provenance:practices:notifying_websites
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| provenance:practices:notifying_websites [2026/08/13 20:08] – Publish the full 144-entry unreviewed residue (the earlier list was silently truncated to 135 by a shell pipeline) and record that. Authored by Claude karel.kubicek.claude | provenance:practices:notifying_websites [2026/09/17 07:23] (current) – Markup rendering sweep: wrap escapes, CLI flag typography, and heading quotes. Authored by Claude. karel.kubicek.claude | ||
|---|---|---|---|
| Line 5: | Line 5: | ||
| Not prose. Read it if you are checking a number. | Not prose. Read it if you are checking a number. | ||
| - | <wrap todo> | + | <WRAP todo> |
| ===== The run ===== | ===== The run ===== | ||
| ^ Field ^ Value ^ | ^ Field ^ Value ^ | ||
| - | | Date | 2026-08-13 | | + | | Date | 2026-08-13 |
| - | | Page status | **new page**. '' | + | | Page status | **new page**. '' |
| | Corpus at the time | '' | | Corpus at the time | '' | ||
| - | | Scripts written | '' | + | | Scripts written | '' |
| - | | Models | Orchestration, all corpus queries, the fold classification, | + | | Models | 2026-08-13: orchestration, all corpus queries, the fold classification, |
| - | | Sub-agent outputs kept | '' | + | | Sub-agent outputs kept | '' |
| | Corrections caught in review | listed under //Reviewer findings// | | | Corrections caught in review | listed under //Reviewer findings// | | ||
| ===== Scope decision ===== | ===== Scope decision ===== | ||
| - | The item as specified pointed at '' | + | The item as specified pointed at '' |
| * **Scope excludes one-off coordinated disclosure to a named vendor.** That is a queue with an SLA and nothing on this page would help. The page says so in its second paragraph. The consequence is that a large share of the 1,636 '' | * **Scope excludes one-off coordinated disclosure to a named vendor.** That is a queue with an SLA and nothing on this page would help. The page says so in its second paragraph. The consequence is that a large share of the 1,636 '' | ||
| - | * **Scope includes network-scanning campaigns, not only web ones.** The page is titled " | + | * **Scope includes network-scanning campaigns, not only web ones.** The page is titled " |
| * **Not broadening a neighbour.** [[Practices: | * **Not broadening a neighbour.** [[Practices: | ||
| Line 48: | Line 48: | ||
| ===== Report script and its unedited output ===== | ===== Report script and its unedited output ===== | ||
| - | Run as '' | + | Run as '' |
| - | <wrap todo>'' | + | <WRAP todo>'' |
| Sections of the script, so a figure on the content page can be traced to the block that produced it: | Sections of the script, so a figure on the content page can be traced to the block that produced it: | ||
| Line 58: | Line 58: | ||
| * **C** — '' | * **C** — '' | ||
| * **D** — '' | * **D** — '' | ||
| - | * **E** — full-text candidate scan, hand classification, | + | * **E** — full-text candidate scan (narrow rule and, since 2026-09-04, the wide recall probe), hand classification, |
| - | * **F** — ('' | + | * **F** — ('' |
| < | < | ||
| Line 115: | Line 115: | ||
| of the 376 that assessed a law: yes 27 (7.2%) | of the 376 that assessed a law: yes 27 (7.2%) | ||
| + | |||
| + | of the 2160 that notified an affected party, 135 also contacted a regulator or CERT (6.3%) | ||
| + | of the 147 that contacted a regulator or CERT, 135 ALSO notified the affected party directly (91.8%) — the intermediary is an addition, not a substitute | ||
| -- ethics.harmMitigation: | -- ethics.harmMitigation: | ||
| Line 196: | Line 199: | ||
