   
   libpng is available as ANSI C source code and requires zlib 1.0.4 or later (1.2.3 or 1.1.4 recommended due to potential security vulnerabilities in earlier versions). In addition to the main library sources, libpng includes the rpng, rpng2 and wpng demo programs, the pngminus demo program, a subset of Willem van Schaik's PngSuite test images, and Willem's VisualPng demo program.  Configure, CMake, Visualc projects, and various makefiles are included for building libpng.
   
  -Libpng is under the libpng license.",http://www.libpng.org/pub/png/libpng.html,http://sourceforge.net/project/showfiles.php?group_id=5624,4,9,401845,C,libpng ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,153194,C,Shared Library,0,1,0,7,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can Access Source code, Not much activity - just warnings about CVEs that were fixed. +++"
  -ssl-cert,,1.0.32,simple debconf wrapper for OpenSSL,,0,https://security-tracker.debian.org/tracker/source-package/ssl-cert,https://www.openhub.net/projects/debconf,debconf,,,,4,21,9380,Perl,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,135045,,Program,1,0,0,7,See OpenSSL.
  -gnutls-bin,gnutls26 (2.12.20-8+deb7u2),3.0.22-3+really2.12.20-8+deb7u2,GNU TLS library - commandline utilities,http://www.gnutls.org/,17,https://security-tracker.debian.org/tracker/source-package/gnutls26,https://www.openhub.net/projects/gnutls,GnuTLS,"GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. It is aimed to be portable and efficient with focus on security and interoperability.",http://www.gnutls.org,,24,72,190431,C,gpl3_or_later lgpl21_or_later ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",3291,C,Program,1,0,0,7,See GnuTLS.
  +Libpng is under the libpng license.",http://www.libpng.org/pub/png/libpng.html,http://sourceforge.net/project/showfiles.php?group_id=5624,5,10,407995,C,libpng,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,153194,C,Shared Library,0,1,0,7,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can Access Source code, Not much activity - just warnings about CVEs that were fixed. +++"
  +gnutls-bin,gnutls26 (2.12.20-8+deb7u2),3.0.22-3+really2.12.20-8+deb7u2,GNU TLS library - commandline utilities,http://www.gnutls.org/,21,https://security-tracker.debian.org/tracker/source-package/gnutls26,https://www.openhub.net/projects/gnutls,GnuTLS,"GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. It is aimed to be portable and efficient with focus on security and interoperability.",http://www.gnutls.org,,21,79,185927,C,gpl3_or_later lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",3291,,,1,0,0,7,See GnuTLS.
   libpolarssl-runtime,polarssl,1.2.9-1~deb7u3,lightweight crypto and SSL/TLS library,http://polarssl.org,13,https://security-tracker.debian.org/tracker/source-package/polarssl,https://www.openhub.net/projects/polarssl,PolarSSL,"PolarSSL is a light-weight open-source cryptographic library for embedded systems.
   
   Its designed to be:
  
positive.code:     * Interoperability (Compliance with SSH 1.3, 1.5, and 2.0 protocol Standards)
      * SFTP client and server support in both SSH1 and SSH2 protocols.
      * Kerberos and AFS Ticket Passing
      * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,25,92,64718,C,BSD-3-Clause ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",132473,,Application Data,0,0,0,3,
  python-soappy,,0.12.0-4,SOAP Support for Python,http://pywebsvcs.sourceforge.net/,2,https://security-tracker.debian.org/tracker/source-package/python-soappy,https://www.openhub.net/projects/python-soappy,python-soappy,,,,0,7,8587,Python,,Stable Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,122669,,Application Data,1,0,0,3,
  sysv-rc,sysvinit,2.88dsf-41+deb7u1,System-V-like runlevel change mechanism,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/sysvinit,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,1,2,8054,C,gpl ,Increasing Y-O-Y development activity,Well-established codebase,Average number of code comments,Only a single active developer,169739,,Application Data,0,0,0,3,
  task-english,tasksel,3.14.1,General English environment,,0,https://security-tracker.debian.org/tracker/source-package/tasksel,https://www.openhub.net/projects/tasksel,tasksel,"Tool for selecting tasks for installation on Debian system.
  
