anchor.diff:      * Interoperability (Compliance with SSH 1.3, 1.5, and 2.0 protocol Standards)
       * SFTP client and server support in both SSH1 and SSH2 protocols.
       * Kerberos and AFS Ticket Passing
  -    * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,25,92,64718,C,BSD-3-Clause ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",140377,,Application Data,0,0,0,3,
  +    * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,23,92,69047,C,BSD-3-Clause,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",140377,,Application Data,0,0,0,0,
   openssh-blacklist-extra,openssh-blacklist,0.4.1+nmu1,list of non-default blacklisted OpenSSH RSA and DSA keys,,0,https://security-tracker.debian.org/tracker/source-package/openssh-blacklist,https://www.openhub.net/projects/openssh,OpenSSH,"OpenSSH is a free SSH/SecSH protocol suite providing encryption for network services like remote login or remote file transfer.
   
   The following is a list of OpenSSH features:
  
positive.code: project_name,debian_source,debian_version,debian_desc,debian_home,CVE_since_2010,CVE_page,openhub_page,openhub_name,openhub_desc,openhub_home,openhub_download,twelve_month_contributor_count,total_contributor_count,total_code_lines,main_language_name,licenses,fact_activity,fact_age,fact_comments,fact_team_size,package_popularity,implemented_in,role,direct_network_exposure,process_network_data,potential_privilege_escalation,risk_index(max = 16),comment_on_priority
  ftp,netkit-ftp,0.17-27,classical file transfer client,,0,https://security-tracker.debian.org/tracker/source-package/netkit-ftp,,,,,,,,,,,,,,,149032,C,Program,1,0,0,11,"Ftp isn't secure by itself, and the ftp client is less commonly used now.  That said, it certainly is used and connects to the wide Internet."
  netcat-traditional,netcat,1.10-40,TCP/IP swiss army knife,,0,https://security-tracker.debian.org/tracker/source-package/netcat,,,,,,,,,,,,,,,166141,C,,1,0,0,11,Netcat is typically used only by invocation in specific cases.
  tcpd,tcp-wrappers,7.6.q-24,Wietse Venema's TCP wrapper utilities,,0,https://security-tracker.debian.org/tracker/source-package/tcp-wrappers,,,,,,,,,,,,,,,160357,C,Program,1,0,0,11,Exposed to the network (wraps incoming requests). Has some security-relevant functions. Relatively small.
  whois,,5.1.1~deb7u1,intelligent WHOIS client,,0,https://security-tracker.debian.org/tracker/source-package/whois,,,,,,,,,,,,,,,156467,C,Program,1,0,0,11,Less commonly used.
  at,,3.1.13-2+deb7u1,Delayed job execution and batch processing,,0,https://security-tracker.debian.org/tracker/source-package/at,https://www.openhub.net/projects/at,,,,,,,,,,,,,,151086,C,,0,0,1,10,Could potentially enable local privilege escalation.
  libwrap0,tcp-wrappers,7.6.q-24,Wietse Venema's TCP wrappers library,,0,https://security-tracker.debian.org/tracker/source-package/tcp-wrappers,,,,,,,,,,,,,,,169717,C,Shared Library,0,1,0,10,Exposed to the network (wraps incoming requests). Has some security-relevant functions. Relatively small.
  traceroute,,1:2.0.18-3,Traces the route taken by packets over an IPv4/IPv6 network,http://traceroute.sourceforge.net/,0,https://security-tracker.debian.org/tracker/source-package/traceroute,,,,,,,,,,,,,,,169058,C,Program,1,0,0,10,"Attackers could conceivably reply with attack (using malicious packets), that'd be sneaky."
  xauth,,1:1.0.7-1,X authentication utility,,0,https://security-tracker.debian.org/tracker/source-package/xauth,,,,,,,,,,,,,,,160270,C,,0,0,1,10,"X Authentication - might enable local privilege escalation.  Home Page: http://www.x.org/ There are current efforts to replace this (e.g., Wayland, Mir). Public code repo is mentioned in dev docs, but clone URL is never stated. Probably given out on request. One nice thing... www.x.org/wiki/Development/Security/ ++"
  bzip2,,1.0.6-4,high-quality block-sorting file compressor - utilities,http://www.bzip.org/,2,https://security-tracker.debian.org/tracker/source-package/bzip2,https://www.openhub.net/projects/bzip2,bzip2,"bzip2 is a freely available, patent free, high-quality data compressor. It typically compresses files to within 10% to 15% of the best available techniques (the PPM family of statistical compressors), whilst being around twice as fast at compression and six times faster at decompression.",http://bzip.org/,http://www.bzip.org/downloads.html,,,,,BSD-3-Clause ,,,,,154602,C,,0,1,0,9,"Bzip2 is widely used for decompression of network-supplied data. No code repo, only released code source tarballs. This is the reference implementation, many alternate implementations shown on https://en.wikipedia.org/wiki/Bzip2. Last release in 2010, v1.0.6, in response to CVE-2010-0405. No forums found. At least one HTTP server supports bzip2 for compression.  +++"
