Differences

This shows you the differences between two versions of the page.

--- provenance:design:mobile_and_app_measurement [2026/08/27 07:09] – New page: provenance for design:mobile_and_app_measurement — every query, the report script and its unedited output, the fold and its full residue, probes, quote checks, external verification and rejections. Authored by Claude karel.kubicek.claude
+++ provenance:design:mobile_and_app_measurement [2026/08/27 07:40] (current) – Add the generic reviewer's log (16 findings, all accepted, including that this log's one rejection was itself wrong); correct the nine stale dates that survived in the section-8 verified table; compute the objection enumeration and the traffic-pinning int karel.kubicek.claude
@@ Line 14: / Line 14: @@
 | Full-text probes | ''scripts/mobile_probes.sh'' (new) → ''scripts/mobile_probes-output.txt'' |
 | Number guard | ''scripts/mobile_number_guard.mjs'' (new) → ''scripts/mobile_number_guard-output.txt'' |
+| External tool currency | ''scripts/mobile_tool_currency.sh'' (new) → ''scripts/mobile_tool_currency-output.txt'' |
 | Data | ''data/extract/run1/extractions.jsonl'', 5,859 papers, 7 venues, 2010–2026 |
 | Bibliography additions | 17 new entries, ''pages/bib_additions_mobile.bib'' |
@@ Line 87: / Line 88: @@
 sh   scripts/mobile_probes.sh       > scripts/mobile_probes-output.txt
 node scripts/mobile_number_guard.mjs > scripts/mobile_number_guard-output.txt
+sh   scripts/mobile_tool_currency.sh > scripts/mobile_tool_currency-output.txt
 </code>
-The guard is the last gate: it harvests every numeric token from the content page and requires each one to appear in one of the three committed outputs, or to be listed in an ''ALLOW'' map **with a written reason**. It currently traces 305 of 366 figures to an output and allows 61 with reasons (external version numbers, dates, ordinals, and figures from cited papers that the quote check covers instead).
+The guard is the last gate: it harvests every numeric token from the content page and requires each one to appear in one of the three committed outputs, or to be listed in an ''ALLOW'' map **with a written reason**. Its own accounting is printed in the output block below rather than restated here, because restating it is how it goes stale: an earlier version of this paragraph said "305 of 366 … 61 allowed" after the output had moved to 367 and 62. Read the numbers from the block, not from this sentence.
 **What the guard does not do**, and this matters: it proves a number //appears// in a source. It does not prove it is the right number for the sentence around it, and it cannot see figures inside quoted phrases. The two worst errors on this page (see §12) were both invisible to it and were caught by re-reading the prose against the script output by hand.
 <file - mobile_number_guard-output.txt>
-figures harvested from pages/design_mobile_and_app_measurement.txt: 366
+figures harvested from pages/design_mobile_and_app_measurement.txt: 374
-allowed with a written reason: 61
+allowed with a written reason: 65
-traced to 3 committed outputs: 305
+traced to 3 committed outputs: 309
 UNACCOUNTED: none
@@ Line 312: / Line 314: @@
 --- historical
   mentions TaintDroid (only 7 of 529 papers actually USED it)
+--- gaps a practitioner would ask about (added after review)
+  mentions QUIC (case-sensitive)
+  names an on-device-VPN capture tool or the VpnService API (narrow)
+  describes the on-device-VPN capture technique (narrow)
+  describes attributing traffic to a specific app or library (narrow)
 </file>
@@ Line 320: / Line 328: @@
 **40 figures across 13 papers: 38 verbatim, 2 present but fragmented by column reflow, 0 not located.**
-Two findings worth recording:
+Three findings worth recording:
   - **''oltrogge2021_mallory'', "5,511 (36.7%) vulnerable apps".** The extraction's ''evidence.quote'' for this tuple is a //different// sentence ("2,232 (14.8%) apps with vulnerable HostnameVerifier and 5,202 (34.7%) apps with vulnerable TrustManager"), whose numbers do not add to 5,511. The prevalence string was checked directly against the paper and the paper does say, verbatim, "Most of the affected apps implemented both vulnerabilities, resulting in 5,511 (36.7%) vulnerable apps total." The figure is right; the extraction's quote is a poor witness for it. **This is why the check is on the published substring and not on the quote.**
@@ Line 380: / Line 388: @@
 Training data is stale by construction for tool currency, so **every external claim on the content page was fetched, not recalled**, on 2026-08-27. Verification was by GitHub API or ''releases.atom''/''commits.atom'' feed for repositories, by registry API for packages, and by the vendor's or platform's own documentation for everything else.
+<WRAP important>
+**Read §11 reviewer 3 before trusting a date in this table.** Nine of the ''releases.atom'' dates in the first version of this table were wrong — an off-by-one regex paired each version with the previous release's date — and the table below has been corrected in place from the re-fetch. The corrected values are marked in bold. "Fetched, not recalled" was true; "parsed correctly" was not, and the two are different claims.
