Define core data collections principles

[pombredanne]

In order to guide the data collection efforts we need to define the core data collection principles.

• What should be our priorities?
• What about older, historical data?
• What about system/distro vs. application vulnerabilities?

[pombredanne]

Here is my take:
We prioritize:

• newer data over older, historical data (but we will eventually also include historical data).
  • The rationale is that older vulnerabilities (where older means 5 years old +) are for older package versions and are less likely to be relevant.
• application packages over system packages vulnerabilities (though they clearly intersect and we are bootstrapping with distros packages)
  • The rationale is that distros provide integrated mostly automatic security patch/upgrade systems, whereas there is no such thing for application packages vulnerabilities. Therefore the risk are likely higher in practice in this area.

[pombredanne]

I think we have the info here. so we can close this