| E. NOTIFICATION CAMPAIGNS IN THE FULL TEXT (hand-classified) | E. NOTIFICATION CAMPAIGNS IN THE FULL TEXT (hand-classified) | ||
| ========================================================================== | ========================================================================== | ||
| - | Stage | + | Stage |
| - | ------------------------------------------------------ | + | ---------------------------------------------------------------------------------------- |
| - | paper.cols.txt files read | + | paper.cols.txt files read |
| - | candidates (notify ∧ outcome ∧ number in one sentence) | + | NARROW rule: notify ∧ outcome ∧ number in one sentence |
| - | hand-classified as a campaign | + | |
| - | hand-classified and rejected, with a reason | + | |
| - | UNREVIEWED residue — matched, nobody read the paper 144 | + | |
| + | WIDE probe only: wider outcome/ | ||
| + | → hand-classified as a campaign | ||
| + | → hand-classified and rejected, with a reason | ||
| + | → UNREVIEWED residue | ||
| + | campaigns in total (CAMPAIGNS) | ||
| - | sanity: campaigns | + | sanity: campaigns caught by neither rule (found by a topical full-text grep, see notify_fold.mjs caught:' |
| - | rejected slugs not caught by the regex: 3 — how-website-owners-face-privacy-issues-thematic-analysis-of-responses-from-a-cov, | + | |
| + | REJECTED slugs caught by neither rule: 3 — how-website-owners-face-privacy-issues-thematic-analysis-of-responses-from-a-cov, | ||
| + | REJECTED_PROBE slugs caught by neither rule: 0 | ||
| - | -- campaigns by decade-ish bucket, of 22 hand-classified -- | + | -- campaigns by four-year bucket, of 32 hand-classified -- |
| Bucket | Bucket | ||
| ---------- | ---------- | ||
| 2010–2013 | 2010–2013 | ||
| - | 2014–2017 | + | 2014–2017 |
| - | 2018–2021 | + | 2018–2021 |
| - | 2022–2024 | + | 2022–2024 |
| - | 2025–2026* | + | 2025–2026* |
| - | What was notified | + | Who was notified |
| - | ----------------------- | + | ----------------------------------------------------------------------------------- |
| - | network | + | network |
| - | web 10 | + | web 13 |
| - | mobile | + | apps 6 |
| </ | </ | ||
| - | Two of the four figures in '' | + | Two of the seven '' |
| ===== Folding: rules and residue ===== | ===== Folding: rules and residue ===== | ||
| Line 228: | Line 238: | ||
| Free-text fields agree run-to-run on roughly 20% of exact strings, so nothing here is aggregated by exact string. Three folds were written, in '' | Free-text fields agree run-to-run on roughly 20% of exact strings, so nothing here is aggregated by exact string. Three folds were written, in '' | ||
| - | ==== 1. '' | + | ==== 1. ethics.disclosureDetail → channel families ==== |
| Nine regex families, **not mutually exclusive** (a paper that told a CERT and the vendor belongs in both; papers counted once per family). Published on the content page as a ranking, never as adoption rates. | Nine regex families, **not mutually exclusive** (a paper that told a CERT and the vendor belongs in both; papers counted once per family). Published on the content page as a ranking, never as adoption rates. | ||
| Line 234: | Line 244: | ||
| * **Scoped to the right population, after a post-review check.** The first version reported the channel fold over all 2,870 papers with a '' | * **Scoped to the right population, after a post-review check.** The first version reported the channel fold over all 2,870 papers with a '' | ||
| * The residue is still the headline: three quarters of the papers that say they notified do not say through what. That is not a fold failure, it is the field' | * The residue is still the headline: three quarters of the papers that say they notified do not say through what. That is not a fold failure, it is the field' | ||