  tasksel is a simple interface for users who want to pick general tasks for installation on their Debian GNU/Linux system. This program is used during the installation process, but users can also use tasksel at any point.",https://launchpad.net/tasksel,,7,132,2062,Perl,gpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",50189,,,0,0,0,3,
  tzdata,,2014h-0wheezy1,time zone and daylight-saving time data,http://www.iana.org/time-zones,0,https://security-tracker.debian.org/tracker/source-package/tzdata,,,,,,,,,,,,,,,169781,,Application Data,0,0,0,3,
  util-linux-locales,util-linux,2.20.1-5.3,Locales files for util-linux,http://userweb.kernel.org/~kzak/util-linux/,4,https://security-tracker.debian.org/tracker/source-package/util-linux,https://www.openhub.net/projects/util-linux-ng,util-linux,util-linux is a random collection of Linux utilities,https://raw.githubusercontent.com/karelzak/util-linux/master/README,http://ftp.kernel.org/pub/linux/utils/util-linux-ng/,86,384,116273,C,bsd gpl3_or_later lgpl21_or_later Public_Domain ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",89412,,Application Data,0,0,0,3,
  vim-common,vim,2:7.3.547-7,Vi IMproved - Common files,http://www.vim.org/,1,https://security-tracker.debian.org/tracker/source-package/vim,https://www.openhub.net/projects/vim,Vim,"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. It's useful whether you're already using vi or using a different editor.",http://www.vim.org/,http://www.vim.org/download.php,1,12,840554,C,Vim_License ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,168687,,Application Data,0,0,0,3,
  xfonts-base,,1:1.0.3,standard fonts for X,,0,https://security-tracker.debian.org/tracker/source-package/xfonts-base,https://www.openhub.net/projects/xfonts,Linux Font Project,Developing console fonts and fixed- and variable-width fonts for X (and porting some of them to Windows). The purpose is to make new fonts to enrich the very poor selection of fonts available in both console and X and improve the existing ones.,http://sourceforge.net/projects/xfonts/,,,,,,,,,,,101661,,Application Data,0,0,0,3,
  xfonts-encodings,,1:1.0.4-1,Encodings for X.Org fonts,,0,https://security-tracker.debian.org/tracker/source-package/xfonts-encodings,https://www.openhub.net/projects/xfonts,Linux Font Project,Developing console fonts and fixed- and variable-width fonts for X (and porting some of them to Windows). The purpose is to make new fonts to enrich the very poor selection of fonts available in both console and X and improve the existing ones.,http://sourceforge.net/projects/xfonts/,,,,,,,,,,,116688,,Application Data,0,0,0,3,
  task-web-server,tasksel,3.14.1,Web server,,0,https://security-tracker.debian.org/tracker/source-package/tasksel,https://www.openhub.net/projects/tasksel,tasksel,"Tool for selecting tasks for installation on Debian system.
  