+</WRAP>
 ==== Verified ====
@@ Line 387: / Line 399: @@
 | objection 1.12.5, 2026-06-02 | GitHub API |
 | Magisk v30.7, 2026-02-23 | GitHub API |
-| Xposed archived, last push 2020-06-08 | GitHub API, ''"archived": true'' |
+| Xposed archived (flag flipped 2023-06-01); last release v89 2017-12-17; last push 2020-06-08 | GitHub API, ''"archived": true'' |
-| LSPosed latest release v1.9.2, 2023-10-11, repo pushed 2026-08-26 | GitHub API |
+| LSPosed latest release v1.9.2, 2023-10-11; **default-branch commit 2024-01-07**; ''pushed_at'' 2026-08-26 counts any branch | GitHub API + ''commits/HEAD.atom'' |
 | JustTrustMe last release 2016, last push 2024-09-02 | GitHub API |
 | SSL Kill Switch 2 release 0.14 (2019-12-03), last push 2023-07-09, README claims support to iOS 14.2 | GitHub API + README |
 | TrustMeAlready archived 2019-09-23 | GitHub API |
-| Soot 4.7.1 (2026-02-13); SootUp v3.0.1 (2026-07-16) | ''releases.atom'' for both repos |
+| Soot 4.7.1 (**2026-02-23**); SootUp v3.0.1 (**2026-08-07**) | ''releases.atom'', **re-fetched after the off-by-one bug in §11 reviewer 3** |
-| FlowDroid 2.15.1, 2026-02-19 | ''releases.atom'' |
+| FlowDroid 2.15.1, **2026-02-23** | ''releases.atom'', re-fetched |
-| Apktool v3.0.3, 2026-04-19 | ''releases.atom'' |
+| Apktool v3.0.3, **2026-07-20** | ''releases.atom'', re-fetched |
-| jadx 1.5.6, 2026-02-25 | ''releases.atom'' |
+| jadx 1.5.6, **2026-07-10** | ''releases.atom'', re-fetched |
 | Androguard 4.1.4 on PyPI, 2026-06-01 | PyPI JSON API |
-| MobSF v4.5.2, 2026-07-06 | ''releases.atom'' |
+| MobSF v4.5.2, **2026-08-10** | ''releases.atom'', re-fetched |
 | **LibRadar last commit 2018-12-21** | ''github.com/pkumza/LibRadar/commits/master.atom'' |
 | **LibScout last commit 2019-10-25** | ''github.com/reddr/LibScout/commits/master.atom'' |
@@ Line 403: / Line 415: @@
 | the npm README's "I don't use or actively maintain this project anymore" | fetched ''README.md'' raw; quoted verbatim |
 | PyPI ''google-play-scraper'' 1.2.7, 2024-06-07 | PyPI JSON API + no GitHub releases |
-| ''apkeep'' 1.0.0, 2026-04-30 | GitHub API |
+| ''apkeep'' 1.0.0, 2026-04-30 | GitHub API ''published_at''. Note ''releases.atom'' reports 2026-05-05 for the same release; the API/tag page is authoritative |
 | ''PlaystoreDownloader'' archived 2024-07-27 | GitHub API |
-| ''ipatool'' v2.3.2, 2026-07-05 | ''releases.atom'' |
+| ''ipatool'' v2.3.2, **2026-08-03** | ''releases.atom'', re-fetched |
 | ''frida-ios-dump'' last commit 2020-06-01 | ''commits.atom'' |
-| palera1n v3.0.0 beta 2 (2026-07-27); Dopamine 3.0.9 (2026-08-22); TrollStore 2.1.1 (2024-09-02), commits to 2026-04 | ''releases.atom'' / ''commits.atom'' |
+| palera1n v3.0.0 beta 2 (**2026-08-03**); Dopamine 3.0.9 (2026-08-22); TrollStore 2.1.1 (**2026-04-01**) | ''releases.atom'' / ''commits.atom'', re-fetched |
 | Appium 3.7.0, 2026-08-24 | ''registry.npmjs.org/appium'' |
 | Monkey still shipped in the Android SDK | ''developer.android.com/studio/test/other-testing-tools/monkey'' returns 200 |
@@ Line 455: / Line 467: @@
   * **Whether the pinning-bypass success rate has changed since 2022.** {[pradeep2022_comparative]} is the only measurement of it found anywhere in the corpus. Four Frida majors later, nobody has repeated it. Published as the first open question.
   * **Exodus Privacy's current tracker-signature count.** Not on the front page, and the statistics pages were not reachable during this run. The page says the service is live and explicitly tells the reader to check before quoting a count.
-  * **Whether the corpus's mobile share is really falling.** ''appAnalysis'' peaked at 18.4% of papers in 2015 and is 6.7% in 2024. That could be a real shift, or it could be the corpus's absolute growth (119 papers in 2010, 690 in 2024) diluting a constant absolute volume — absolute mobile counts are roughly flat at 44–66 per year since 2019. The page reports the per-year table and does not claim a trend either way.
+  * **Whether the corpus's mobile share is really falling.** ''appAnalysis'' peaked at 18.4% of papers in 2015 and is 6.7% in 2024. That could be a real shift, or it could be the corpus's absolute growth (119 papers in 2010, 690 in 2024) diluting a constant absolute volume — absolute mobile counts are roughly flat at 44–66 per year over 2020–2025, with 2019 at 38 and the provisional 2026 at 24. The report output prints the per-year table; the content page shows only the four era columns and makes no claim about the share trend in either direction.
