An empirical study of security problem reports in Linux distributions
Two case studies of open source software development: Apache and Mozilla