anchor.diff:  
   One of the main sources used by SCOWL is Alan Beale 12Dicts package.
   
  -One of the main artifacts created was the VarCon (Variant Conversion) database, that can be used to convert between American, British and Canadian dictionaries.",http://wordlist.aspell.net,,5,6,8111,Perl,BSD-3-Clause mit,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Average size development team,155222,,Application Data,0,0,0,0,
  -xfonts-base,,1:1.0.3,standard fonts for X,,0,https://security-tracker.debian.org/tracker/source-package/xfonts-base,https://www.openhub.net/projects/xfonts,Linux Font Project,Developing console fonts and fixed- and variable-width fonts for X (and porting some of them to Windows). The purpose is to make new fonts to enrich the very poor selection of fonts available in both console and X and improve the existing ones.,http://sourceforge.net/projects/xfonts/,,,,,,,,,,,101661,,Application Data,0,0,0,0,
  -xfonts-encodings,,1:1.0.4-1,Encodings for X.Org fonts,,0,https://security-tracker.debian.org/tracker/source-package/xfonts-encodings,https://www.openhub.net/projects/xfonts,Linux Font Project,Developing console fonts and fixed- and variable-width fonts for X (and porting some of them to Windows). The purpose is to make new fonts to enrich the very poor selection of fonts available in both console and X and improve the existing ones.,http://sourceforge.net/projects/xfonts/,,,,,,,,,,,116688,,Application Data,0,0,0,0,
  +One of the main artifacts created was the VarCon (Variant Conversion) database, that can be used to convert between American, British and Canadian dictionaries.",http://wordlist.aspell.net,,5,6,8111,Perl,BSD-3-Clause mit,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,Average size development team,155222,,Application Data,0,0,0,0,"Website points: 0, CVE: 0, 12-month contributor: 0, Popularity: 1, Language: 0, Exposure: 0 , Data only: -3",
  +xfonts-base,,1:1.0.3,standard fonts for X,,0,https://security-tracker.debian.org/tracker/source-package/xfonts-base,https://www.openhub.net/projects/xfonts,Linux Font Project,Developing console fonts and fixed- and variable-width fonts for X (and porting some of them to Windows). The purpose is to make new fonts to enrich the very poor selection of fonts available in both console and X and improve the existing ones.,http://sourceforge.net/projects/xfonts/,,,,,,,,,,,101661,,Application Data,0,0,0,0,"Website points: 0, CVE: 0, 12-month contributor: 2, Popularity: 1, Language: 0, Exposure: 0 , Data only: -3",
  +xfonts-encodings,,1:1.0.4-1,Encodings for X.Org fonts,,0,https://security-tracker.debian.org/tracker/source-package/xfonts-encodings,https://www.openhub.net/projects/xfonts,Linux Font Project,Developing console fonts and fixed- and variable-width fonts for X (and porting some of them to Windows). The purpose is to make new fonts to enrich the very poor selection of fonts available in both console and X and improve the existing ones.,http://sourceforge.net/projects/xfonts/,,,,,,,,,,,116688,,Application Data,0,0,0,0,"Website points: 0, CVE: 0, 12-month contributor: 2, Popularity: 1, Language: 0, Exposure: 0 , Data only: -3",
   task-web-server,tasksel,3.14.1,Web server,,0,https://security-tracker.debian.org/tracker/source-package/tasksel,https://www.openhub.net/projects/tasksel,tasksel,"Tool for selecting tasks for installation on Debian system.
   
  -tasksel is a simple interface for users who want to pick general tasks for installation on their Debian GNU/Linux system. This program is used during the installation process, but users can also use tasksel at any point.",https://launchpad.net/tasksel,,9,134,2064,Perl,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",14292,,Program,0,0,0,0,
  +tasksel is a simple interface for users who want to pick general tasks for installation on their Debian GNU/Linux system. This program is used during the installation process, but users can also use tasksel at any point.",https://launchpad.net/tasksel,,9,134,2064,Perl,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",14292,,Program,0,0,0,0,"Website points: 0, CVE: 0, 12-month contributor: 0, Popularity: 0, Language: 0, Exposure: 0 , Data only: 0",
  
positive.code:     * Interoperability (Compliance with SSH 1.3, 1.5, and 2.0 protocol Standards)
      * SFTP client and server support in both SSH1 and SSH2 protocols.
      * Kerberos and AFS Ticket Passing
      * Data Compression",http://www.openssh.com/,http://www.openssh.com/portable.html,23,92,69047,C,BSD-3-Clause,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",132473,,Application Data,0,0,0,0,
  tasksel-data,tasksel,3.14.1,Official tasks used for installation of Debian systems,,0,https://security-tracker.debian.org/tracker/source-package/tasksel,https://www.openhub.net/projects/tasksel,tasksel,"Tool for selecting tasks for installation on Debian system.
  
  tasksel is a simple interface for users who want to pick general tasks for installation on their Debian GNU/Linux system. This program is used during the installation process, but users can also use tasksel at any point.",https://launchpad.net/tasksel,,9,134,2064,Perl,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",164602,,Application Data,0,0,0,0,
  tzdata,,2014h-0wheezy1,time zone and daylight-saving time data,http://www.iana.org/time-zones,0,https://security-tracker.debian.org/tracker/source-package/tzdata,,,,,,,,,,,,,,,169781,,Application Data,0,0,0,0,
  wamerican,scowl,7.1-1,American English dictionary words for /usr/share/dict,http://wordlist.sourceforge.net/,0,https://security-tracker.debian.org/tracker/source-package/scowl,https://www.openhub.net/projects/scowl,SCOWL (and friends),"SCOWL (Spell Checker Oriented Word Lists) is a database of English words that can be used to create word lists suitable for use in spell checkers of various sizes and dialects (America, British (both -ise and -ize) and Canadian). However, I am sure it will have numerous other uses as well.
  
  The main product of SCOWL are spell checker dictionaries for Hunspell and Aspell.
  
negative.code: 
  StatusFunctional but not feature-complete compared to libXau. Feel free to contribute! 
  