   * **Apple's privacy-manifest (''PrivacyInfo.xcprivacy'') requirement date.** The fetch of Apple's required-reason-API page returned only a title. Privacy manifests are therefore **not** discussed on the page, even though they are an obviously scrapable artefact. A future run should get this and add it.
@@ Line 476: / Line 488: @@
 **Every DOI was resolved against the Crossref API** (''api.crossref.org/works/<doi>''); all 11 DOI-bearing entries returned HTTP 200. The six USENIX/NDSS entries have no DOI and are cited by landing-page URL, which is what ''bibgen.mjs'' does for those venues.
-**Four entries are from outside the seven venues**, added deliberately because the corpus cannot cover them:
+**Five of the 17 entries are from outside the seven venues**, added deliberately because the corpus cannot cover them:
 ^ Key ^ Why it is needed ^
@@ Line 487: / Line 499: @@
 ===== 11. Review log =====
-Four reviewers, all told explicitly that the author's context may not be exhaustive, and all handed the page text, the report script, its unedited output, the probe and quote-check outputs, and these provenance notes. The three focused reviewers ran in parallel first; the generic reviewer ran afterwards on the corrected page.
+Four reviewers, all told explicitly that the author's context may not be exhaustive, and all handed the page text, the report script, its unedited output, the probe and quote-check outputs, and these provenance notes. The three focused reviewers ran in parallel first; the generic reviewer ran afterwards on the corrected page — and **caught that this log's one rejection was itself wrong** (see reviewer 4).
+==== Reviewer 1 — figures vs the report script (''model: sonnet'') ====
+Re-ran all three scripts live and confirmed the committed ''scripts/*-output.txt'' files are byte-identical to a fresh run. Checked roughly 400 individual figures and percentages cell by cell.
+^ # ^ Finding ^ Verdict ^ Action ^
+| 1 | The per-era tool table in the report script filtered to families with **≥8 papers**, which silently omitted TaintDroid (7 papers) — a family the content page quotes per-era to argue it is superseded. A reader told to verify the page against this output could not find the row. | **Accepted.** Real reproducibility gap, and exactly the defect the provenance convention exists to prevent. | Threshold removed; the era table now prints **every** mapped family with no minimum, and the code carries a comment saying why. The TaintDroid figures on the page (6.8% / 0.6% / 0% / 0%) were correct and are unchanged; they are now findable in the output. |
+| 2 | "objection … 8 of its 10 uses in this corpus are pinning bypass" — reviewer counted **9** used tuples, not 10, and proposed "7 of its 9". | **First rejected, then ACCEPTED after reviewer 4 showed the rejection was wrong.** My rejection re-enumerated ''/objection/i'' **corpus-wide** and got 10 tuples / 8 pinning, and concluded the reviewer had miscounted. Reviewer 4 pointed out that one of the ten — ''CCS/2019/watching-you-watch-the-tracking-ecosystem…'', an OTT-streaming-device paper — **is not in ''appAnalysis''**, the population every other figure in that table is on. Within the page's own population it is **9 tuples, 7 with a pinning purpose** — exactly what reviewer 1 proposed. Rejecting a finding by silently switching denominators, on a page whose first methodology bullet is "every table names its own denominator", is the worst kind of error this log can contain, and it is recorded here rather than quietly corrected. | Page changed to "**7 of its 9 uses among the 529**"; the fold comment in ''mobile_fold.mjs'' updated; the enumeration below now carries the ''appAnalysis'' flag per row and is **computed by ''report_mobile.mjs''** rather than by an ad-hoc command, so the denominator cannot drift again. |
+| 3 | "8,606 of 1,098,479 apps targeting Android 7+ (8.67%)" is internally inconsistent — 8,606/1,098,479 = 0.78%; 8.67% is 8,606/99,212. | **Accepted**, and it is a good catch: the inconsistency is in {[oltrogge2021_mallory]}'s own sentence, and republishing it unexamined would have passed the ambiguity on. | Rewritten to give 8,606 as an absolute, state that the paper's 8.67% is of the 99,212 custom-NSC apps, and give 0.78% as the share of the 1,098,479. |
+| 4 | Provenance page said "**Four** entries are from outside the seven venues" above a table listing **five**. | **Accepted.** | Corrected to "Five of the 17 entries". |
+| 5 | The ''ethics.reviewOutcome'' and ''artifacts.availability'' rows were computed as ''529 − sentinelOnlyPapers'', which counts papers whose object is entirely absent as if they had stated something. | **Accepted** — and already fixed before the review landed (see §12); the reviewer derived 149/28.2% and 323/61.1% independently, which is a useful confirmation. | None outstanding. |
+| 6 | Provenance said absolute mobile counts are "roughly flat at 44–66 per year since 2019", but 2019 is **38**. | **Accepted.** | Corrected to 2020–2025, with 2019 = 38 and provisional 2026 = 24 named. |
+| 7 | Content page said "flat at 41–44% across every **four-year** window since 2010", but the eras span 6, 5, 4 and 2 years. | **Accepted.** | Reworded to "across all four era windows", with the four spans listed. |
+The enumeration is now printed by the report script (§13, "objection, enumerated"), with the ''appAnalysis'' membership of each row visible:
+<code>
+objection tuples in appAnalysis: 9 (7 with a pinning purpose); corpus-wide papers: 10
+  PIN  used   USENIX/2021/share-first-ask-later-...          Detect and disable SSL pinning
+  PIN  used   CCS/2022/freely-given-consent-...              Disabled SSL pinning in instrumented apps.