  hostname,,3.11,utility to set/show the host name or domain name,,0,https://security-tracker.debian.org/tracker/source-package/hostname,,,,,,,,,,,,,,,169894,C,,0,0,0,9,Relatively small functionality.
  libacl1,acl,2.2.51-8,Access control list shared library,http://savannah.nongnu.org/projects/acl/,0,https://security-tracker.debian.org/tracker/source-package/acl,,,,,,,,,,,,,,,169898,C,Shared Library,0,0,1,9,"Access control-related, so of concern."
  libaudit0,audit,1:1.7.18-1.1,Dynamic library for security auditing,http://people.redhat.com/sgrubb/audit/,0,https://security-tracker.debian.org/tracker/source-package/audit,,,,,,,,,,,,,,,75354,C,Shared Library,0,0,1,9,"Audit framework for Debian, many other components depend on it.  Useful for detecting problems. Project infrastructure at Red Hat. SVN repo available. Most recent code change 2 months ago. Mailing lists and IRC exist. v2.4 release 10/2014, plans exist for v2.5 and 2.6. Couldn't find an issue tracker. ++"
  libbz2-1.0,bzip2,1.0.6-4,high-quality block-sorting file compressor library - runtime,http://www.bzip.org/,2,https://security-tracker.debian.org/tracker/source-package/bzip2,https://www.openhub.net/projects/bzip2,bzip2,"bzip2 is a freely available, patent free, high-quality data compressor. It typically compresses files to within 10% to 15% of the best available techniques (the PPM family of statistical compressors), whilst being around twice as fast at compression and six times faster at decompression.",http://bzip.org/,http://www.bzip.org/downloads.html,,,,,BSD-3-Clause ,,,,,169891,C,Shared Library,0,1,0,9,Bzip2 is widely used for decompression of network-supplied data. ++
  libept1.4.12,libept,1.0.9,High-level library for managing Debian package information,,0,https://security-tracker.debian.org/tracker/source-package/libept,,,,,,,,,,,,,,,129952,C++,Development Library,0,0,0,9,"Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  libreadline6,readline6,6.2+dfsg-0.1,"GNU readline and history libraries, run-time libraries",,1,https://security-tracker.debian.org/tracker/source-package/readline6,,,,,,,,,,,,,,,161846,C,Shared Library,0,0,0,9,"Typically interactive same-user use, so unlikely to be security issue."
  libtasn1-3,,2.13-2+deb7u1,Manage ASN.1 structures (runtime),http://www.gnu.org/software/libtasn1/,4,https://security-tracker.debian.org/tracker/source-package/libtasn1-3,,,,,,,,,,,,,,,153250,C,Shared Library,0,1,0,9,"Important because X.509 certificates (standard for certificates) use ASN.1. A Gnu project, git repo and mailing list available from home page. No issue tracker found. Search on 'security' in mailing list archives shows a few messages from Debian using security-related compiler flags. Debian security page shows a history of CVE's being fixed, most recent in 2014. OpenHub page at https://www.openhub.net/p/libtasn1 gives stats. Active effort of one developer, with others contributing as recently as 9 months ago. ++"
  linux-base,,3.5,Linux image base package,,0,https://security-tracker.debian.org/tracker/source-package/linux-base,,,,,,,,,,,,,,,159593,C,Program,0,0,0,9,These are small scripts and utilities for the Linux kernel.
  telnet,netkit-telnet,0.17-36,The telnet client,,0,https://security-tracker.debian.org/tracker/source-package/netkit-telnet,,,,,,,,,,,,,,,155277,,Program,1,0,0,9,Telnet is a fundamentally insecure protocol and is being phased out in most locations.
  bind9-host,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Version of 'host' bundled with BIND 9.X,,32,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,6,46,635185,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,161011,C,Program,1,0,0,8,"Bind9 is critical for security. It does have active development. Support is via mailing lists. Very active development, issue tracker intentionally not public...claimed to be ""huge backlog"" of issues. Public git repo. Active history of CVEs raised and fixed. ++"
  bsd-mailx,,8.1.2-0.20111106cvs-1,simple mail user agent,,1,https://security-tracker.debian.org/tracker/source-package/bsd-mailx,https://www.openhub.net/projects/nail,mailx,"Heirloom mailx (previously known as nail) is a mail user agent (MUA) for Unix systems. 
  
  Highlights are:
  
      * Derived from Berkeley Mail 8.1. An interface like the original Berkeley one is still optionally available.
  