  Known ProblemsThe API is not documented, but the example file should be self-explanatory.",http://code.google.com/p/xauthxx,,0,3,528,C++,lgpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,167548,C,Shared Library,1,0,0,10,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","X11 authorization.  Important, but X not typically network-exposed today, so expect reduced risk today compared to past."
  linux-headers-3.2.0-4-amd64,linux,3.2.63-2+deb7u2,Header files for Linux 3.2.0-4-amd64,,403,https://security-tracker.debian.org/tracker/source-package/linux,https://www.openhub.net/projects/libc-headers,linux-libc-kernel-headers,This project has not yet submitted a short description. You can submit it now.,http://savannah.nongnu.org/projects/libc-headers/,,0,5,71260,C,gpl,Stable Y-O-Y development activity,Short source control history,Well-commented source code,No recent development activity,27190,,,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 0, Language: 2, Exposure: 0 , Data only: 0",
  patch,,2.6.1-3,Apply a diff file to an original,,5,https://security-tracker.debian.org/tracker/source-package/patch,https://www.openhub.net/projects/diffutils,GNU Diff Utilities,"The GNU diffutils are comprised of diff, diff3, sdiff, and cmp, utilities for showing differences between files. The manual also documents patch, which uses diff output to update files.",http://savannah.gnu.org/projects/diffutils,http://ftp.gnu.org/gnu/diffutils/,3,17,9727,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,161731,C,,0,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  virtualbox-guest-dkms,virtualbox,4.1.18-dfsg-2+deb7u3,x86 virtualization solution - guest addition module source for dkms,http://www.virtualbox.org/,27,https://security-tracker.debian.org/tracker/source-package/virtualbox,https://www.openhub.net/projects/virtualbox,Oracle VM VirtualBox,"Oracle VM VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. VirtualBox is an extremely feature rich, high performance product for enterprise customers.
  
  VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,8367,,,0,0,1,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 0, Language: 2, Exposure: 1 , Data only: 0",
  virtualbox-guest-utils,virtualbox,4.1.18-dfsg-2+deb7u3,x86 virtualization solution - non-X11 guest utilities,http://www.virtualbox.org/,27,https://security-tracker.debian.org/tracker/source-package/virtualbox,https://www.openhub.net/projects/virtualbox,Oracle VM VirtualBox,"Oracle VM VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. VirtualBox is an extremely feature rich, high performance product for enterprise customers.
  
  VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,8661,,,0,0,1,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 0, Language: 2, Exposure: 1 , Data only: 0",
  virtualbox-guest-x11,virtualbox,4.1.18-dfsg-2+deb7u3,x86 virtualization solution - X11 guest utilities,http://www.virtualbox.org/,27,https://security-tracker.debian.org/tracker/source-package/virtualbox,https://www.openhub.net/projects/virtualbox,Oracle VM VirtualBox,"Oracle VM VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. VirtualBox is an extremely feature rich, high performance product for enterprise customers.
  
  VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,8240,,,0,0,1,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 0, Language: 2, Exposure: 1 , Data only: 0",
  virtualbox-ose-guest-x11,virtualbox,4.1.18-dfsg-2+deb7u3,transitional package for virtualbox-guest-x11,http://www.virtualbox.org/,27,https://security-tracker.debian.org/tracker/source-package/virtualbox,https://www.openhub.net/projects/virtualbox,Oracle VM VirtualBox,"Oracle VM VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. VirtualBox is an extremely feature rich, high performance product for enterprise customers.
  