| + | * **Two claims on the content page about this fold were checked directly against the JSONL rather than taken from the script.** (a) "all 2,160 that said they notified are among them": of the 2,160 '' | ||
| * The largest matched family, "a named large platform or app store", | * The largest matched family, "a named large platform or app store", | ||
| * '' | * '' | ||
| - | ==== 2. '' | + | ==== 2. ethics.disclosureDetail → outcome families ==== |
| Five families, non-exclusive. Residue 2,155 of 2,870 (75.1%), published above. Not used on the content page except as the 75.1% figure. | Five families, non-exclusive. Residue 2,155 of 2,870 (75.1%), published above. Not used on the content page except as the 75.1% figure. | ||
| - | ==== 3. '' | + | ==== 3. ethics.harmMitigation → families ==== |
| - | Eleven families, non-exclusive. **Residue 1,069 of 3,186 (33.6%).** This fold is **diagnostic only — no folded harm-mitigation figure appears on the content page**; the page uses only the non-null count (71.2%) and its per-bucket trend, neither of which depends on the fold. The residue is therefore recorded here by shape rather than in full, and prints with '' | + | Eleven families, non-exclusive. **Residue 1,069 of 3,186 (33.6%).** This fold is **diagnostic only — no folded harm-mitigation figure appears on the content page**; the page uses only the non-null count (71.2%) and its per-bucket trend, neither of which depends on the fold. The residue is therefore recorded here by shape rather than in full, and prints with '' |
| Shape of the 1,069, read from the first ~60 entries and a shuffled sample of 45: almost entirely **study-specific harm limitation with no generalisable family** — "Used a wired testbed and 900-MHz transmitter to minimize GPS interference", | Shape of the 1,069, read from the first ~60 entries and a shuffled sample of 45: almost entirely **study-specific harm limitation with no generalisable family** — "Used a wired testbed and 900-MHz transmitter to minimize GPS interference", | ||
| - | ==== 4. The campaign classification ('' | + | ==== 4. The campaign classification (scripts/ |
| The one fold that is a hand list rather than a regex family list, and the reason is in the file: the corpus signal for "the authors ran a campaign" | The one fold that is a hand list rather than a regex family list, and the reason is in the file: the corpus signal for "the authors ran a campaign" | ||
| Line 257: | Line 268: | ||
| * '' | * '' | ||
| - | Result over 5,869 files: **179 candidates → 22 campaigns, 16 rejected with a reason, 144 unreviewed.** | + | Result over 5,869 files on 2026-08-13: **179 candidates → 22 campaigns, 16 rejected with a reason, 144 unreviewed.** |
| Inclusion threshold, applied by hand: the authors notified parties they did not already know, at a scale where the contact had to be looked up, //and// reported a delivery, response or remediation outcome. Rough scale floor ≥100 parties, which is why PETS 2022's 40-organisation SAR re-test is in the rejected list and quoted only in prose. | Inclusion threshold, applied by hand: the authors notified parties they did not already know, at a scale where the contact had to be looked up, //and// reported a delivery, response or remediation outcome. Rough scale floor ≥100 parties, which is why PETS 2022's 40-organisation SAR re-test is in the rejected list and quoted only in prose. | ||