      * Is a free implementation of the System V mailx command and features an interface like that by default.",http://heirloom.sourceforge.net/mailx.html,http://sourceforge.net/project/showfiles.php?group_id=106236&package_id=182246,0,1,29957,C,BSD-3-Clause common_development_and_distribution gpl lgpl zlib_libpng ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,145942,C,Program,1,0,0,8,"This does take data from untrusted sources, but many systems won't actively use it (there are many mail clients)."
  dnsutils,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Clients provided with BIND,,32,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,6,46,635185,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,156816,C,Program,1,0,0,8,Bind9 is critical for security. It does have active development. ++
  dpkg,,1.16.15,Debian package management system,http://wiki.debian.org/Teams/Dpkg,9,https://security-tracker.debian.org/tracker/source-package/dpkg,https://www.openhub.net/projects/dpkg,dpkg,Debian's PacKaGe manager,http://wiki.debian.org/Teams/Dpkg/,http://packages.debian.org/src:dpkg,48,203,63613,C,bsd_2clause_ish GNU_General_Public_License_v2_0_only gpl Public_Domain ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169894,C,Program,1,0,0,8,"Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  exim4,,4.80-7+deb7u1,metapackage to ease Exim MTA (v4) installation,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,15,31,112788,C,gpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",121505,C,Dummy Package,1,0,0,8,"This is an MTA, thus has to process untrustworthy data.  Mailing lists, bugzilla tracker, public git repo. Active history of CVE issues and fixes. Active with 16 contributors in last year. ++"
  exim4-base,exim4,4.80-7+deb7u1,support files for all Exim MTA (v4) packages,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,15,31,112788,C,gpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",125159,C,,1,0,0,8,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  exim4-config,exim4,4.80-7+deb7u1,configuration for the Exim MTA (v4),http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,15,31,112788,C,gpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",125426,"sh, bash, ksh, tcsh and other shells",Program,1,0,0,8,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  exim4-daemon-light,exim4,4.80-7+deb7u1,lightweight Exim MTA (v4) daemon,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,15,31,112788,C,gpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",122835,C,,1,0,0,8,"This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  isc-dhcp-client,isc-dhcp,4.2.2.dfsg.1-5+deb70u6,ISC DHCP client,,22,https://security-tracker.debian.org/tracker/source-package/isc-dhcp,https://www.openhub.net/projects/4273,DHCP (ISC),"The Internet Systems Consortium (ISC) offers a Dynamic Host Configuration Protocol (DHCP) distribution including a DHCP server, client and relay agent. This distribution supports POSIX-compliant operating systems and also non-POSIX systems like Windows NT and MacOS.",http://www.isc.org/downloads/dhcp/,http://ftp.isc.org/isc/dhcp/,4,21,126101,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,157880,C,,1,0,0,8,"In wide use, accepts data from external sources.  Includes dhclient. Very similar to BIND. Perhaps slightly less active, lower developer count, but steady commits and releases. Somewhat critical due to being core network functionality. ++"
  less,,444-4,pager program similar to more,http://www.greenwoodsoftware.com/less/,0,https://security-tracker.debian.org/tracker/source-package/less,,,,,,,,,,,,,,,164427,C,Program,0,0,0,8,Less likely to be a security vulnerability :-).
  libbind9-80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,BIND9 Shared Library used by BIND,,32,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,6,46,635185,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,105540,C,Shared Library,1,0,0,8,Bind9 is critical for security. It does have active development. ++
  libdns88,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,DNS Shared Library used by BIND,,32,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,6,46,635185,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,104754,C,Shared Library,1,0,0,8,Bind9 is critical for security. It does have active development. ++
  libgnutls26,gnutls26,2.12.20-8+deb7u2,GNU TLS library - runtime library,http://www.gnutls.org/,17,https://security-tracker.debian.org/tracker/source-package/gnutls26,https://www.openhub.net/projects/gnutls,GnuTLS,"GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. It is aimed to be portable and efficient with focus on security and interoperability.",http://www.gnutls.org,,24,72,190431,C,gpl3_or_later lgpl21_or_later ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",157014,C,Shared Library,1,0,0,8,"TLS implementation.  Less used than OpenSSL, but is in use (it avoids OpenSSL licensing issues). Good ""security activity"" metrics, except suspiciously empty GitLab issue tracker, especially when Debian Security page shows many existing vulnerabilities. They may sweep the public issue tracker so as not to expose what they're trying to fix before it's ready. Notably still supporting SSL 3.0, which has known exploits. There is evidence they do stay on top of things, though. They have responded to questions regarding FREAK in their mailing lists, explaining gnutls is not vulnerable due to how it operates. ++"
  libgpgme11,gpgme1.0,1.2.0-1.4+deb7u1,GPGME - GnuPG Made Easy,,1,https://security-tracker.debian.org/tracker/source-package/gpgme1.0,https://www.openhub.net/projects/gpgme,GPGME,"GnuPG Made Easy (GPGME) is a library designed to make access to GnuPG easier for applications. It provides a High-Level Crypto API for encryption, decryption, signing, signature verification and key management. Currently it uses GnuPG as its backend but the API isn't restricted to this engine; in fact we have already developed a backend for CMS (S/MIME).",http://www.gnupg.org/gpgme.html,http://www.gnupg.org/download/index.html#gpgme,3,14,70855,C,lgpl ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,148645,C,Shared Library,1,0,0,8,"Vital for protecting email (see gpg) Git repo available. Issue tracker site uses self-signed cert; it's concerning that a user would have to compromise the HTTPS security model just to view and interact with the bug tracker. Openhub doesn't reflect their mailing lists in *multiple languages*. Appears to be actively maintained mostly by one dev, but notably just got donations supporting him for the next 2-3 years. ++"
  libgssapi-krb5-2,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - krb5 GSS-API Mechanism,http://web.mit.edu/kerberos/,43,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,26,91,386862,C,mit ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161577,,,1,0,0,8,"Vital when using Kerberos; unclear how common that is today. (For Windows, may use SAMBA)"
  libgssglue1,libgssglue,0.4-2,mechanism-switch gssapi library,http://www.citi.umich.edu/projects/nfsv4/linux/,1,https://security-tracker.debian.org/tracker/source-package/libgssglue,,,,,,,,,,,,,,,132579,,Shared Library,1,0,0,8,Vital for systems that use it; amount of use unclear.
  libkrb5-3,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries,http://web.mit.edu/kerberos/,43,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,26,91,386862,C,mit ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161582,,,1,0,0,8,"Vital when using Kerberos; unclear how common that is today. (For Windows, may use SAMBA)"
  libldap-2.4-2,openldap,2.4.31-1+nmu2,OpenLDAP libraries,http://www.openldap.org/,11,https://security-tracker.debian.org/tracker/source-package/openldap,https://www.openhub.net/projects/openldap,OpenLDAP,"OpenLDAP Software is the premier open source implementation of the Lightweight Directory Access Protocol. It is the most reliable and standards-compliant. Since 2005 it has been the world's fastest; it is the gold standard against which all other directory software is compared.
  
