The Linux Foundation and Harvard’s Lab for Innovation Science release census for open-source software security

> Javascript? Is core? have they ever bothered to look at root running daemons?

Yes, Census I (which I led) specifically looked at system packages (it specifically looked at Debian, though different distros share many of the same important packages in practice).

Census II (run by Harvard) wanted to look at language-level packages. Their report discusses some of the challenges. One challenge of many is that the JavaScript environment strongly encourages tiny modules, with around 1/2 of all JavaScript packages having at most one function. As a result, when you start counting dependencies, there are *far* more dependencies in JavaScript (because each module does so little), and so JavaScript tends to dominate. One solution is to look at each ecosystem separately (e.g., separate JavaScript from Python). Another problem is that while dependencies tell you about transitive dependencies, they don't tell you "what people are actually using". And so on.

In my post Census II Report on Open Source Software, their long-term goal is to figure out what FOSS packages are most critical through data analysis. However, "this turns out to extremely difficult, as discussed in the paper." They expressly state that their current results “cannot - and do not purport to - be a definitive claim of which FOSS packages are the most critical”. Instead, they have developed a method as a “proof of concept” to start working towards that answer.

This is not a final answer. Instead, it shows why it's so hard to get a final answer. It's merely a step to try to move towards an answer. Your suggestions on how to get there with quantitative analysis (instead of guessing) would be welcome :-).