  VirtualBox runs on Windows, Linux, Mac OS X and Solaris hosts in both 32-bit and 64-bit modes. It supports a large number of guest operating systems including but not limited to Solaris, Windows, Linux, and OpenBSD.",http://www.virtualbox.org,http://www.virtualbox.org/wiki/Downloads,2,7,5770304,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,6823,,,0,0,1,10,"Website points: 0, CVE: 3, 12-month contributor: 4, Popularity: 0, Language: 2, Exposure: 1 , Data only: 0",
  bouncycastle,,,,,4,https://security-tracker.debian.org/tracker/source-package/bouncycastle,https://www.openhub.net/projects/5523,Bouncy Castle,"Here at the Bouncy Castle, we believe in encryption. That's something that's near and dear to our hearts. We believe so strongly in encryption, that we've gone to the effort to provide some for everybody.",http://www.bouncycastle.org,,0,1,468546,Java,BSD-3-Clause,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,No recent development activity,0,,,1,0,0,10,"Website points: 0, CVE: 3, 12-month contributor: 5, Popularity: 0, Language: 0, Exposure: 2 , Data only: 0",
  libapache2-mod-gnutls,mod-gnutls,0.5.10-1.1,Apache module for SSL and TLS encryption with GnuTLS,http://www.outoforder.cc/projects/apache/mod_gnutls/,1,https://security-tracker.debian.org/tracker/source-package/mod-gnutls,https://www.openhub.net/projects/mod_gnutls,mod_gnutls,"mod_gnutls uses the GnuTLS library to provide SSL 3.0, TLS 1.0 and TLS 1.1 and TLS 1.2 encryption for Apache HTTPD. It is similar to mod_ssl in purpose, but does not use OpenSSL.",http://www.outoforder.cc/projects/apache/mod_gnutls/,http://www.outoforder.cc/projects/apache/mod_gnutls/,0,5,4020,C,apache_2,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,666,,,1,0,0,10,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 0, Language: 2, Exposure: 2 , Data only: 0","This is in widespread use for SSL/TLS on webservers; it uses GnuTLS instead of OpenSSL.  Old website http://www.outoforder.cc/projects/apache/mod_gnutls/ points to newer site ""https://mod.gnutls.org/?outoforder-ref"".  At newer site the mailing list has a few relevant postings/month, though the March 2015 postings raise concerns about dropped patches.  The bug tracker is badly spammed and one seems to be fixing/addressing it.  Last release 17-Feb-2014.  This looks like it badly needs help. +++"
  postfix,,2.9.6-2,High-performance mail transport agent,http://www.postfix.org,3,https://security-tracker.debian.org/tracker/source-package/postfix,https://www.openhub.net/projects/postfix,Postfix,"Postfix is Wietse Venema's mailer that started life as an alternative to the widely-used Sendmail program. Postfix attempts to be fast, easy to administer, and secure, while at the same time being sendmail compatible enough to not upset existing users. Thus, the outside has a sendmail-ish flavor, but the inside is completely different.",http://www.postfix.org/,http://www.postfix.org/download.html,2,3,217169,C,ibm_public,Stable Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Small development team,28872,C,Program,1,0,0,10,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 0, Language: 2, Exposure: 2 , Data only: 0","This is a widely-used mail transfer agent (MTA).
  Postfix was created by Wietse Venema, main site www.postfix.org.  On February 8, 2015 Postfix released 3.0.0, so currently active.  Developer mailing list postfix-devel has activity. (e.g., http://news.gmane.org/gmane.mail.postfix.devel/cutoff=2948).  There is no public repo; Wietse (the lead developer) does not want to allow any external review before formal release, as noted in https://groups.google.com/forum/#!topic/mailing.postfix.users/6Kkel3J_nv4 (The Debian package may be an obsolete fork; the Debian package has been assembled by LaMont Jones from sources available from http://www.postfix.org, and can be cloned from git via: git clone git://git.debian.org/~lamont/postfix.git.  Changes on http://anonscm.debian.org/cgit/users/lamont/postfix.git/log/ in git stop in 2011.) ++"
  acpi,,1.6-1,displays information on ACPI devices,http://sourceforge.net/projects/acpiclient,0,https://security-tracker.debian.org/tracker/source-package/acpi,https://www.openhub.net/projects/acpi,ACPI,"Linux ACPI client is a command-line tool, similar to the ""apm"" command, that provides information on battery status, AC power, and thermal readings.",http://grahame.angrygoats.net/acpi.shtml,,0,3,14813,C,,Stable Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,147993,,Program,0,0,1,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Provides data on local hardware. Conceivably might allow local raise in privilege.
  cron,,3.0pl1-124,process scheduling daemon,http://ftp.isc.org/isc/cron/,3,https://security-tracker.debian.org/tracker/source-package/cron,https://www.openhub.net/projects/pkg-cron,pkg-cron,This is the Debian GNU/Linux prepackaged and heavily modified version of Paul Vixie's cron subsystem.,https://alioth.debian.org/projects/pkg-cron/,,2,6,5367,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,169633,C,,0,0,0,9,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  dmsetup,lvm2 (2.02.95-8),2:1.02.74-8,Linux Kernel Device Mapper userspace library,http://sources.redhat.com/lvm2/,1,https://security-tracker.debian.org/tracker/source-package/lvm2,https://www.openhub.net/projects/device-mapper,Device Mapper,"The userspace portion of device mapper, a generic framework to map one block device into another with sector granularity. Device mapper forms the foundation of LVM2 and EVMS, software RAIDs, dm-crypt disk encryption, and offers additional features such as file-system snapshots.",http://sources.redhat.com/dm,http://sources.redhat.com/dm,0,15,34138,C,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,161528,C,,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  gzip,,1.5-1.1,GNU compression utilities,,1,https://security-tracker.debian.org/tracker/source-package/gzip,https://www.openhub.net/projects/gzip,gzip,gzip (GNU zip) is a compression utility designed to be a replacement for compress. Its main advantages over compress are much better compression and freedom from patented algorithms. It has been adopted by the GNU project and is now relatively popular on the Internet.,http://www.gnu.org/software/gzip/,,2,15,8631,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,Small development team,169892,C,,0,1,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. http://www.gnu.org/software/gzip/ Maintained on Savannah (http://savannah.gnu.org/projects/gzip/) using git. Last formal release was years ago (June 2013).  Multiple contributors, but not many. Current git contributions, but only a few a month (2015-02-08, 2015-01-02, 2014-11-10, 2014-10-10), and most seem to be small/trivial (document and syntax tweaks). +++"
  iproute,iproute (20120521-3),20120521-3+b3,networking and traffic control tools,http://www.linux-foundation.org/en/Net:Iproute2,1,https://security-tracker.debian.org/tracker/source-package/iproute,https://www.openhub.net/projects/iproute-mptcp,iproute-mptcp,IP-Route extensions for MultiPath TCP,https://github.com/multipath-tcp/iproute-mptcp,https://github.com/multipath-tcp/iproute-mptcp/downloads,0,192,52045,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,163524,C,Program,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  iputils-ping,iputils (3:20101006-1),3:20101006-1+b1,Tools to test the reachability of network hosts,,1,https://security-tracker.debian.org/tracker/source-package/iputils,https://www.openhub.net/projects/iputils,iputils,http://www.skbuff.net/iputils/,https://github.com/boocz3ch/iputils,https://github.com/boocz3ch/iputils/downloads,0,13,18123,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,No recent development activity,169397,C,Program,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  klibc-utils,klibc,2.0.1-3.1,small utilities built with klibc for early boot,http://git.kernel.org/?p=libs/klibc/klibc.git;a=summary,2,https://security-tracker.debian.org/tracker/source-package/klibc,https://www.openhub.net/projects/klibc,klibc,"klibc is intended to be a minimalistic libc subset for use with initramfs.  It is deliberately written for small size, minimal entanglement, and portability, not speed.  It is definitely a work in progress, and a lot of things are still missing.",http://en.wikipedia.org/wiki/Klibc,http://www.kernel.org/pub/linux/libs/klibc/,2,95,53134,C,BSD-3-Clause gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168471,C,Program,0,0,0,9,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libdevmapper1.02.1,lvm2 (2.02.95-8),2:1.02.74-8,Linux Kernel Device Mapper userspace library,http://sources.redhat.com/lvm2/,1,https://security-tracker.debian.org/tracker/source-package/lvm2,https://www.openhub.net/projects/lvm2,lvm2,,,,0,18,57726,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,167105,C,Shared Library,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libgeoip1,geoip,1.4.8+dfsg-3,non-DNS IP-to-country resolver library,http://www.maxmind.com/,0,https://security-tracker.debian.org/tracker/source-package/geoip,https://www.openhub.net/projects/geoip,MaxMind GeoIP,"MaxMind GeoIP is a set of APIs for looking up the location of an IP address, including the country, region, city, latitude, and longitude. Free GeoLite databases are available at http://www.maxmind.com/app/geolitecity",http://sourceforge.net/projects/geoip,,0,2,83883,C,,Stable Y-O-Y development activity,"Mature, well-established codebase",Very few source code comments,No recent development activity,156657,C,Shared Library,0,1,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Should not be security-relevant.
  libgmp10,gmp,2:5.0.5+dfsg-2,Multiprecision arithmetic library,http://gmplib.org/,0,https://security-tracker.debian.org/tracker/source-package/gmp,https://www.openhub.net/projects/gmp,GMP,"GMP is a free library for arbitrary precision arithmetic, operating on signed integers, rational numbers, and floating point numbers. There is no practical limit to the precision except the ones implied by the available memory in the machine GMP runs on. GMP has a rich set of functions, and the functions have a regular interface.",http://gmplib.org/,http://ftp.sunet.se/pub/gnu/gmp/,0,17,209398,C,lgpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,122633,C,Shared Library,0,1,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Multi-precision can be security-relevant if used to process crypto data.
  libidn11,libidn,1.25-2,"GNU Libidn library, implementation of IETF IDN specifications",https://www.gnu.org/software/libidn/,1,https://security-tracker.debian.org/tracker/source-package/libidn,https://www.openhub.net/projects/libidn,LibIDN,"GNU Libidn is an implementation of the Stringprep, Punycode and IDNA specifications defined by the IETF Internationalized Domain Names (IDN) working group, used for internationalized domain names. The C library is available under the GNU Lesser General Public License.
  
