Okay, but what about people who aren't security researchers, who just want to figure out if their distribution/vendor/self is running vulnerable software?