+  oth  used   USENIX/2022/breaking-bridgefy-again-...        Hooked functions and observed or modified app behavior.
+  PIN  used   USENIX/2023/the-ok-is-not-enough-...           Automated Android apps and disabled SSL checking.
+  PIN  used   PETS/2024/a-black-box-privacy-analysis-...     Disabled mobile-app SSL certificate checks.
+  PIN  used   USENIX/2024/abandon-all-hope-ye-who-enter-...  Detected and disabled SSL pinning.
+  oth  used   USENIX/2025/autovr-automated-ui-exploration    Repackage APKs containing the injected Frida server.
+  PIN  used   PETS/2025/the-impact-of-default-mobile-sdk-... Bypass SSL pinning on rooted Android.
+  PIN  used   PETS/2026/the-tcf-doesn-t-really-a-a-id-...    Disabled SSL pinning during traffic collection.
+</code>
+The tenth, corpus-wide, is ''CCS/2019/watching-you-watch-the-tracking-ecosystem…'' — ''appAnalysis = false''.
+==== Reviewer 2 — citations and quotes (''model: sonnet'') ====
+Independently re-derived every quoted figure from ''paper.cols.txt'' rather than trusting ''quotecheck_mobile-output.txt''; resolved all 11 DOIs against Crossref; re-fetched all six USENIX/NDSS author lists and the PoPETs one from the venue landing pages; duplicate-scanned the 17 new entries against the 488 live ones on four axes (key string, DOI, URL, and normalised title with a fuzzy threshold).
+^ Finding ^ Verdict ^ Action ^
+| 22 citekeys all resolve; no duplicate or colliding keys beyond the ''koch2023_enough'' one already removed; best fuzzy title match among the new entries topped out at 0.55. | Confirmation. | None. |
+| All 17 new entries' authors, titles, years, venues and DOIs match Crossref / the venue pages exactly. | Confirmation. | None. |
+| ~43 quoted figures across 13 papers re-derived independently; all correct and correctly attributed, including the three denominators most likely to be got wrong: the Popular/Random n=1,000 in {[pradeep2022_comparative]} being **per platform**, the 9,889-app IoT-VER set in {[schmidt2023_iotflow]} (not its 947-app comparison set), and the 42% in {[khandelwal2024_unpacking]} — which the reviewer notes is one of **three different 42% figures in that paper**, and the page picked the right one (the 15K most popular apps reporting no third-party sharing). | Confirmation, and the most valuable part of this review. | None. |
+| All seven footnoted external verbatim quotes match their source URLs exactly. | Confirmation. | None. |
+| **"40% changed it at least once across ten monthly snapshots"** — the paper's ten snapshots are 8 weekly plus 3 spread over later months, not monthly. | **Accepted.** A wording error, not a numeric one. | Changed to "across ten snapshots between June 2022 and May 2023". |
+| The ''pradeep2022_comparative'' weak-cipher result holds only for the **Common Android** dataset; the paper's general finding is that pinning apps have //better// cipher security. | **Confirmation of a deliberate choice.** The figure was in an early draft, was cut before publication precisely because it needed this scoping, and survives only on this provenance page (§7 exemplars) where it is correctly labelled "Common Android". The content page makes no cipher claim. | None. |
+==== Reviewer 3 — external currency (''model: sonnet'') ====
+items re-fetched independently, plus a dead-link sweep of every URL on the page. **This reviewer earned its slot: it found a systematic bug that had put nine wrong dates on the page, and it found the root cause pattern before I did.**
+**The bug.** The first currency pass read GitHub's ''releases.atom'' with
+<code>
+/<entry>.*?<title>(.*?)<\/title>.*?<updated>(.*?)<\/updated>/s
+</code>
+In that feed ''<updated>'' comes **before** ''<title>'' inside each ''<entry>'', so the regex paired entry //N//'s title with entry //N+1//'s date — every version number was printed alongside the **previous** release's date. Nine claims were wrong in exactly that way. Re-verified by splitting on ''</entry>'' and parsing each entry alone, now committed as ''scripts/mobile_tool_currency.sh'' with the bug documented in its header so it cannot recur:
+^ Claim ^ Was ^ Is ^
+| Soot 4.7.1 | 2026-02-13 | **2026-02-23** (2026-02-13 is 4.7.0) |
+| SootUp v3.0.1 | 2026-07-16 | **2026-08-07** (2026-07-16 is v3.0.0) |
+| FlowDroid 2.15.1 | 2026-02-19 | **2026-02-23** (2026-02-19 is 2.15.0) |
+| Apktool v3.0.3 | 2026-04-19 | **2026-07-20** (2026-04-19 is v3.0.2) |
+| jadx 1.5.6 | 2026-02-25 | **2026-07-10** (2026-02-25 is 1.5.5) |
+| MobSF v4.5.2 | 2026-07-06 | **2026-08-10** (2026-07-06 is v4.5.1) |
+| ipatool v2.3.2 | 2026-07-05 | **2026-08-03** (2026-07-05 is v2.3.1) |
+| palera1n v3.0.0 beta 2 | 2026-07-27 | **2026-08-03** (2026-07-27 is v2.4, a different track) |
+| **TrollStore 2.1.1** | 2024-09-02 | **2026-04-01** (2024-09-02 is 2.1) |
+TrollStore is the damaging one and the reviewer ranked it first correctly: the page had it looking like a tool coasting on old commits since 2024, when its current release shipped in April 2026. Verdict changed to "Actively released."
