Takes more time as time passes by 1999 - average 1,3 days mean 3,5 (16) 2000 - average 17,3 days mean 2 (45) 2001 - average 15,8 days mean 6 (52) 2002 - average 42,6 days mean 9 (115) 2003 - average 80,4 days mean 63 (14) A constant increase of DSAs: DSAs in 1997: 17 DSAs in 1998: 43 DSAs in 1999: 38 DSAs in 2000: 66 DSAs in 2001: 85 DSAs in 2002: 124 DSAs in 2003: 111 (july 11th) Slink (unknown, no priority in Sources) Potato DSAs: 6 required, 10 important, 17 standard, 24 extra, 140 optional Woody DSAs: 1 to important, 3 to required, 11 standard, 41 extra, 139 optional Compare vs. CERT and Bugtraq reports of vuln increase We have more software -> we have more DSAs. Obvious but true.