libsqlite3-0 risk index should be 8 not 6

[edwintorok]

Manually calculating the score yields a score of 8:

• website: 0 points
• CVE : 3 points (4 CVEs since 2010, don't know why its marked as 0 in your csv)
• Contributor: 0 points (according to scm history, 4 contributors in 12 months)
• popularity: 1 point (popcon vote: 126928 83348, popcon inst: 130862)
• Network exposure: at least 1 point (firefox uses it for IndexedDB IIRC)
• Dependencies: 2 points (440 unique reverse depends for libsqlite3-0 sqlite3)
• Patches: 1 point (8 patches, not marked as forwarded in debian)
• ABRT crash statistics: don't know where to get this from

[skhakimov]

Hello,

Please note: we are not yet including Dependencies, Patches and ABRT crash statistics into the risk index. These are suggested but are not implemented yet [1].

CVEs are not being captured because all are recent (post-April 2015). I believe results.csv shows data from March-April. Rerunning the script will reflect latest CVEs and scores. And we are using [2] to source CVEs.

[1] https://www.coreinfrastructure.org/programs/census-project
[2] https://security-tracker.debian.org/tracker/source-package/sqlite3

[david-a-wheeler]

I suggest closing this issue, partly because we've shown in the previous responses that we don't use ABRT etc., and partly from the resolution of issue #29 . In particular, the new version of the tool will show each portion of the calculated score, making it MUCH easier to see why scores ended up a certain way.

[edwintorok]

thanks