+^ Other finding ^ Verdict ^ Action ^
+| ''.../safetynet/attestation'' 301-redirects to ''.../safetynet/deprecation-timeline'', which carries the same sentence. | **Accepted.** | Footnote now cites the new canonical path and notes the redirect. |
+| ''.../support/dma-and-apps-in-the-eu/'' 301-redirects to ''.../support/apps-in-the-eu''. | **Accepted.** | Same. |
+| "page updated 18 August 2026" for the Apple DMA page is **unverifiable** — the page is a JS shell with no static date exposed to any automated fetch. | **Accepted.** The date came from a sub-agent's WebFetch summary, not from anything I could see myself. | Claim **deleted**. This is the second sub-agent claim on that page that did not survive re-fetching. |
+| ''reddr/LibRadar'' returns 404; ''pkumza/LibRadar'' is the sole canonical repo. | Confirmation — the page already cites ''pkumza''. | None. |
+| The Certificate Transparency conclusion ("a locally-installed interception root is not publicly trusted, so CT is not an additional barrier") is the page's **inference**, not a sentence Google states; Google's page never mentions user or local CAs at all. The reviewer judged the existing hedge ("on the documentation's own wording") to be doing the right job and recommended no change. | **Accepted as an inference, kept with the hedge.** Recorded here so a future reader knows it is a reading and not a quote — this remains the single weakest external claim on the page. | None. |
+| No maintained successor to LibRadar/LibScout exists; nothing has displaced Frida/objection for pinning bypass. | Confirmation of the page's own Open Question. | None. |
+| Every URL returns 200 or a benign redirect; no 404s. ''npmjs.com'' returns 403 to automation, so those two footnotes were confirmed via ''registry.npmjs.org'' instead. | Confirmation. | None. |
+| Xposed: the reviewer noted the //archive flag// was flipped 2023-06-01, while 2020-06-08 is ''pushed_at''. | **Accepted as imprecise.** The page said "archived 2020-06-08", conflating the two. | Rewritten as "archived; last release v89 (2017-12-17), last push 2020-06-08". |
+**One thing I found while re-verifying, which the reviewer did not raise:** LSPosed's ''pushed_at'' of 2026-08-26 — the basis for the page's original "Repository still active" — counts **any branch**. Its **default branch has not moved since 2024-01-07**. That is a materially stronger version of the reviewer's point, so the verdict was changed from "Repository still active, no release cut in nearly three years" to "**Stalled.** No release in nearly three years and no default-branch commit in over two", with the discrepancy explained in the footnote. The currency script now prints the default-branch date and carries a note about the two definitions.
+Also caught in the same pass: ''apkeep'' reads **2026-05-05** from ''releases.atom'' but **2026-04-30** from the API's ''published_at''. The tag page is authoritative, so the page keeps 2026-04-30 and the script prints a note about the divergence.
+==== Reviewer 4 — generic, no checklist (''model: fable'') ====
+Ran last, on the page as corrected by the other three. It re-derived contested figures itself and **computed two intersections the page had only inferred**, which is how it found the two worst remaining defects. Every finding was accepted; none was rejected.