  The library contains a generic Stringprep implementation that does Unicode 3.2 NFKC normalization, mapping and prohibitation of characters, and bidirectional character handling. Profiles for iSCSI, Kerberos 5, Nameprep, SASL and XMPP are included. Punycode and ASCII Compatible Encoding (ACE) via IDNA are supported.",http://www.gnu.org/software/libidn/,,2,5,103506,C,gpl lgpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168599,C,Shared Library,0,1,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Libidn's purpose is to encode and decode internationalized domain names; this data may come straight from attackers (e.g., in web page links, etc.)."
  libklibc,klibc,2.0.1-3.1,minimal libc subset for use with initramfs,http://git.kernel.org/?p=libs/klibc/klibc.git;a=summary,2,https://security-tracker.debian.org/tracker/source-package/klibc,https://www.openhub.net/projects/klibc,klibc,"klibc is intended to be a minimalistic libc subset for use with initramfs.  It is deliberately written for small size, minimal entanglement, and portability, not speed.  It is definitely a work in progress, and a lot of things are still missing.",http://en.wikipedia.org/wiki/Klibc,http://www.kernel.org/pub/linux/libs/klibc/,2,95,53134,C,BSD-3-Clause gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,168489,,Shared Library,0,0,0,9,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libnfnetlink0,libnfnetlink,1.0.0-1.1,Netfilter netlink library,,0,https://security-tracker.debian.org/tracker/source-package/libnfnetlink,https://www.openhub.net/projects/libnfnetlink,libnfnetlink,libnfnetlink is the low-level library for netfilter related kernel/userspace communication.,http://www.netfilter.org/projects/libnfnetlink/index.html,http://www.netfilter.org/projects/libnfnetlink/downloads.html,2,14,2030,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Very well-commented source code,Small development team,160950,,Shared Library,1,0,0,9,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Typically the user is already trusted, and the runtime for netlink is part of the kernel, so vulnerabilities would typically not be here."
  libsasl2-2,cyrus-sasl2,2.1.25.dfsg1-6+deb7u1,Cyrus SASL - authentication abstraction library,http://www.cyrusimap.org/,1,https://security-tracker.debian.org/tracker/source-package/cyrus-sasl2,https://www.openhub.net/projects/12134,Cyrus SASL,"SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. If its use is negotiated, a security layer is inserted between the protocol and the connection.
  
  Cyrus SASL is the reference implementation of SASL.",http://asg.web.cmu.edu/sasl/,http://ftp.andrew.cmu.edu/pub/cyrus-mail/,1,20,72049,C,Carnegie_Mellon_Licence,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,168686,C,Shared Library,0,1,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++"
  libsasl2-modules,cyrus-sasl2,2.1.25.dfsg1-6+deb7u1,Cyrus SASL - pluggable authentication modules,http://www.cyrusimap.org/,1,https://security-tracker.debian.org/tracker/source-package/cyrus-sasl2,https://www.openhub.net/projects/12134,Cyrus SASL,"SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. If its use is negotiated, a security layer is inserted between the protocol and the connection.
  