  The suite includes:
  
  * slapd - stand-alone LDAP daemon (server)
  * libraries implementing the LDAP protocol, and
  * utilities, tools, and sample clients.",http://www.openldap.org/,http://www.openldap.org/software/download/,17,99,562412,C,OpenLDAP_Public_License ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",166665,C,Shared Library,1,0,0,8,"Wide use, vitally important. Very active. Public repo, issue tracker, lists, active development, closing CVEs, the works. This is vitally important, but they appear to have things in hand in terms of project activity. ++"
  liblwres80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Lightweight Resolver Library used by BIND,,32,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,6,46,635185,C,isc ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,105345,C,Shared Library,1,0,0,8,Bind9 is critical for security. It does have active development. ++
  libnfnetlink0,libnfnetlink,1.0.0-1.1,Netfilter netlink library,,0,https://security-tracker.debian.org/tracker/source-package/libnfnetlink,https://www.openhub.net/projects/libnfnetlink,libnfnetlink,libnfnetlink is the low-level library for netfilter related kernel/userspace communication.,http://www.netfilter.org/projects/libnfnetlink/index.html,http://www.netfilter.org/projects/libnfnetlink/downloads.html,1,13,2058,C,gpl ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Only a single active developer,160950,,Shared Library,1,0,0,8,"Typically the user is already trusted, and the runtime for netlink is part of the kernel, so vulnerabilities would typically not be here."
  libnfsidmap2,libnfsidmap,0.25-4,NFS idmapping library,http://www.citi.umich.edu/projects/nfsv4/linux/,0,https://security-tracker.debian.org/tracker/source-package/libnfsidmap,,,,,,,,,,,,,,,149187,,Shared Library,1,0,0,8,"Important for NFS, amount of use unclear."
  libpam-modules,pam,1.1.3-7.1,Pluggable Authentication Modules for PAM,http://pam.sourceforge.net/,14,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,8,20,56988,C,BSD-3-Clause gpl gpl3 ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169892,C,Plugin,1,0,0,8,"Critical central role for authentication.  Real site is http://www.linux-pam.org/ (Debian lists as http://pam.sourceforge.net/ but that points to https://fedorahosted.org/linux-pam/ which points to this). It has a somewhat active mailing list, and an active issue tracker where issues are clearly opened and closed. Stable version is somewhat old (2013); recent changes in git though relatively small (https://git.fedorahosted.org/cgit/linux-pam.git/) ++"
  libpam0g,pam,1.1.3-7.1,Pluggable Authentication Modules library,http://pam.sourceforge.net/,14,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,8,20,56988,C,BSD-3-Clause gpl gpl3 ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169889,C,Shared Library,1,0,0,8,Critical central role for authentication; not very active.  Concerning. ++
  libssl1.0.0,openssl,1.0.1e-2+deb7u13,SSL shared libraries,,65,https://security-tracker.debian.org/tracker/source-package/openssl,https://www.openhub.net/projects/openssl,OpenSSL,"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and dev",http://www.openssl.org/,http://www.openssl.org//source/,117,145,447247,C,BSD-3-Clause ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",136119,,,1,0,0,8,"Critical, in wide use.  OpenSSL is already funded by CII. ++"
  libtirpc1,libtirpc,0.2.2-5,transport-independent RPC library,,1,https://security-tracker.debian.org/tracker/source-package/libtirpc,https://www.openhub.net/projects/libtirpc,libtirpc,Libtirpc is a port of Suns Transport-Independent RPC library to Linux. It's being developed by the Bull GNU/Linux NFSv4 project. Note: The SVN Repository on this site is *not* used. Use the git://git.infradead.org/~steved/libtirpc.git GIT tree,http://sourceforge.net/projects/libtirpc,,7,29,17758,C,,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",118553,,Shared Library,1,0,0,8,"RPC library, used by NFS."
  libxau6,libxau,1:1.0.7-1,X11 authorisation library,,0,https://security-tracker.debian.org/tracker/source-package/libxau,https://www.openhub.net/projects/xauthxx,xauthxx,"DescriptionXauth++ provides a C++ interface to Xauthority by wrapping libXau. 
  
