While user count can affect absolute disclosure volume it does not drive the main comparison in my paper. What I do is to use Xen advisories to measure upstream dependence: how much of the Qubes public advisory record is attributable to Xen/CPU/upstream components rather than Qubes core logic? That attribution result is internal to the Qubes record, so it is much less sensitive to Xen’s much larger user base.
While user count can affect absolute disclosure volume it does not drive the main comparison in my paper. What I do is to use Xen advisories to measure upstream dependence: how much of the Qubes public advisory record is attributable to Xen/CPU/upstream components rather than Qubes core logic? That attribution result is internal to the Qubes record, so it is much less sensitive to Xen’s much larger user base.