This feels like a strange list. The top five are Debian, suSE, Oracle, IBM, and Microsoft. The next three are Canonical, Google, and RedHat. This feels more lik

This feels like a strange list. The top five are Debian, suSE, Oracle, IBM, and Microsoft. The next three are Canonical, Google, and RedHat. This feels more like a fact about how much software the organizations are shipping rather than anything about the organizations themselves. I also wonder whether they double count a bunch of vulnerabilities that are in both Debian and SuSE (and Canonical and Oracle and RedHat).