  Cyrus SASL is the reference implementation of SASL.",http://asg.web.cmu.edu/sasl/,http://ftp.andrew.cmu.edu/pub/cyrus-mail/,1,20,72049,C,Carnegie_Mellon_Licence,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Only a single active developer,157085,C,Plugin,0,1,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Authentication library. Has Home Page, HAS bug tracker https://bugzilla.cyrusimap.org/index.cgi, fairly active ML http://asg.andrew.cmu.edu/archive/index.php?mailbox=archive.cyrus-sasl ++"
  libudev0,udev,175-7.2,libudev shared library,,1,https://security-tracker.debian.org/tracker/source-package/udev,https://www.openhub.net/projects/udev,udev,Managing device nodes in /dev on Linux.,http://www.freedesktop.org/software/systemd/man/udev.html,http://www.kernel.org/pub/linux/utils/kernel/hotplug/,0,224,23505,C,gpl lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,144230,C,Shared Library,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libxcb1,libxcb,1.8.1-2+deb7u1,X C Binding,http://xcb.freedesktop.org,1,https://security-tracker.debian.org/tracker/source-package/libxcb,https://www.openhub.net/projects/libxcb,libxcb,,https://github.com/StarchLinux/libxcb,https://github.com/StarchLinux/libxcb/downloads,0,1,87401,C,,,Short source control history,Very well-commented source code,No recent development activity,166104,C,Shared Library,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  nano,nano (2.2.6-1),2.2.6-1+b1,"small, friendly text editor inspired by Pico",http://www.nano-editor.org/,2,https://security-tracker.debian.org/tracker/source-package/nano,https://www.openhub.net/projects/nano,GNU nano,"GNU nano is designed to be a free replacement for the Pico text editor, part of the Pine email suite from The University of Washington. It aims to ""emulate Pico as closely as possible and perhaps include extra functionality"".",http://www.nano-editor.org/,,3,10,20032,C,gpl3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,164806,C,Program,0,0,0,9,"Website points: 0, CVE: 2, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  tar,,1.26+dfsg-0.1,GNU version of the tar archiving utility,,1,https://security-tracker.debian.org/tracker/source-package/tar,https://www.openhub.net/projects/tar,GNU tar,"The Tar program provides the ability to create tar archives, as well as various other kinds of manipulation.",http://savannah.gnu.org/projects/tar/,,3,21,23495,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Small development team,169899,,,0,1,0,9,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. Has Home page, mailing list, Public Repo git://git.savannah.gnu.org/tar.git, uses ""technical support"" for issue tracking (could be confusing).  Does have changes in git repo, but only a few a month and typically small. ++"
  udev,,175-7.2,/dev/ and hotplug management daemon,,1,https://security-tracker.debian.org/tracker/source-package/udev,https://www.openhub.net/projects/udev,udev,Managing device nodes in /dev on Linux.,http://www.freedesktop.org/software/systemd/man/udev.html,http://www.kernel.org/pub/linux/utils/kernel/hotplug/,0,224,23505,C,gpl lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,169330,C,Program,0,0,0,9,"Website points: 0, CVE: 1, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  zlib1g,zlib,1:1.2.7.dfsg-13,compression library - runtime,http://zlib.net/,0,https://security-tracker.debian.org/tracker/source-package/zlib,https://www.openhub.net/projects/zlib,zlib,"zlib is designed to be a free, general-purpose, legally unencumbered -- that is, not covered by any patents -- lossless data-compression library for use on virtually any computer hardware and operating system. The zlib data format is itself portable across platforms. Unlike the LZW compression method used in Unix compress(1) and in the GIF image format, the compression method currently used in zlib essentially never expands the data. (LZW can double or triple the file size in extreme cases.) zlib's memory footprint is also independent of the input data and can be reduced, if necessary, at some cost in compression.",http://www.zlib.net/,http://www.zlib.net/,0,20,36295,C,zlib_libpng,Stable Y-O-Y development activity,"Young, but established codebase",Well-commented source code,No recent development activity,169896,C,Shared Library,0,1,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Widely-used compression/decompression.  Vital, a vulnerability here could be very serious. HAS Home Page, has mailing list zlib@gzip.org, NO issue tracker, Latest release April 2013 (old). +++"
  zip,,3.0-6,Archiver for .zip files,http://www.info-zip.org/Zip.html,0,https://security-tracker.debian.org/tracker/source-package/zip,https://www.openhub.net/projects/infozip,Zip & Unzip,,http://www.info-zip.org/,,0,2,878,C,BSD-3-Clause,Stable Y-O-Y development activity,"Young, but established codebase",Average number of code comments,No recent development activity,61799,C,,0,1,0,9,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",
  bind9-host,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Version of 'host' bundled with BIND 9.X,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161011,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Bind9 is critical for security. It does have active development. Support is via mailing lists. Very active development, issue tracker intentionally not public...claimed to be ""huge backlog"" of issues. Public git repo. Active history of CVEs raised and fixed. ++"
  bzip2,,1.0.6-4,high-quality block-sorting file compressor - utilities,http://www.bzip.org/,2,https://security-tracker.debian.org/tracker/source-package/bzip2,https://www.openhub.net/projects/bzip2,bzip2,"bzip2 is a freely available, patent free, high-quality data compressor. It typically compresses files to within 10% to 15% of the best available techniques (the PPM family of statistical compressors), whilst being around twice as fast at compression and six times faster at decompression.",http://bzip.org/,http://www.bzip.org/downloads.html,,,,,BSD-3-Clause,,,,,154602,C,,0,1,0,8,"Website points: 0, CVE: 2, 12-month contributor: 2, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Bzip2 is widely used for decompression of network-supplied data. No code repo, only released code source tarballs. This is the reference implementation, many alternate implementations shown on https://en.wikipedia.org/wiki/Bzip2. Last release in 2010, v1.0.6, in response to CVE-2010-0405. No forums found. At least one HTTP server supports bzip2 for compression.  +++"
  db5.1-util,db,5.1.29-5,Berkeley v5.1 Database Utilities,http://www.oracle.com/technology/software/products/berkeley-db/index.html,0,https://security-tracker.debian.org/tracker/source-package/db,https://www.openhub.net/projects/berkeleydb,Berkeley DB,"Berkeley DB (BDB) is a high-performance, embedded database library with bindings in C, C++, Java, Perl, Python, Tcl, Smalltalk and many other programming languages. BDB stores arbitrary key/data pairs as byte arrays, and supports multiple data items for a single key. BDB can support thousands of simultaneous threads of control or concurrent processes manipulating databases as large as 256 terabytes, on a wide variety of systems including most UNIX-like and Windows systems as well as real-time operating systems.",http://www.oracle.com/technology/products/berkeley-db/db/index.html,,0,3,1746106,C,sleepycat,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,No recent development activity,93090,,Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  debianutils,,4.3.2,Miscellaneous utilities specific to Debian,,0,https://security-tracker.debian.org/tracker/source-package/debianutils,https://www.openhub.net/projects/debian-installer-utils,debian-installer-utils,,,,3,89,1170,shell script,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Few source code comments,Small development team,169899,C,Program,0,0,0,8,"Website points: 1, CVE: 0, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0","Collection of small tools.The tempfile(1) command is security-relevant (temp file mistakes are a common security vulnerability) but is relatively small, and usually the problem is a failure to use tempfile(1) or similar."
  dnsutils,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Clients provided with BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",156816,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Bind9 is critical for security. It does have active development. ++
  dpkg,,1.16.15,Debian package management system,http://wiki.debian.org/Teams/Dpkg,10,https://security-tracker.debian.org/tracker/source-package/dpkg,https://www.openhub.net/projects/dpkg,dpkg,Debian's PacKaGe manager,http://wiki.debian.org/Teams/Dpkg/,http://packages.debian.org/src:dpkg,43,205,64794,C,bsd_2clause_ish GNU_General_Public_License_v2_0_only gpl Public_Domain,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",169894,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Should primarily be managing data from trusted source; if it ensures data source okay, less risky."
  eject,,2.1.5+deb1+cvs20081104-13,ejects CDs and operates CD-Changers under Linux,http://www.pobox.com/~tranter/eject.html,0,https://security-tracker.debian.org/tracker/source-package/eject,https://www.openhub.net/projects/eject,eject utility for removable media,"Eject allows  removable media (typically a CD-ROM, floppy disk, tape, or JAZ or ZIP disk) to be ejected under  software control. The command can also control some multi-disc CD-ROM changers, the auto-eject feature supported by  some devices, and more.",http://sourceforge.net/projects/eject,,0,1,1247,C,,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,155486,,Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  exim4,,4.80-7+deb7u1,metapackage to ease Exim MTA (v4) installation,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",121505,C,Dummy Package,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","This is an MTA, thus has to process untrustworthy data.  Mailing lists, bugzilla tracker, public git repo. Active history of CVE issues and fixes. Active with 16 contributors in last year. ++"
  exim4-base,exim4,4.80-7+deb7u1,support files for all Exim MTA (v4) packages,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",125159,C,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  exim4-config,exim4,4.80-7+deb7u1,configuration for the Exim MTA (v4),http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",125426,"sh, bash, ksh, tcsh and other shells",Program,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  exim4-daemon-light,exim4,4.80-7+deb7u1,lightweight Exim MTA (v4) daemon,http://www.exim.org/,10,https://security-tracker.debian.org/tracker/source-package/exim4,https://www.openhub.net/projects/exim,Exim,"Exim is a message transfer agent (MTA) developed for Unix systems connected to the Internet. It is similar to Smail 3, but expands on Smail features.",http://www.exim.org/,http://www.exim.org/mirrors.html,19,40,115583,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",122835,C,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","This is an MTA, thus has to process untrustworthy data.  There are several MTA in use; should we focus on this one? ++"