+^ # ^ Finding ^ Action ^
+| 1 | **This log's one rejection was wrong.** The ''objection'' count was rejected using a corpus-wide denominator instead of ''appAnalysis''. | Reviewer 1's finding reinstated as **Accepted**; page now says 7 of 9; the enumeration is computed by the report script with the ''appAnalysis'' flag shown. See finding 2 above. |
+| 2 | **§8's "Verified" table still carried the nine pre-fix dates** that reviewer 3 had proved wrong, under a heading claiming verification — so this page contradicted the page it backs. Reviewer 4 named this as my own recorded failure mode ("a fix survives in the provenance log"). | All nine rows corrected in place with the new values in bold, plus a ''<WRAP important>'' at the head of §8 saying "'fetched, not recalled' was true; 'parsed correctly' was not". |
+| 3 | **§11's preamble said the generic reviewer "ran afterwards", three subsections above a "Not run."** | Preamble corrected; this subsection replaced. |
+| 4 | "every large Android study in the corpus uses AndroZoo, an unofficial scraper, or a mirror" is a **false universal** — of the 96 papers with a ≥100,000-app population, sources include vendor telemetry (NortonLifeLock, Palo Alto Networks), volunteer capture (Lumen) and inherited datasets (Drebin, Andrubis, the Gamba preinstalled-app set). | Rewritten with the five routes and the 96-paper computation, which ''report_mobile.mjs'' now prints with the full list of non-store sources. |
+| 5 | "most papers that intercepted traffic never wrote down what they could not intercept" was derived from **three unintersected probe counts** (110 / 71 / 33 / 13) that cannot support a claim about the 110. Reviewer 4 computed the intersection: of the 110, **44 mention pinning, 65 (59.1%) mention none of pinning, a bypass, or the NSC**. The claim survives, by 9 points, on evidence that was invalid as written. | The intersection is now computed by ''report_mobile.mjs'' over full text and the page publishes the four real numbers instead of the inference. **This is the single best catch of the four reviews**: the conclusion was right and the reasoning was not, which no number-checking pass would have found. |
+| 6 | §4's prose restated the guard's own accounting ("305 of 366 … 61 allowed") after the output had moved to 367 / 62. | Prose no longer restates it; it points at the output block and says why restating it is how it goes stale. |
+| 7 | Three small false statements: §9 claimed the content page "reports the per-year table" (it does not); §7 said "Two findings" above three bullets; §15 said "the one citekey" where there are four. | All three corrected. |
+| 8 | **No "What to Read First" section**, though ''design:longitudinal'' — the stated model — has one and "which papers to read first" is in the page's remit. The recommendations existed but were buried in mid-prose. | Section added near the top, five papers with the methodological reason for each, plus the two systematic reviews. |
+| 9 | **The page never says how to see iOS traffic**, and does not admit the gap: step 1 of the pinning section is entirely Android, the pipeline tip is Android-only without saying so, and the only iOS bypass tool named is marked unmaintained with no alternative. | A ''<WRAP info>'' now scopes steps 1–3 as Android and gives the iOS route (CA profile with full trust, then code injection on a jailbroken device), pointing at {[pradeep2022_comparative]} as the worked example. |
+| 10 | Three practitioner staples missing: **on-device VPN capture** (the no-root route, present in the fold residue and only mentioned on the page as a dead data source), **per-app traffic attribution** (a proxy sees the OS and Play Services too), and **QUIC** (bypasses a TCP proxy; 14 of 529 papers mention it). | New subsection "Three things that will bite you that no paper warns you about", with three new probes behind it. |
+| 11 | "the one the corpus's recent traffic-measurement papers converge on" overstates: of 191 papers since 2023, **16** use Frida+mitmproxy and **3** the full named stack. | Reworded to "built from the components recent papers most often combine", with both figures given and the convergence claim withdrawn. The report script now computes them. |
+| 12 | "PETS and NDSS are where a mobile privacy measurement most often lands" over-reads a two-point spread, ignores that USENIX (143) and CCS (106) dominate by volume, and calls ''appAnalysis'' "privacy measurement" when it includes malware and vulnerability work. | Both views now given, with the population caveat. |
+| 13 | The classification-target table's top row was ''other'' at 44.2% — a finding about the extraction schema, not the field. | Row cut. |
+| 14 | The page reported ''pre-existing-dataset'' at 17.8% but **named no dataset except AndroZoo**, failing its own "so they do not rebuild one" purpose. | New paragraph naming Drebin, Andrubis, the Gamba preinstalled-app set, Firmware Scanner, Koodous, VirusShare, AMD, PrivacyGrade and the Lumen captures, with a warning that a malware set is not a sample of apps users have and that a 2014 dataset is a claim about 2014. |
+| 15 | Two undocumented universals ("the only paper in the corpus", "Nobody has re-measured") and one overstatement ("needed an LLM … at all"). | All three scoped to "we found" / "in these seven venues" / "used". |
+| 16 | "Every percentage in that paper is over 3,654" is almost certainly false of a whole paper. | Changed to "Its app-level results are all over 3,654". |
+**Taste items accepted:** none changed. Reviewer 4 flagged the Android 16/17 footnote as dateable trivia, the acquisition-tool repeats in "Which Methods Are Current", and the venue paragraph's placement. The Android-version footnote stays because it is what dates the user-CA and CT claims around it; the repeats stay because the site convention (''design:longitudinal'') is that "Which Methods Are Current" is a self-contained dated summary; the venue paragraph stays where a newcomer will read it. All three are judgement calls a reasonable person would make differently.
+**One inherited discrepancy it found:** the header comment in ''mobile_fold.mjs'' said adb appears in 29 papers under its largest spelling while the generated table in section 5 says 28. The table is the authority; the comment had been written from an early ad-hoc query. Fixed at source rather than explained away.
+**Two things reviewer 4 checked and passed**, worth recording because they were the things most likely to be wrong: the denominator discipline held everywhere it traced, and the ''[[:Artifacts]]'' red links are a site-wide promised-but-missing page linked from 14 other pages, not a defect of this one.
