some packages mentioned in the paper are missing from results.csv

[edwintorok]

I see nginx mentioned in the paper, but its not in results.csv or projects_to_examine.csv, did it get lost in the process?
Risk index should be ~8 points if I counted right:

• website: 0 points
• CVE : 3 points (17 CVEs since 2010)
• Contributor: 0 points (according to scm history, 22 contributors in 12 months)
• popularity: 1 point (popcon vote: 126928)
• Network exposure: 2 points
• Dependencies: 2 points (~20 unique reverse depends for nginx, nginx-light, nginx-extras, nginx-full)
• Patches: 0 point (1 patch)
• ABRT crash statistics: don't know where to get this from

[skhakimov]

Hello,

Thanks for pointing out nginx. It will be included into the list. Our initial list primarily included packages in Standard System Utilities and Web Server.

Please note: we are not yet including Dependencies, Patches and ABRT crash statistics into the risk index. These are suggested but not yet implemented [1].

Can you please advise how you obtain popcon vote of 126928 for nginx? As per [2], it is 6428.

[1] https://www.coreinfrastructure.org/programs/census-project
[2] http://popcon.debian.org/by_inst

[edwintorok]

I was looking here for nginx popcon and got confused that at the top it says in bold green Vote (122307). Turns out that is the vote for libc6, not nginx (why would they show the vote for libc6 on the popcon page for nginx?).
Your number looks more correct, although I'm still confused on why the number of installs for nginx + number of installs for nginx-full is more than the number of installs for nginx-common.

[skhakimov]

Hello,

I think the vote for libc6 on the popcon page for 'nginx' is displayed for one to see the highest ranked item in that category (for comparison, etc). Thus, for 'vote' it is 'libc6' and for 'inst' it is 'debianutils'.

Current popcon votes for nginx:
nginx-common 6817
nginx 6315
nginx-full 5816

It is okay for number of installs for 'nginx' + number of installs for 'nginx-full' to be more than the number of installs for 'nginx-common' because dependencies are as follows:

nginx depends on nginx-full or nginx-light
nginx-full depends on nginx-common