  fakeroot,,1.18.4-2,tool for simulating superuser privileges,,0,https://security-tracker.debian.org/tracker/source-package/fakeroot,https://www.openhub.net/projects/6854,fakeroot,Gives a fake root environment through the use of LD_PRELOAD and SYSV IPC or TCP IPC trickery.,http://packages.debian.org/fakeroot,http://packages.debian.org/fakeroot,0,3,4906,C,,,,,,90563,C,,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  ftp,netkit-ftp,0.17-27,classical file transfer client,,0,https://security-tracker.debian.org/tracker/source-package/netkit-ftp,,,,,,,,,,,,,,,149032,C,Program,1,0,0,8,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Ftp isn't secure by itself, and the ftp client is less commonly used now.  That said, it certainly is used and connects to the wide Internet."
  ifupdown,,0.7.8,high level tools to configure network interfaces,,0,https://security-tracker.debian.org/tracker/source-package/ifupdown,https://www.openhub.net/projects/ifupdown-ng,ifupdown-ng,Next-generation network interface configuration tool,https://github.com/kmoffett/ifupdown-ng,https://github.com/kmoffett/ifupdown-ng/downloads,0,1,830,Python,,Stable Y-O-Y development activity,Short source control history,Well-commented source code,No recent development activity,169457,C,Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  initscripts,sysvinit,2.88dsf-41+deb7u1,scripts for initializing and shutting down the system,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/sysvinit,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,169876,"sh, bash, ksh, tcsh and other shells",Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  insserv,,1.14.0-5,boot sequence organizer using LSB init.d script dependency information,http://savannah.nongnu.org/projects/sysvinit,0,https://security-tracker.debian.org/tracker/source-package/insserv,https://www.openhub.net/projects/sysvinit,sysvinit,"The Sysvinit package contains programs for controlling the startup, running, and shutdown of the system.",http://savannah.nongnu.org/projects/sysvinit,,0,2,8054,C,gpl,Decreasing Y-O-Y development activity,Well-established codebase,Average number of code comments,No recent development activity,161625,,Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  isc-dhcp-client,isc-dhcp,4.2.2.dfsg.1-5+deb70u6,ISC DHCP client,,22,https://security-tracker.debian.org/tracker/source-package/isc-dhcp,https://www.openhub.net/projects/4273,DHCP (ISC),"The Internet Systems Consortium (ISC) offers a Dynamic Host Configuration Protocol (DHCP) distribution including a DHCP server, client and relay agent. This distribution supports POSIX-compliant operating systems and also non-POSIX systems like Windows NT and MacOS.",http://www.isc.org/downloads/dhcp/,http://ftp.isc.org/isc/dhcp/,6,22,124066,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Average size development team,157880,C,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","In wide use, accepts data from external sources.  Includes dhclient. Very similar to BIND. Perhaps slightly less active, lower developer count, but steady commits and releases. Somewhat critical due to being core network functionality. ++"
  libattr1,attr,1:2.4.46-8,Extended attribute shared library,http://savannah.nongnu.org/projects/attr/,0,https://security-tracker.debian.org/tracker/source-package/attr,https://www.openhub.net/projects/attr,Linux Extended Attributes,"A set of tools for manipulating extended attributes on filesystem objects, in particular getfattr(1) and setfattr(1).
  An attr(1) command is also provided which is largely compatible with the SGI IRIX tool of the same name.",http://savannah.nongnu.org/projects/attr,http://savannah.nongnu.org/files/?group=attr,2,27,2691,C,gpl,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,169897,C,Shared Library,0,0,1,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Actual acl checking implemented by the kernel.
  libbind9-80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,BIND9 Shared Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",105540,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Bind9 is critical for security. It does have active development. ++
  libbz2-1.0,bzip2,1.0.6-4,high-quality block-sorting file compressor library - runtime,http://www.bzip.org/,2,https://security-tracker.debian.org/tracker/source-package/bzip2,https://www.openhub.net/projects/bzip2,bzip2,"bzip2 is a freely available, patent free, high-quality data compressor. It typically compresses files to within 10% to 15% of the best available techniques (the PPM family of statistical compressors), whilst being around twice as fast at compression and six times faster at decompression.",http://bzip.org/,http://www.bzip.org/downloads.html,,,,,BSD-3-Clause,,,,,169891,C,Shared Library,0,1,0,8,"Website points: 0, CVE: 2, 12-month contributor: 2, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0",Bzip2 is widely used for decompression of network-supplied data. ++
  libdb5.1,db,5.1.29-5,Berkeley v5.1 Database Libraries [runtime],http://www.oracle.com/technology/software/products/berkeley-db/index.html,0,https://security-tracker.debian.org/tracker/source-package/db,https://www.openhub.net/projects/berkeleydb,Berkeley DB,"Berkeley DB (BDB) is a high-performance, embedded database library with bindings in C, C++, Java, Perl, Python, Tcl, Smalltalk and many other programming languages. BDB stores arbitrary key/data pairs as byte arrays, and supports multiple data items for a single key. BDB can support thousands of simultaneous threads of control or concurrent processes manipulating databases as large as 256 terabytes, on a wide variety of systems including most UNIX-like and Windows systems as well as real-time operating systems.",http://www.oracle.com/technology/products/berkeley-db/db/index.html,,0,3,1746106,C,sleepycat,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,No recent development activity,117520,,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libdns88,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,DNS Shared Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",104754,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Bind9 is critical for security. It does have active development. ++
  libedit2,libedit,2.11-20080614-5,BSD editline and history libraries,http://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/lib/libedit/,0,https://security-tracker.debian.org/tracker/source-package/libedit,https://www.openhub.net/projects/libedit-merge,libedit-merge,,http://github.com/alloy/libedit-merge,,0,1,32187,C,,Stable Y-O-Y development activity,Short source control history,Average number of code comments,No recent development activity,169609,C,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libgnutls26,gnutls26,2.12.20-8+deb7u2,GNU TLS library - runtime library,http://www.gnutls.org/,21,https://security-tracker.debian.org/tracker/source-package/gnutls26,https://www.openhub.net/projects/gnutls,GnuTLS,"GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. It is aimed to be portable and efficient with focus on security and interoperability.",http://www.gnutls.org,,21,79,185927,C,gpl3_or_later lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Large, active development team",157014,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","TLS implementation.  Less used than OpenSSL, but is in use (it avoids OpenSSL licensing issues). Good ""security activity"" metrics, except suspiciously empty GitLab issue tracker, especially when Debian Security page shows many existing vulnerabilities. They may sweep the public issue tracker so as not to expose what they're trying to fix before it's ready. Notably still supporting SSL 3.0, which has known exploits. There is evidence they do stay on top of things, though. They have responded to questions regarding FREAK in their mailing lists, explaining gnutls is not vulnerable due to how it operates. ++"
  libgssapi-krb5-2,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries - krb5 GSS-API Mechanism,http://web.mit.edu/kerberos/,45,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,21,96,388789,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161577,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Vital when using Kerberos; unclear how common that is today. (For Windows, may use SAMBA)"
  libice6,libice,2:1.0.8-2,X11 Inter-Client Exchange library,,0,https://security-tracker.debian.org/tracker/source-package/libice,https://www.openhub.net/projects/libice,libice,ICE - Is a generic module for Interactive Connectivity Establishment to make better flow of data between the endpoints in the internet. This is mostly used to intiate the media session between the endpoints. It is written in Purely ANSI C so that it can be compiled to embedded platforms.,http://code.google.com/p/libice,,0,1,0,,gpl,Stable Y-O-Y development activity,Short source control history,,No recent development activity,137357,C,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libkeyutils1,keyutils,1.5.5-3+deb7u1,Linux Key Management Utilities (library),http://people.redhat.com/~dhowells/keyutils/,0,https://security-tracker.debian.org/tracker/source-package/keyutils,https://www.openhub.net/projects/keyutils,keyutils,Linux Key Management Utilities,https://github.com/pld-linux/keyutils,,1,4,0,,,Stable Y-O-Y development activity,"Mature, well-established codebase",,Only a single active developer,167697,C,Shared Library,0,1,0,8,"Website points: 0, CVE: 0, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 1 , Data only: 0","Manages authorization and encryption keys required to perform secure operations. Public Repo, NO bug tracker, NO mailing list. ++"
  libkrb5-3,krb5,1.10.1+dfsg-5+deb7u2,MIT Kerberos runtime libraries,http://web.mit.edu/kerberos/,45,https://security-tracker.debian.org/tracker/source-package/krb5,https://www.openhub.net/projects/kerberos,Kerberos,Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.,http://web.mit.edu/Kerberos/,http://web.mit.edu/Kerberos/dist/index.html,21,96,388789,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",161582,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Vital when using Kerberos; unclear how common that is today. (For Windows, may use SAMBA)"
  libldap-2.4-2,openldap,2.4.31-1+nmu2,OpenLDAP libraries,http://www.openldap.org/,13,https://security-tracker.debian.org/tracker/source-package/openldap,https://www.openhub.net/projects/openldap,OpenLDAP,"OpenLDAP Software is the premier open source implementation of the Lightweight Directory Access Protocol. It is the most reliable and standards-compliant. Since 2005 it has been the world's fastest; it is the gold standard against which all other directory software is compared.
  