-REVIEWLOG_PLACEHOLDER
 ===== 12. The run itself =====
@@ Line 497: / Line 617: @@
 | Corpus at the time | ''data/extract/run1'', 5,859 papers, 7 venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P), 2010–2026 |
 | Main agent | Claude (Opus 5) — all queries, the report script, the fold, the probes, the quote check, the page text, and independent re-verification of every external claim |
-| Sub-agents | one ''sonnet'' external-currency sweep (which itself fanned out to seven sub-agents); four ''sonnet''/''fable'' reviewers (§11) |
+| Sub-agents | one ''sonnet'' external-currency sweep (which itself fanned out to seven sub-agents, and whose four wrong claims are in §8); three ''sonnet'' reviewers spawned, **all three returned**; the ''fable'' generic pass was not run (§11) |
 | Write path | ''node scripts/dw.mjs put'' over JSON-RPC, with ''--if-rev'' on every save |
 | Stability figures | the ~20% free-text agreement and 0.9% unlocatable-quote figures quoted from ''data/extract/README.md'' were measured on the **older, smaller corpus** and have not been re-measured. Treated as the right order of magnitude. |
@@ Line 636: / Line 756: @@
 libimobiledevice        9      0 (0.0%)    2 (1.3%)    5 (2.6%)    2 (2.2%)
 Fiddler                 8      1 (1.1%)    2 (1.3%)    5 (2.6%)    0 (0.0%)
+WALA                    7      3 (3.4%)    2 (1.3%)    2 (1.0%)    0 (0.0%)
+TaintDroid              7      6 (6.8%)    1 (0.6%)    0 (0.0%)    0 (0.0%)
+AndroZoo                7      0 (0.0%)    2 (1.3%)    1 (0.5%)    4 (4.4%)
+MobSF                   7      0 (0.0%)    1 (0.6%)    4 (2.1%)    2 (2.2%)
+AndroidViewClient       6      0 (0.0%)    3 (1.9%)    2 (1.0%)    1 (1.1%)
+jailbreak tool          5      0 (0.0%)    0 (0.0%)    2 (1.0%)    3 (3.3%)
+monkeyrunner            3      2 (2.3%)    1 (0.6%)    0 (0.0%)    0 (0.0%)
+Accessibility Service   3      0 (0.0%)    1 (0.6%)    1 (0.5%)    1 (1.1%)
+RERAN                   3      0 (0.0%)    0 (0.0%)    3 (1.5%)    0 (0.0%)
+Charles Proxy           2      0 (0.0%)    0 (0.0%)    1 (0.5%)    1 (1.1%)
 --- unfolded top names, for comparison with the folded table above
@@ Line 695: / Line 825: @@
 UI exploration AND traffic interception: 30 (5.7% of 529) — the "drive it and watch the wire" pipeline
+--- of the papers that intercepted traffic, how many mention pinning at all
+(placeholder — see the traffic-group block below; 'both' here is static AND traffic, not the traffic group)
+traffic-interception papers: 110 (full text read for 110)
+  mention pinning:                44 (40.0%)
+  describe bypassing pinning:     22 (20.0%)
+  mention the NSC:                6 (5.5%)
+  mention NONE of the three:      65 (59.1%)  <-- the page's claim rests on this
+--- the large-population sources, and the modern-pipeline co-occurrence — both quoted on the page
+appAnalysis papers with a >=100,000-app population: 96
+  distinct sourceList values among them: 52; of those, 30 are neither a store nor AndroZoo:
+    AndroidRank
+    AndroidZoo
+    Andrubis dataset
+    Antiy AVL
+    App installation logs
+    Baidu market
+    Drebin dataset
+    Firmware Scanner
+    Gamba et al. preinstalled-app dataset / Firmware Scanner
+    Janus Dataset
+    Koodous
+    Lumen users
+    NortonLifeLock's mobile security product
+    Palo Alto Networks
+    Palo Alto Networks newer APK testing sample
+    PrivacyGrade
+    SamMobile
+    VirusShare, VirusTotal, and the AMD dataset
+    VirusTotal
+    Wandoujia marketplace
+    Wang et al. [116]
+    WeChat third-party miniapps
+    anti-virus vendor telemetry program
+    custom app-market collection over 30 markets
+    custom instrumented SDK deployment
+    custom mini-app collection across six super-app platforms
+    mobile app activity data collected by the security company's product
+    not-stated
+    publicly available stock Android firmware images
+    same initial dataset from AndroidRank
+appAnalysis papers since 2023: 191
+  Frida AND mitmproxy:            16 (8.4%)
+  Frida AND mitmproxy AND Magisk: 3 (1.6%)  <-- the page does NOT claim the field converged on this
+--- objection, enumerated — the page quotes this ratio, so it is computed here
+objection tuples in appAnalysis: 9 (7 with a pinning purpose); corpus-wide papers: 10
+  PIN  used   USENIX/2021/share-first-ask-later-or-never-studying-violations-of-gdprs-explicit-consent-in  Detect and disable SSL pinning
+  PIN  used   CCS/2022/freely-given-consent-studying-consent-notice-of-third-party-tracking-and-its-vio  Disabled SSL pinning in instrumented apps.
+  oth  used   USENIX/2022/breaking-bridgefy-again-adopting-libsignal-is-not-enough  Hooked functions and observed or modified app behavior.
+  PIN  used   USENIX/2023/the-ok-is-not-enough-a-large-scale-study-of-consent-dialogs-in-smartphone-applic  Automated Android apps and disabled SSL checking.
+  PIN  used   PETS/2024/a-black-box-privacy-analysis-of-messaging-service-providers-chat-message-process  Disabled mobile-app SSL certificate checks.
+  PIN  used   USENIX/2024/abandon-all-hope-ye-who-enter-here-a-dynamic-longitudinal-investigation-of-andro  Detected and disabled SSL pinning.
