This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
The weighting: why one rule counts twice as much as the others
The four rules carry 40, 20, 20, and 20 points. The library with no maker maintenance weighs twice as much as any visibility rule — because it describes a real problem, while the other three only make reconnaissance easier for attackers.
- The weighting follows the actual risk, not measurability. It would have been simpler to weight all four equally — the result would be a score that takes three minor things as seriously as one real shortcoming.
- The practical consequence: anyone who only hides the version values ends up at 60 points, and so stays below the seal threshold. The discontinued library has to go.
- The reverse is also true: replacing the library alone isn't enough either — the three visibility rules together weigh just as much.
FAQ
Why isn't the split even?
Because the four rules don't carry equal weight. An unmaintained library is a state that won't improve any further; a visible version number is a setting.
How do we get above the seal threshold?
Only with both: no library at end of maintenance AND no publicly visible version values. None of the four rules alone is enough.