| - | An earlier, wider first-pass scan (a looser regex, 197 candidates) was used to seed the hand list; the script reports that **0 campaigns and 3 rejections fall outside | + | An earlier, wider first-pass scan (a looser regex, 197 candidates) was used to seed the 2026-08-13 |
| **Rejections, | **Rejections, | ||
| Line 283: | Line 294: | ||
| | '' | | '' | ||
| - | **The six campaigns not on the content page's rates table**, because they report a volume sent but no response or remediation figure: '' | + | **The six campaigns not on the content page's rates table**, because they report a volume sent but no response or remediation figure: '' |
| - | So the rates table has **17 rows: 16 of the 22 hand-classified campaigns, plus {[stock2018_didnt]}**, | + | So the rates table has **27 rows: 26 of the 32 hand-classified campaigns, plus {[stock2018_didnt]}**, |
| - | ==== The 144 unreviewed | + | ==== The 144 candidates |
| - | Matched the candidate | + | How they were read. '' |
| + | |||
| + | Inclusion rule, unchanged from 2026-08-13: the authors notified parties they did not already know, at a scale where the contact had to be looked up (roughly ≥100 parties), and reported | ||
| + | |||
| + | Rejections that a looser rule would have counted: '' | ||
| < | < | ||
| - | IMC 2010 internet-background-radiation-revisited | + | # Classification |
| - | IMC 2010 selecting-representative-ip-addresses-for-internet-topology-studies | + | # PROMOTED (6) |
| - | CCS 2012 before-we-knew-it-an-empirical-study-of-zero-day-attacks-in-the-real-world | + | seeking-nonsense-looking-for-trouble-efficient-promotional-infection-detection-t |
| - | NDSS 2013 when-firmware-modifications-attack-a-case-study-of-embedded-exploitation | + | are-we-there-yet-on-rpki-s-deployment-and-security |
| - | USENIX 2013 an-empirical-study-of-vulnerability-rewards-programs | + | complex-security-policy-a-longitudinal-analysis-of-deployed-content-security-policies |
| - | WWW 2013 two-years-of-short-urls-internet-measurement-security-threats-and-countermeasure | + | measuring-alexa-skill-privacy-practices-across-three-years |
| - | USENIX 2014 a-look-at-targeted-attacks-through-the-lense-of-an-ngo | + | are-you-spying-on-me-large-scale-analysis-on-iot-data-exposure-through-companion |
| - | USENIX 2014 brahmastra-driving-apps-to-test-the-security-of-third-party-components | + | are-we-getting-well-informed-an-in-depth-study-of-runtime-privacy-notice-practic |
| - | IEEE-SP 2015 the-attack-of-the-clones-a-study-of-the-impact-of-shared-code-on-vulnerability-p | + | |
| - | NDSS 2015 checking-more-and-alerting-less-detecting-privacy-leakages-via-enhanced-data-flo | + | |
| - | PETS 2015 portrait-of-a-privacy-invasion | + | |
| - | IEEE-SP 2016 seeking-nonsense-looking-for-trouble-efficient-promotional-infection-detection-t | + | |
| - | IEEE-SP 2016 talos-neutralizing-vulnerabilities-with-security-workarounds-for-rapid-response | + | |
| - | IMC 2016 weak-keys-remain-widespread-in-network-devices | + | |
| - | PETS 2016 towards-mining-latent-client-identifiers-from-network-traffic | + | |
| - | IMC 2017 if-you-are-not-paying-for-it-you-are-the-product-how-much-do-advertisers-pay-to | + | |
| - | NDSS 2017 are-we-there-yet-on-rpki-s-deployment-and-security | + | |
| - | PETS 2017 wiretapping-end-to-end-encrypted-voip-calls-real-world-attacks-on-zrtp | + | |
| - | USENIX 2018 from-patching-delays-to-infection-symptoms-using-risk-profiles-for-an-early-disc | + | |
| - | USENIX 2018 wpse-fortifying-web-protocols-via-browser-side-security-monitoring | + | |
| - | CCS 2019 a-usability-evaluation-of-lets-encrypt-and-certbot-usable-security-done-right | + | |