  FeaturesXauthority file I/O Automatic generation of MIT Magic Cookies Easy-to-use object-oriented API LicensingAll source files are distributed under the GNU LGPL except the example file, testxauth.cc, which is distributed under the GNU GPL. 
  
  UsageFor example usage, see UsageExamples and testxauth.cc. 
  
  Compile and run with: 
  
  g++ -Wall -pedantic -g -DHAVE_GCRYPT=1 -o testxauth testxauth.cc xauthxx.cc `pkg-config --cflags --libs xau` `libgcrypt-config --cflags --libs` 
  
  Warning: It will create two new files in the working directory: Xauthority-1 and Xauthority-2. 
  
  StatusFunctional but not feature-complete compared to libXau. Feel free to contribute! 
  
  Known ProblemsThe API is not documented, but the example file should be self-explanatory.",http://code.google.com/p/xauthxx,,0,3,528,C++,lgpl ,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,167548,C,Shared Library,1,0,0,8,"X11 authorization.  Important, but X not typically network-exposed today, so expect reduced risk today compared to past."
  linux-image-3.2.0-4-amd64,linux,3.2.63-2+deb7u2,Linux 3.2 for 64-bit PCs,,352,https://security-tracker.debian.org/tracker/source-package/linux,https://www.openhub.net/projects/linux,Linux Kernel,"Linux is a free software kernel, which combined with the GNU libraries, core utils and shell form the GNU/Linux operating system.
  
  !!!PLEASE!!! DO NOT REMOVE git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git enlistment. It contains historical pre-2.6.12 commit data.",http://kernel.org/,,3569,13617,17167091,C,GNU_General_Public_License_v2_0_only ,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",74082,,,1,0,0,8,"Linux kernel. Fundamental to security, but it has extremely active development and many tools/organizations reviewing."
  lsof,,4.86+dfsg-1,Utility to list open files,http://people.freebsd.org/~abe/,0,https://security-tracker.debian.org/tracker/source-package/lsof,https://www.openhub.net/projects/lsof,lsof,"The free, open-source, Unix administrative tool lsof (for LiSt Open Files) displays information about files open to Unix processes.",http://people.freebsd.org/~abe/,http://people.freebsd.org/~abe/,,,,,Distributable ,,,,,159219,C,,0,0,0,8,Unlikely to be a security vulnerability
  mutt,,1.5.21-6.2+deb7u3,"text-based mailreader supporting MIME, GPG, PGP and threading",http://www.mutt.org/,3,https://security-tracker.debian.org/tracker/source-package/mutt,https://www.openhub.net/projects/mutt,mutt,"Mutt is a small but very powerful text-based mail client for Unix operating systems.
  