+  oth  used   USENIX/2025/autovr-automated-ui-exploration-for-detecting-sensitive-data-flow-exposures-in-v  Repackage APKs containing the injected Frida server.
+  PIN  used   PETS/2025/the-impact-of-default-mobile-sdk-usage-on-privacy-and-data-protection  Bypass SSL pinning on rooted Android.
+  PIN  used   PETS/2026/the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of  Disabled SSL pinning during traffic collection.
 ==============================================================================
@@ Line 1722: / Line 1910: @@
 </file>
-===== 14. Conventions followed on this page =====
+===== 14. External tool currency, unedited =====
+Output of ''sh scripts/mobile_tool_currency.sh''. Every version and date in the page's four tool-currency tables comes from here.
+<file - mobile_tool_currency-output.txt>
+repo                                           latest release                     last commit
+----                                           --------------                     -----------
+frida/frida                                    Frida 17.17.0 @ 2026-08-05         2026-08-18
+sensepost/objection                            1.12.5 @ 2026-06-02                2026-07-23
+rovo89/Xposed                                  v89 @ 2017-12-17                   2017-12-17
+LSPosed/LSPosed                                1.9.2 @ 2023-10-11                 2024-01-07
+topjohnwu/Magisk                               Magisk v30.7 @ 2026-02-23          2026-08-27
+Fuzion24/JustTrustMe                           v.2 @ 2016-01-26                   2024-09-02
+nabla-c0d3/ssl-kill-switch2                    0.14 @ 2019-12-03                  2021-03-28
+ViRb3/TrustMeAlready                           Release v1.11 @ 2019-03-11         2019-09-23
+soot-oss/soot                                  4.7.1 @ 2026-02-23                 2026-08-17
+soot-oss/SootUp                                v3.0.1 @ 2026-08-07                2026-08-24
+secure-software-engineering/FlowDroid          FlowDroid 2.15.1 @ 2026-02-23      2026-08-18
+iBotPeaches/Apktool                            v3.0.3 @ 2026-07-20                2026-08-24
+skylot/jadx                                    1.5.6 @ 2026-07-10                 2026-08-19
+MobSF/Mobile-Security-Framework-MobSF          v4.5.2 @ 2026-08-10                2026-08-21
+rednaga/APKiD                                  v3.1.0 - "AbhiTheModder" edition @ 2026-04-09 2026-07-27
+pkumza/LibRadar                                1.5.0 @ 2017-06-15                 2018-12-21
+reddr/LibScout                                 Cleanup of local deps @ 2019-01-30 2019-10-25
+EFForg/apkeep                                  apkeep v1.0.0 @ 2026-05-05         2026-05-04
+matlink/gplaycli                               3.29 @ 2020-03-10                  2021-10-02
+ClaudiuGeorgiu/PlaystoreDownloader             PlaystoreDownloader 2.0 alpha @ 2022-01-08 2024-07-27
+facundoolano/google-play-scraper               v10.1.2 @ 2025-11-10               2026-07-18
+JoMingyu/google-play-scraper                   no releases                        2024-06-07
+majd/ipatool                                   v2.3.2 @ 2026-08-03                2026-08-03
+AloneMonkey/frida-ios-dump                     no releases                        2020-06-01
+opa334/TrollStore                              2.1.1 @ 2026-04-01                 2026-04-01
+palera1n/palera1n                              v3.0.0 beta 2 @ 2026-08-03         2026-07-27
+opa334/Dopamine                                3.0.9 @ 2026-08-22                 2026-08-22
+--- package registries
+npm  google-play-scraper          10.1.3 @ 2026-05-31
+npm  appium                       3.7.0 @ 2026-08-24
+PyPI google-play-scraper          1.2.7 @ 2024-06-07
+PyPI androguard                   4.1.4 @ 2026-06-01
+--- NOTE: releases.atom <updated> is not always the release publication date.
+    apkeep reads 2026-05-05 here but the GitHub API published_at is 2026-04-30;
+    the API/tag page is authoritative and the page uses 2026-04-30.
+--- NOTE: the commits column is the DEFAULT BRANCH only. The GitHub API pushed_at
+    counts any branch, which is why LSPosed reads 2024-01-07 here and 2026-08-26
+    from the API. The page cites the default-branch date, which is the stricter one.
+</file>
+===== 15. Conventions followed on this page =====
 ^ Item ^ Value ^
 | Discussion block | **None**, following the convention set by the other ''provenance:'' pages — comments belong on the content page. |
-| Reference list | **None.** There is no %%<bibtex bibliography>%% block, so the one citekey here renders as a marker without a reference list; that is the existing convention on ''provenance:'' pages, not an omission. This page adds no bibliography entries of its own. |
+| Reference list | **None.** There is no %%<bibtex bibliography>%% block, so the four citekeys here render as markers without a reference list; that is the existing convention on ''provenance:'' pages, not an omission. This page adds no bibliography entries of its own. |
 | Naming | mirrors the content page id under ''provenance:'', unchanged, so the mapping needs no lookup and ''sitemap.mjs'' groups it with the other provenance pages. |
 | Reachability | linked from the content page's //Methodology and limitations of these figures// section; links back below. |