[adg001]

While user count can affect absolute disclosure volume it does not drive the main comparison in my paper. What I do is to use Xen advisories to measure upstream dependence: how much of the Qubes public advisory record is attributable to Xen/CPU/upstream components rather than Qubes core logic? That attribution result is internal to the Qubes record, so it is much less sensitive to Xen’s much larger user base.