  tasksel is a simple interface for users who want to pick general tasks for installation on their Debian GNU/Linux system. This program is used during the installation process, but users can also use tasksel at any point.",https://launchpad.net/tasksel,,7,132,2062,Perl,gpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",14292,,Program,0,0,0,3,
  debconf-i18n,debconf,1.5.49,full internationalization support for debconf,,0,https://security-tracker.debian.org/tracker/source-package/debconf,https://www.openhub.net/projects/debconf,debconf,,,,4,21,9380,Perl,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Average size development team,168799,,Application Data,0,0,0,2,
  gcc-4.6-base,gcc-4.6,4.6.3-14,"GCC, the GNU Compiler Collection (base package)",http://gcc.gnu.org/,1,https://security-tracker.debian.org/tracker/source-package/gcc-4.6,https://www.openhub.net/projects/gcc,GNU Compiler Collection,"The GNU Compiler Collection includes front ends for C, C++, Objective-C, Fortran, Java, and Ada, as well as libraries for these languages (libstdc++, libgcj,...).",http://gcc.gnu.org/,http://gcc.gnu.org/install/binaries.html,205,538,6946142,C,gpl3_or_later ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",48090,,Application Data,0,0,0,2,
  ienglish-common,ispell,3.3.02-6,Common files for British and American ispell dictionaries,http://www.lasr.cs.ucla.edu/geoff/ispell.html,0,https://security-tracker.debian.org/tracker/source-package/ispell,,,,,,,,,,,,,,,59098,,Application Data,0,0,0,2,
  libsemanage-common,libsemanage,2.1.6-6,Common files for SELinux policy management libraries,http://userspace.selinuxproject.org/,0,https://security-tracker.debian.org/tracker/source-package/libsemanage,https://www.openhub.net/projects/libsemanage,libsemanage,An interface for SELinux management,https://github.com/pld-linux/libsemanage,,1,9,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Only a single active developer,136084,,Application Data,0,0,1,2,
  iso-codes,,3.41-1,"ISO language, territory, currency, script codes and their translations",http://pkg-isocodes.alioth.debian.org/,0,https://security-tracker.debian.org/tracker/source-package/iso-codes,https://www.openhub.net/projects/iso-codes,iso-codes,"This package provides the ISO-639 Language code list, the ISO-4217 currency list, the ISO-3166 Territory code list, and ISO-3166-2 sub-territory lists.
  It also (more importantly) provides their translations in .po form.",http://pkg-isocodes.alioth.debian.org/,http://pkg-isocodes.alioth.debian.org/,3,67,121687,shell script,lgpl ,,,,,151137,,Standalone Data,0,0,0,1,
  tasksel-data,tasksel,3.14.1,Official tasks used for installation of Debian systems,,0,https://security-tracker.debian.org/tracker/source-package/tasksel,https://www.openhub.net/projects/tasksel,tasksel,"Tool for selecting tasks for installation on Debian system.
  
  tasksel is a simple interface for users who want to pick general tasks for installation on their Debian GNU/Linux system. This program is used during the installation process, but users can also use tasksel at any point.",https://launchpad.net/tasksel,,7,132,2062,Perl,gpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",164602,,Application Data,0,0,0,1,
  wamerican,scowl,7.1-1,American English dictionary words for /usr/share/dict,http://wordlist.sourceforge.net/,0,https://security-tracker.debian.org/tracker/source-package/scowl,https://www.openhub.net/projects/scowl,SCOWL (and friends),"SCOWL (Spell Checker Oriented Word Lists) is a database of English words that can be used to create word lists suitable for use in spell checkers of various sizes and dialects (America, British (both -ise and -ize) and Canadian). However, I am sure it will have numerous other uses as well.
  
  The main product of SCOWL are spell checker dictionaries for Hunspell and Aspell.
  
  SCOWL was created by carefully combing many other high quality wordlists. The creation of SCOWL also lead to many other useful artifacts.
  
  One of the main sources used by SCOWL is Alan Beale 12Dicts package.
  
  One of the main artifacts created was the VarCon (Variant Conversion) database, that can be used to convert between American, British and Canadian dictionaries.",http://wordlist.aspell.net,,3,4,7536,Perl,BSD-3-Clause mit ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Small development team,155222,,Application Data,0,0,0,1,
  
negative.code:     * Interoperability (Compliance with SSH 1.3, 1.5, and 2.0 protocol Standards)
      * SFTP client and server support in both SSH1 and SSH2 protocols.
      * Kerberos and AFS Ticket Passing
      * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,23,92,69047,C,BSD-3-Clause,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",140377,,Application Data,0,0,0,0,
  openssh-blacklist-extra,openssh-blacklist,0.4.1+nmu1,list of non-default blacklisted OpenSSH RSA and DSA keys,,0,https://security-tracker.debian.org/tracker/source-package/openssh-blacklist,https://www.openhub.net/projects/openssh,OpenSSH,"OpenSSH is a free SSH/SecSH protocol suite providing encryption for network services like remote login or remote file transfer.
  
  The following is a list of OpenSSH features:
  