| - | NDSS 2019 automating-patching-of-vulnerable-open-source-software-versions-in-application-binaries | + | |
| - | NDSS 2019 digital-healthcare-associated-infection-a-case-study-on-the-security-of-a-major-multi-campus-hospital-system | + | |
| - | NDSS 2019 we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy | + | |
| - | PETS 2019 accessileaks-investigating-privacy-leaks-exposed-by-the-android-accessibility-se | + | |
| - | USENIX 2019 50-ways-to-leak-your-data-an-exploration-of-apps-circumvention-of-the-android-pe | + | |
| - | USENIX 2019 evaluating-the-contextual-integrity-of-privacy-regulation-parents-iot-toy-privac | + | |
| - | USENIX 2019 the-betrayal-at-cloud-city-an-empirical-analysis-of-cloud-based-mobile-backends | + | |
| - | WWW 2019 studying-preferences-and-concerns-about-information-disclosure-in-email-notifica | + | |
| - | CCS 2020 dangerous-skills-got-certified-measuring-the-trustworthiness-of-skill-certificat | + | |
| - | IEEE-SP 2020 a-security-analysis-of-the-facebook-ad-library | + | |
| - | IEEE-SP 2020 the-many-kinds-of-creepware-used-for-interpersonal-attacks | + | |
| - | IMC 2020 behind-closed-doors-a-network-tale-of-spoofing-intrusion-and-false-dns-security | + | |
| - | NDSS 2020 broken-metre-attacking-resource-metering-in-evm | + | |
| - | NDSS 2020 complex-security-policy-a-longitudinal-analysis-of-deployed-content-security-policies | + | |
| - | PETS 2020 the-price-is-not-right-comparing-privacy-in-free-and-paid-apps | + | |
| - | USENIX 2020 actions-speak-louder-than-words-entity-sensitive-privacy-policy-and-data-flow-an | + | |
| - | USENIX 2020 cached-and-confused-web-cache-deception-in-the-wild | + | |
| - | USENIX 2020 plug-n-pwned-comprehensive-vulnerability-analysis-of-obd-ii-dongles-as-a-new-ove | + | |
| - | WWW 2020 an-empirical-study-of-the-use-of-integrity-verification-mechanisms-for-web-subre | + | |
| - | CCS 2021 i-need-a-better-description-an-investigation-into-user-expectations-for-differen | + | |
| - | IEEE-SP 2021 sok-quantifying-cyber-risk | + | |
| - | NDSS 2021 all-the-numbers-are-us-large-scale-abuse-of-contact-discovery-in-mobile-messengers | + | |
| - | NDSS 2021 shadow-attacks-hiding-and-replacing-content-in-signed-pdfs | + | |
| - | PETS 2021 defining-privacy-how-users-interpret-technical-terms-in-privacy-policies | + | |
| - | PETS 2021 digital-inequality-through-the-lens-of-self-disclosure | + | |
| - | USENIX 2021 a-large-scale-interview-study-on-information-security-in-and-attacks-against-sma | + | |
| - | USENIX 2021 injection-attacks-reloaded-tunnelling-malicious-payloads-over-dns | + | |
| - | USENIX 2021 now-im-a-bit-angry-individuals-awareness-perception-and-responses-to-data-breach | + | |
| - | CCS 2022 clues-in-tweets-twitter-guided-discovery-and-analysis-of-sms-spam | + | |
| - | IEEE-SP 2022 timing-based-browsing-privacy-vulnerabilities-via-site-isolation | + | |
| - | IMC 2022 characterizing-permanently-dead-links-on-wikipedia | + | |
| - | IMC 2022 mind-your-manrs-measuring-the-manrs-ecosystem | + | |
| - | NDSS 2022 auto-draft-219 | + | |
| - | PETS 2022 developers-say-the-darnedest-things-privacy-compliance-processes-followed-by-dev | + | |
| - | PETS 2022 exploring-the-privacy-concerns-of-bystanders-in-smart-homes-from-the-perspective | + | |
| - | PETS 2022 we-may-share-the-number-of-diaper-changes-a-privacy-and-security-analysis-of-mob | + | |
| - | USENIX 2022 movery-a-precise-approach-for-modified-vulnerable-code-clone-discovery-from-modi | + | |
| - | WWW 2022 measuring-alexa-skill-privacy-practices-across-three-years | + | |