  The suite includes:
  
  * slapd - stand-alone LDAP daemon (server)
  * libraries implementing the LDAP protocol, and
  * utilities, tools, and sample clients.",http://www.openldap.org/,http://www.openldap.org/software/download/,18,104,564452,C,OpenLDAP_Public_License,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",166665,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Wide use, vitally important. Very active. Public repo, issue tracker, lists, active development, closing CVEs, the works. This is vitally important, but they appear to have things in hand in terms of project activity. ++"
  liblwres80,bind9,1:9.8.4.dfsg.P1-6+nmu2+deb7u3,Lightweight Resolver Library used by BIND,,34,https://security-tracker.debian.org/tracker/source-package/bind9,https://www.openhub.net/projects/bind,BIND (Berkeley Internet Name Domain),"BIND (Berkeley Internet Name Domain) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System, including a Domain Name System server, a Domain Name System resolver library and tools for verifying the proper operation of the DNS server.",https://www.isc.org/wordpress/software/bind/,https://www.isc.org/wordpress/downloads/,9,48,648199,C,isc,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",105345,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Bind9 is critical for security. It does have active development. ++
  libmpfr4,mpfr4,3.1.0-5,multiple precision floating-point computation,http://www.mpfr.org/,1,https://security-tracker.debian.org/tracker/source-package/mpfr4,https://www.openhub.net/projects/gnu-mpfr,GNU MPFR,Provides a library for multiple-precision floating-point computation with correct rounding. The computation is both efficient and has a well-defined semantics. It copies the good ideas from the ANSI/IEEE-754 standard for double-precision floating-point arithmetic.,http://www.mpfr.org/,http://www.mpfr.org/mpfr-current/,2,17,91557,C,lgpv3_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,139170,C,Shared Library,0,0,0,8,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libpam-modules,pam,1.1.3-7.1,Pluggable Authentication Modules for PAM,http://pam.sourceforge.net/,15,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,7,20,57169,C,BSD-3-Clause gpl gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169892,C,Plugin,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Critical central role for authentication.  Real site is http://www.linux-pam.org/ (Debian lists as http://pam.sourceforge.net/ but that points to https://fedorahosted.org/linux-pam/ which points to this). It has a somewhat active mailing list, and an active issue tracker where issues are clearly opened and closed. Stable version is somewhat old (2013); recent changes in git though relatively small (https://git.fedorahosted.org/cgit/linux-pam.git/) ++"
  libpam0g,pam,1.1.3-7.1,Pluggable Authentication Modules library,http://pam.sourceforge.net/,15,https://security-tracker.debian.org/tracker/source-package/pam,https://www.openhub.net/projects/linux-pam,Linux-PAM,Linux-PAM (Pluggable Authentication Modules for Linux) project.,http://www.linux-pam.org,https://fedorahosted.org/releases/l/i/linux-pam/,7,20,57169,C,BSD-3-Clause gpl gpl3,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Large, active development team",169889,C,Shared Library,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Critical central role for authentication; not very active.  Concerning. ++
  libpciaccess0,libpciaccess,0.13.1-2,Generic PCI access library for X,,0,https://security-tracker.debian.org/tracker/source-package/libpciaccess,https://www.openhub.net/projects/pci-utility,PCI Configuration Utility.,pci-utility is utility developed to access PCI Device configuration Space. It enables user to read and write registers on PCI Configuration space of PCI Devices.,http://sourceforge.net/projects/pci-utility,,0,1,1119,C,,Stable Y-O-Y development activity,Short source control history,Average number of code comments,No recent development activity,110995,,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libprocps0,procps,1:3.3.3-3,library for accessing process information from /proc,http://gitorious.org/procps,0,https://security-tracker.debian.org/tracker/source-package/procps,https://www.openhub.net/projects/procps,Procps - The /proc file system utilities,"procps is the package that has a bunch of small useful utilities that give information about processes using the /proc filesystem. The package includes the programs ps, top, vmstat, w, kill, free, slabtop, and skill.
  