  Though written from scratch, Mutt's initial interface was based largely on the ELM mail client. To a large extent, Mutt is still very ELM-like in presentation of information in menus (and in fact, ELM users will find it quite painless to switch as the default key bindings are identical). As development progressed, features found in other popular clients such as PINE and MUSH have been added, the result being a hybrid, or ""mutt.""",http://www.mutt.org/,http://www.mutt.org/download.html,10,207,93301,C,gpl ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",148965,C,,1,0,0,8,Rarely used in practice
  net-tools,,1.60-24.2,The NET-3 networking toolkit,http://net-tools.berlios.de/,0,https://security-tracker.debian.org/tracker/source-package/net-tools,https://www.openhub.net/projects/net-tools,net-tools,"A collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Includes: arp, hostname, ifconfig, netstat, rarp, route, plipconfig, slattach, mii-tool, iptunn
  
  Please keep in mind that most net-tools programs are obsolete now. See ethtool and iproute2 instead.",https://sourceforge.net/projects/net-tools/,http://downloads.sourceforge.net/net-tools/,7,24,14688,C,gpl ,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Large, active development team",169690,C,,1,0,0,8,"It's unclear if the Debian package and SourceForge project are still related.  This warrants further examination. Upstream listed as https://developer.berlios.de/projects/net-tools/ but has moved to http://sourceforge.net/projects/net-tools/ Has mailing though rather inactive. Has public git repo, latest commit 2015-01-07 on 2015-03-12. These are tools for controlling the network and typically run as root; it's unclear how exposed they are to network attack (most, if not all, are probably not exposed). This lack of exposure probably lowers their priority. ++"
  nfs-common,nfs-utils,1:1.2.6-4,NFS support files common to client and server,http://nfs.sourceforge.net/,4,https://security-tracker.debian.org/tracker/source-package/nfs-utils,https://www.openhub.net/projects/nfs-utils,nfs-utils,"The Network File System (NFS) was developed to allow machines to mount a disk partition on a remote machine as if it were a local disk. It allows for fast, seamless sharing of files across a network.",http://nfs.sourceforge.net/,http://sourceforge.net/projects/nfs/files/nfs-utils/,36,134,39085,C,gpl ,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",143800,C,,1,0,0,8,"Important for NFS, amount of use unclear."
  openssh-client,openssh,1:6.0p1-4+deb7u2,"secure shell (SSH) client, for secure access to remote machines",http://www.openssh.org/,12,https://security-tracker.debian.org/tracker/source-package/openssh,https://www.openhub.net/projects/openssh,OpenSSH,"OpenSSH is a free SSH/SecSH protocol suite providing encryption for network services like remote login or remote file transfer.
  
  The following is a list of OpenSSH features:
      * Open Source Project
  
negative.code:     * Interoperability (Compliance with SSH 1.3, 1.5, and 2.0 protocol Standards)
      * SFTP client and server support in both SSH1 and SSH2 protocols.
      * Kerberos and AFS Ticket Passing
      * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,23,92,69047,C,BSD-3-Clause,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",134645,C,Program,1,0,0,8,Vital for security. CII already investing in this. ++
  openssl,,1.0.1e-2+deb7u13,Secure Socket Layer (SSL) binary and related cryptographic tools,,87,https://security-tracker.debian.org/tracker/source-package/openssl,https://www.openhub.net/projects/openssl,OpenSSL,"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and dev",http://www.openssl.org/,http://www.openssl.org//source/,107,177,437855,C,OpenSSL_License,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",167275,,,1,0,0,8,"Critical, in wide use.  OpenSSL is already funded by CII. ++"
  procps,,1:3.3.3-3,/proc file system utilities,http://gitorious.org/procps,0,https://security-tracker.debian.org/tracker/source-package/procps,https://www.openhub.net/projects/procps,Procps - The /proc file system utilities,"procps is the package that has a bunch of small useful utilities that give information about processes using the /proc filesystem. The package includes the programs ps, top, vmstat, w, kill, free, slabtop, and skill.
  
  Version 3 includes NPTL thread support, a rewritten top, many bug fixes, performance improvements, and new features.",http://procps.sourceforge.net/,http://procps.sourceforge.net/download.html,0,2,15622,C,lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,169883,C,Program,0,0,0,8,
  reportbug,,6.4.4+deb7u1,reports bugs in the Debian distribution,http://alioth.debian.org/projects/reportbug/,1,https://security-tracker.debian.org/tracker/source-package/reportbug,https://www.openhub.net/projects/reportbug,reportbug,,http://alioth.debian.org/projects/reportbug,,1,23,8566,Python,mit,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Only a single active developer,150122,Python,,1,0,0,8,
  rsyslog,,5.8.11-3+deb7u2,reliable system and kernel logging daemon,http://www.rsyslog.com/,9,https://security-tracker.debian.org/tracker/source-package/rsyslog,https://www.openhub.net/projects/rsyslog,rsyslog,"Rsyslog is an enhanced multi-threaded syslogd supporting, among others, MySQL, syslog/tcp, RFC 3195, permitted sender lists, filtering on any message part, and fine grain output format control. It is quite compatible to stock sysklogd and can be used as a drop-in replacement. Its advanced features make it suitable for enterprise-class, encryption protected syslog relay chains while at the same time being very easy to setup for the novice user. 
  