| - | WWW 2022 understanding-the-practice-of-security-patch-management-across-multiple-branches | + | |
| - | CCS 2023 dont-leak-your-keys-understanding-measuring-and-exploiting-the-appsecret-leaks-i | + | |
| - | CCS 2023 passive-ssh-key-compromise-via-lattices | + | |
| - | IEEE-SP 2023 no-one-drinks-from-the-firehose-how-organizations-filter-and-prioritize-vulnerab | + | |
| - | IEEE-SP 2023 no-privacy-in-the-electronics-repair-industry | + | |
| - | IEEE-SP 2023 three-birds-with-one-stone-efficient-partitioning-attacks-on-interdependent-cryp | + | |
| - | IEEE-SP 2023 utopia-automatic-generation-of-fuzz-driver-using-unit-tests | + | |
| - | IMC 2023 a-longitudinal-study-of-vulnerable-client-side-resources-and-web-developers-upda | + | |
| - | IMC 2023 rovista-measuring-and-analyzing-the-route-origin-validation-rov-in-rpki | + | |
| - | IMC 2023 wolf-in-sheeps-clothing-evaluating-security-risks-of-the-undelegated-record-on-d | + | |
| - | PETS 2023 investigating-how-users-imagine-their-personal-privacy-assistant | + | |
| - | PETS 2023 lessons-in-vcr-repair-compliance-of-android-app-developers-with-the-california-c | + | |
| - | PETS 2023 on-the-role-and-form-of-personal-information-disclosure-in-cyberbullying-inciden | + | |
| - | PETS 2023 privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part | + | |
| - | PETS 2023 revoked-just-now-users-behaviors-toward-fitness-data-sharing-with-third-party-ap | + | |
| - | USENIX 2023 a-bugs-life-analyzing-the-lifecycle-and-mitigation-process-of-content-security-p | + | |
| - | USENIX 2023 all-of-them-claim-to-be-the-best-multi-perspective-study-of-vpn-users-and-vpn-pr | + | |
| - | USENIX 2023 arana-discovering-and-characterizing-password-guessing-attacks-in-practice | + | |
| - | USENIX 2023 are-you-spying-on-me-large-scale-analysis-on-iot-data-exposure-through-companion | + | |
| - | USENIX 2023 downgrading-dnssec-how-to-exploit-crypto-agility-for-hijacking-signed-zones | + | |
| - | USENIX 2023 internet-service-providers-and-individuals-attitudes-barriers-and-incentives-to | + | |
| - | USENIX 2023 my-privacy-for-their-security-employees-privacy-perspectives-and-expectations-wh | + | |
| - | USENIX 2023 panda-security-analysis-of-algorand-smart-contracts | + | |
| - | USENIX 2023 pushed-by-accident-a-mixed-methods-study-on-strategies-of-handling-secret-inform | + | |
| - | USENIX 2023 whip-improving-static-vulnerability-detection-in-web-application-by-forcing-tool | + | |
| - | CCS 2024 airgapagent-protecting-privacy-conscious-conversational-agents | + | |
| - | CCS 2024 are-we-getting-well-informed-an-in-depth-study-of-runtime-privacy-notice-practic | + | |
| - | CCS 2024 defying-the-odds-solanas-unexpected-resilience-in-spite-of-the-security-challeng | + | |
| - | IEEE-SP 2024 breach-extraction-attacks-exposing-and-addressing-the-leakage-in-second-generati | + | |
| - | IEEE-SP 2024 from-virtual-touch-to-tesla-command-unlocking-unauthenticated-control-chains-fro | + | |
| - | IEEE-SP 2024 shedding-light-on-cvss-scoring-inconsistencies-a-user-centric-study-on-evaluatin | + | |
| - | IEEE-SP 2024 sok-sgx-fail-how-stuff-gets-exposed | + | |
| - | IEEE-SP 2024 tabbed-out-subverting-the-android-custom-tab-security-model | + | |
| - | NDSS 2024 dont-interrupt-me-a-large-scale-study-of-on-device-permission-prompt-quieting-in-chrome | + | |
| - | NDSS 2024 understanding-the-implementation-and-security-implications-of-protective-dns-services | + | |
| - | PETS 2024 exploring-the-privacy-experiences-of-closeted-users-of-online-dating-services-in | + | |
| - | PETS 2024 security-and-privacy-with-second-hand-storage-devices-a-user-centric-perspective | + | |