  Version 3 includes NPTL thread support, a rewritten top, many bug fixes, performance improvements, and new features.",http://procps.sourceforge.net/,http://procps.sourceforge.net/download.html,0,2,15622,C,lgpl21_or_later,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,117203,,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libssl1.0.0,openssl,1.0.1e-2+deb7u13,SSL shared libraries,,87,https://security-tracker.debian.org/tracker/source-package/openssl,https://www.openhub.net/projects/openssl,OpenSSL,"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and dev",http://www.openssl.org/,http://www.openssl.org//source/,107,177,437855,C,OpenSSL_License,Increasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,"Very large, active development team",136119,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Critical, in wide use.  OpenSSL is already funded by CII. ++"
  libusb-1.0-0,libusbx,2:1.0.11-1,userspace USB programming library,http://www.linux-usb.org/,0,https://security-tracker.debian.org/tracker/source-package/libusbx,https://www.openhub.net/projects/libusbx,libusbx,libusbx is a cross-platform user mode library that provides generic access to USB devices,http://libusbx.org,http://sourceforge.net/projects/libusbx/files/,0,71,28479,C,lgpl21_or_later,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Well-commented source code,No recent development activity,133195,C,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libustr-1.0-1,ustr,1.0.4-3,Micro string library: shared library,http://www.and.org/ustr/,0,https://security-tracker.debian.org/tracker/source-package/ustr,https://www.openhub.net/projects/10874,Ustr,"Micro string library, very low overhead from plain strdup() (Ave. 44% for 0-20B strings). Very easy to use in existing C code. At it's simplest you can
  just include a single header file into your .c and start using it.",http://www.and.org/ustr/,http://www.and.org/ustr/,0,2,27200,C,mit,Stable Y-O-Y development activity,Short source control history,Very few source code comments,No recent development activity,136967,,Shared Library,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  libxrender1,libxrender,1:0.9.7-1+deb7u1,X Rendering Extension client library,,1,https://security-tracker.debian.org/tracker/source-package/libxrender,https://www.openhub.net/projects/libxrender,libXrender,,http://cgit.freedesktop.org/xorg/lib/libXrender,http://cgit.freedesktop.org/xorg/lib/libXrender,2,31,2995,C,mit,Decreasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,Small development team,139934,,,0,0,0,8,"Website points: 0, CVE: 1, 12-month contributor: 4, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  linux-image-3.2.0-4-amd64,linux,3.2.63-2+deb7u2,Linux 3.2 for 64-bit PCs,,403,https://security-tracker.debian.org/tracker/source-package/linux,https://www.openhub.net/projects/linux,Linux Kernel,"Linux is a free software kernel, which combined with the GNU libraries, core utils and shell form the GNU/Linux operating system.
  
  !!!PLEASE!!! DO NOT REMOVE git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git enlistment. It contains historical pre-2.6.12 commit data.",http://kernel.org/,,3714,14514,18036029,C,GNU_General_Public_License_v2_0_only,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",74082,,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Linux kernel. Fundamental to security, but it has extremely active development and many tools/organizations reviewing."
  menu,,2.1.46,generates programs menu for all menu-aware applications,,0,https://security-tracker.debian.org/tracker/source-package/menu,https://www.openhub.net/projects/8294,Debian menu,Generate menus files for applications from a list of menu entries files and an application specific menu-method file. This is the way coherence between installed packages and programs menu is achieved on Debian systems.,http://alioth.debian.org/projects/menu/,http://alioth.debian.org/scm/?group_id=30046,0,7,5098,C++,gpl,Stable Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,No recent development activity,90826,,Program,0,0,0,8,"Website points: 0, CVE: 0, 12-month contributor: 5, Popularity: 1, Language: 2, Exposure: 0 , Data only: 0",
  netcat-traditional,netcat,1.10-40,TCP/IP swiss army knife,,0,https://security-tracker.debian.org/tracker/source-package/netcat,,,,,,,,,,,,,,,166141,C,,1,0,0,8,"Website points: 1, CVE: 0, 12-month contributor: 2, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0",Netcat is typically used only by invocation in specific cases.
  nfs-common,nfs-utils,1:1.2.6-4,NFS support files common to client and server,http://nfs.sourceforge.net/,4,https://security-tracker.debian.org/tracker/source-package/nfs-utils,https://www.openhub.net/projects/nfs-utils,nfs-utils,"The Network File System (NFS) was developed to allow machines to mount a disk partition on a remote machine as if it were a local disk. It allows for fast, seamless sharing of files across a network.",http://nfs.sourceforge.net/,http://sourceforge.net/projects/nfs/files/nfs-utils/,36,142,38969,C,gpl,Increasing Y-O-Y development activity,"Mature, well-established codebase",Average number of code comments,"Very large, active development team",143800,C,,1,0,0,8,"Website points: 0, CVE: 3, 12-month contributor: 0, Popularity: 1, Language: 2, Exposure: 2 , Data only: 0","Important for NFS, amount of use unclear."
  openssh-client,openssh,1:6.0p1-4+deb7u2,"secure shell (SSH) client, for secure access to remote machines",http://www.openssh.org/,13,https://security-tracker.debian.org/tracker/source-package/openssh,https://www.openhub.net/projects/openssh,OpenSSH,"OpenSSH is a free SSH/SecSH protocol suite providing encryption for network services like remote login or remote file transfer.
  
  The following is a list of OpenSSH features:
  