  Over time, rsyslog has become the default syslogd for the many distributions.",http://www.rsyslog.com/,http://www.rsyslog.com/Downloads-index-req-viewdownload-cid-1-orderby-dateD.phtml,52,160,196201,C,gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",161535,C,,1,0,0,8,"Processes data from untrusted users.  Important today; as systemd becomes more used, its use may lessen but still important for merging data sources. Project page http://www.rsyslog.com/ Official repo on GitHub, https://github.com/rsyslog This is an active multi-person project; in the one-month period February 12, 2015     March 12, 2015, excluding merges, 7 authors have pushed 27 commits to master and 40 commits to all branches. On master, 37 files have changed and there have been 677 additions and 216 deletions. ++"
  sysvinit,,2.88dsf-41+deb7u1,System-V-like init utilities,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/sysvinit,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,159762,,,0,0,0,8,
  sysvinit-utils,sysvinit,2.88dsf-41+deb7u1,System-V-like utilities,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/sysvinit,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,169791,C,,0,0,0,8,
  tcpd,tcp-wrappers,7.6.q-24,Wietse Venema's TCP wrapper utilities,,0,https://security-tracker.debian.org/tracker/source-package/tcp-wrappers,,,,,,,,,,,,,,,160357,C,Program,1,0,0,8,Exposed to the network (wraps incoming requests). Has some security-relevant functions. Relatively small.
  time,,1.7-24,GNU time program for measuring CPU resource usage,http://www.gnu.org/software/time,0,https://security-tracker.debian.org/tracker/source-package/time,https://www.openhub.net/projects/time,OpenTimeCE,An implementation of the full set of time_t functions in time.h from the C Standard Library for Windows CE.,http://time.codeplex.com,,0,3,1637,XAML,mit,Stable Y-O-Y development activity,"Young, but established codebase",Very few source code comments,No recent development activity,150543,C,,0,0,0,8,
  vim-tiny,vim,2:7.3.547-7,Vi IMproved - enhanced vi editor - compact version,http://www.vim.org/,1,https://security-tracker.debian.org/tracker/source-package/vim,https://www.openhub.net/projects/vim,Vim,"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. It's useful whether you're already using vi or using a different editor.",http://www.vim.org/,http://www.vim.org/download.php,1,12,844733,C,Vim_License,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,163921,C,,0,0,0,8,
  whois,,5.1.1~deb7u1,intelligent WHOIS client,,0,https://security-tracker.debian.org/tracker/source-package/whois,,,,,,,,,,,,,,,156467,C,Program,1,0,0,8,Less commonly used.
  apache2,,2.2.22-13+deb7u3,Apache HTTP Server metapackage,http://httpd.apache.org/,47,https://security-tracker.debian.org/tracker/source-package/apache2,https://www.openhub.net/projects/apache,Apache HTTP Server,"The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.",http://httpd.apache.org/,http://httpd.apache.org/download.cgi,30,117,1760653,C,apache_2,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",61161,C,Metapackage,1,0,0,8,"Vitally important.  Note, however, that there's already large development & review team in place."
  apache2-utils,apache2,2.2.22-13+deb7u3,utility programs for webservers,http://httpd.apache.org/,47,https://security-tracker.debian.org/tracker/source-package/apache2,https://www.openhub.net/projects/apache,Apache HTTP Server,"The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich, and freely-available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.",http://httpd.apache.org/,http://httpd.apache.org/download.cgi,30,117,1760653,C,apache_2,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",73507,C,Program,1,0,0,8,"Vitally important.  Note, however, that there's already large development & review team in place."
  lzma,,9.22-2,Compression and decompression in the LZMA format - command line utility,http://www.7-zip.org/sdk.html,0,https://security-tracker.debian.org/tracker/source-package/lzma,https://www.openhub.net/projects/lzmautils,LZMA Utils,gzip- and zlib-like interfaces for LZMA compression from 7-Zip,http://sourceforge.net/projects/lzmautils,,0,2,9659,C++,,,,,,20594,C,,0,1,0,8,
  ntp,,1:4.2.6.p5+dfsg-2,Network Time Protocol daemon and utility programs,http://support.ntp.org/,11,https://security-tracker.debian.org/tracker/source-package/ntp,,,,,,,,,,,,,,,62345,,,1,0,0,8,"Directly connects to network and open to attack. HAS Home Page, NO issue tracker, Has Mailing list, public repo. CII investing. ++"
  curl,,7.26.0-1+wheezy11,command line tool for transferring data with URL syntax,http://curl.haxx.se,27,https://security-tracker.debian.org/tracker/source-package/curl,https://www.openhub.net/projects/curl,cURL,"curl is a command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, Gopher, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMB, SMTP, SMTPS, Telnet and TFTP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, HTTP/2, cookies, user+password authentication (Basic, Plain, Digest, CRAM-MD5, NTLM, Negotiate and Kerberos), file transfer resume, proxy tunneling and more.",http://curl.haxx.se/,http://curl.haxx.se/download.html,100,345,216504,C,mit,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",60976,,,1,0,0,8,Telnet is a fundamentally insecure protocol and is being phased out.
  samba,,2:3.6.6-6+deb7u4,"SMB/CIFS file, print, and login server for Unix",http://www.samba.org,36,https://security-tracker.debian.org/tracker/source-package/samba,https://www.openhub.net/projects/samba,Samba,"Samba is an Open Source/Free Software suite that provides file and print services to all manner of SMB/CIFS clients, including the numerous versions of Microsoft Windows operating systems.",http://www.samba.org,http://samba.org/samba/download/,83,357,1601907,C,gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",42039,,,1,0,0,8,
  apt,,0.9.7.9+deb7u6,commandline package manager,,15,https://security-tracker.debian.org/tracker/source-package/apt,https://www.openhub.net/projects/apt,apt - Advanced Package Tool,"Debian's next generation front-end for the dpkg package manager. It provides the apt-get utility and APT dselect method that provides a simpler, safer way to install and upgrade packages.
  