| - | PETS 2024 the-medium-is-the-message-how-secure-messaging-apps-leak-sensitive-data-to-push | + | |
| - | USENIX 2024 diffie-hellman-picture-show-key-exchange-stories-from-commercial-vowifi-deployme | + | |
| - | USENIX 2024 digital-discrimination-of-users-in-sanctioned-states-the-case-of-the-cuba-embarg | + | |
| - | USENIX 2024 globalconfusion-trustzone-trusted-application-0-days-by-design | + | |
| - | USENIX 2024 malla-demystifying-real-world-large-language-model-integrated-malicious-services | + | |
| - | USENIX 2024 rethinking-the-security-threats-of-stale-dns-glue-records | + | |
| - | USENIX 2024 spf-beyond-the-standard-management-and-operational-challenges-in-practice-and-pr | + | |
| - | USENIX 2024 towards-more-practical-threat-models-in-artificial-intelligence-security | + | |
| - | USENIX 2024 unpacking-privacy-labels-a-measurement-and-developer-perspective-on-googles-data | + | |
| - | WWW 2024 unfiltered-measuring-cloud-based-email-filtering-bypasses | + | |
| - | CCS 2025 a-decade-long-landscape-of-advanced-persistent-threats-longitudinal-analysis-and | + | |
| - | CCS 2025 is-this-a-scam-the-nature-and-quality-of-reddit-discussion-about-scams | + | |
| - | IEEE-SP 2025 gptracker-a-large-scale-measurement-of-misused-gpts | + | |
| - | IEEE-SP 2025 sniffing-location-privacy-of-video-conference-users-using-free-audio-channels | + | |
| - | NDSS 2025 hitchhiking-vaccine-enhancing-botnet-remediation-with-remote-code-deployment-reuse | + | |
| - | NDSS 2025 was-this-you-investigating-the-design-considerations-for-suspicious-login-notifications | + | |
| - | NDSS 2025 who-is-trying-to-access-my-account-exploring-user-perceptions-and-reactions-to-risk-based-authentication-notifications | + | |
| - | PETS 2025 ai-is-from-the-devil-behaviors-and-concerns-toward-personal-data-sharing-with-ll | + | |
| - | PETS 2025 how-unique-is-whose-web-browser-the-role-of-demographics-in-browser-fingerprinti | + | |
| - | PETS 2025 privacy-perceptions-and-behaviors-towards-targeted-advertising-on-social-media-a | + | |
| - | PETS 2025 the-effect-of-platform-policies-on-app-privacy-compliance-a-study-of-child-direc | + | |
| - | USENIX 2025 a-mixed-methods-study-of-open-source-software-maintainers-on-vulnerability-manag | + | |
| - | USENIX 2025 an-industry-interview-study-of-software-signing-for-supply-chain-security | + | |
| - | USENIX 2025 collisionrepair-first-aid-and-automated-patching-for-storage-collision-vulnerabi | + | |
| - | USENIX 2025 exploring-user-security-and-privacy-attitudes-and-concerns-toward-the-use-of-gen | + | |
| - | USENIX 2025 gpuhammer-rowhammer-attacks-on-gpu-memories-are-practical | + | |
| - | USENIX 2025 malicious-llm-based-conversational-ai-makes-users-reveal-personal-information | + | |
| - | USENIX 2025 misty-registry-an-empirical-study-of-flawed-domain-registry-operation | + | |
| - | USENIX 2025 privacy-law-enforcement-under-centralized-governance-a-qualitative-analysis-of-f | + | |
| - | USENIX 2025 regulating-smart-device-support-periods-user-expectations-and-the-european-cyber | + | |
| - | USENIX 2025 your-shield-is-my-sword-a-persistent-denial-of-service-attack-via-the-reuse-of-u | + | |
| - | IEEE-SP 2026 consumer-beware-exploring-data-brokers-ccpa-compliance | + | |
| - | NDSS 2026 chameleoscan-demystifying-and-detecting-ios-chameleon-apps-via-llm-powered-ui-exploration | + | |
| - | NDSS 2026 cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews | + | |
| - | NDSS 2026 demystifying-the-access-control-mechanism-of-esxi-vmkernel | + | |
| - | NDSS 2026 tickets-to-hide-an-inside-look-into-the-anti-abuse-ecosystem-through-internal-abuse-data | + | |