  APT features complete installation ordering, multiple source capability
  and several other unique features.",https://wiki.debian.org/Apt,http://packages.qa.debian.org/a/apt.html,30,120,71636,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169881,,,0,1,0,7,"Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  apt-utils,apt,0.9.7.9+deb7u6,package managment related utility programs,,15,https://security-tracker.debian.org/tracker/source-package/apt,https://www.openhub.net/projects/apt,apt - Advanced Package Tool,"Debian's next generation front-end for the dpkg package manager. It provides the apt-get utility and APT dselect method that provides a simpler, safer way to install and upgrade packages.
  
  APT features complete installation ordering, multiple source capability
  and several other unique features.",https://wiki.debian.org/Apt,http://packages.qa.debian.org/a/apt.html,30,120,71636,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169440,C++,,0,1,0,7,"Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  aptitude,,0.6.8.2-1,terminal-based package manager,http://aptitude.alioth.debian.org/,0,https://security-tracker.debian.org/tracker/source-package/aptitude,https://www.openhub.net/projects/aptitude,Aptitude,"Aptitude's goal is to be a highly configurable console frontend for the Debian Advanced Package Tool, based heavily on hierarchical display of information about packages.",http://aptitude.alioth.debian.org/,http://packages.qa.debian.org/a/aptitude.html,2,38,139612,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168326,,,0,0,0,7,
  aptitude-common,aptitude,0.6.8.2-1,architecture indepedent files for the aptitude package manager,http://aptitude.alioth.debian.org/,0,https://security-tracker.debian.org/tracker/source-package/aptitude,https://www.openhub.net/projects/aptitude,Aptitude,"Aptitude's goal is to be a highly configurable console frontend for the Debian Advanced Package Tool, based heavily on hierarchical display of information about packages.",http://aptitude.alioth.debian.org/,http://packages.qa.debian.org/a/aptitude.html,2,38,139612,C++,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,133879,,,0,0,0,7,
  at,,3.1.13-2+deb7u1,Delayed job execution and batch processing,,0,https://security-tracker.debian.org/tracker/source-package/at,https://www.openhub.net/projects/at,,,,,,,,,,,,,,151086,C,,0,0,1,7,Could potentially enable local privilege escalation.
  binutils,,2.22-8,"GNU assembler, linker and binary utilities",,9,https://security-tracker.debian.org/tracker/source-package/binutils,https://www.openhub.net/projects/binutils,GNU binutils,"The GNU linker and related programs and libraries: ar, as, gprof, ld, nm, ranlib, strip, libbfd.  You depend on this utterly.",http://www.gnu.org/software/binutils/,http://ftp.gnu.org/gnu/binutils/,173,569,4635179,C,gpl3,Increasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,"Very large, active development team",128690,,,0,0,1,7,"Vital software for a running system.  Active maintenance.  Includes many subcomponents; some components might need review, but hard to tell because they're managed as a group."
  coreutils,,8.13-3.5,GNU core utilities,http://gnu.org/software/coreutils,7,https://security-tracker.debian.org/tracker/source-package/coreutils,https://www.openhub.net/projects/coreutils,GNU Core Utilities,"The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU Operating System.
  
  Specifically, this package includes:
   arch base64 basename cat chcon chgrp chmod chown chroot cksum comm cp
  