| - | NDSS 2026 time-and-time-again-leveraging-tcp-timestamps-to-improve-remote-timing-attacks | + | |
| - | NDSS 2026 unveiling-byovd-threats-malwares-use-and-abuse-of-kernel-drivers | + | |
| - | PETS 2026 more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr | + | |
| - | PETS 2026 personal-data-flows-and-privacy-policy-traceability-in-third-party-llm-apps-in-t | + | |
| - | PETS 2026 precision-leads-recalling-you-improved-location-privacy-for-shared-mobility-serv | + | |
| - | PETS 2026 the-role-of-online-forums-in-developer-understanding-of-privacy-law-a-reddit-cas | + | |
| - | USENIX 2026 abuse-risks-are-often-inherent-to-product-features-exploring-ai-vendors-bug-boun | + | |
| - | USENIX 2026 inconsistent-incomplete-and-insecure-a-survey-of-account-security-interfaces | + | |
| - | USENIX 2026 the-art-of-hide-and-seek-making-pickle-based-model-supply-chain-poisoning-stealt | + | |
| - | WWW 2026 bowling-with-chatgpt-on-the-evolving-user-interactions-with-conversational-ai-sy | + | |
| - | WWW 2026 falconscope-effective-and-efficient-detection-of-hidden-web-interfaces-in-iot-de | + | |
| - | WWW 2026 unveiling-the-resilience-of-llm-enhanced-search-engines-against-black-hat-seo-ma | + | |
| - | </ | + | |
| - | <wrap todo> | + | # REJECTED (138), tag = screening level |
| + | internet-background-radiation-revisited :: [sentences] IMC 2010 — contacted the software vendors responsible for a misconfiguration; | ||
| + | selecting-representative-ip-addresses-for-internet-topology-studies :: [sentences] IMC 2010 — ' | ||
| + | before-we-knew-it-an-empirical-study-of-zero-day-attacks-in-the-real-world :: [sentences] CCS 2012 — ' | ||
| + | when-firmware-modifications-attack-a-case-study-of-embedded-exploitation :: [sentences] NDSS 2013 — one vendor (HP) disclosure; the 1.08% is end-user patching of 90,000 printers after the vendor fix, not a campaign outcome. | ||
| + | an-empirical-study-of-vulnerability-rewards-programs :: [sentences] USENIX Sec 2013 — Chrome/ | ||
| + | two-years-of-short-urls-internet-measurement-security-threats-and-countermeasure :: [sentences] WWW 2013 — users contacted the authors about a browser add-on; no notification. | ||
| + | a-look-at-targeted-attacks-through-the-lense-of-an-ngo :: [sentences] USENIX Sec 2014 — CVE public disclosure dates. | ||
| + | brahmastra-driving-apps-to-test-the-security-of-third-party-components :: [sentences] USENIX Sec 2014 — list of vulnerable apps shared with the Facebook security team, which contacted developers itself; one platform. | ||
| + | the-attack-of-the-clones-a-study-of-the-impact-of-shared-code-on-vulnerability-p :: [sentences] IEEE S&P 2015 — patch deployment against public disclosure dates; no notification. | ||
| + | checking-more-and-alerting-less-detecting-privacy-leakages-via-enhanced-data-flo :: [sentences] NDSS 2015 — ' | ||
| + | portrait-of-a-privacy-invasion :: [sentences] PETS 2015 — users disclosing relationship status. | ||
| + | talos-neutralizing-vulnerabilities-with-security-workarounds-for-rapid-response :: [sentences] IEEE S&P 2016 — patch timing after public disclosure from CVE data. | ||
| + | weak-keys-remain-widespread-in-network-devices :: [read] IMC 2016 — vendor disclosure: 61 vendors in 2012 (37 with RSA issues: 5 public advisory, 11 private response, 3 auto-response, | ||
| + | towards-mining-latent-client-identifiers-from-network-traffic :: [sentences] PETS 2016 — Apple Push Notification traffic. | ||
| + | if-you-are-not-paying-for-it-you-are-the-product-how-much-do-advertisers-pay-to :: [sentences] IMC 2017 — RTB winning-price notifications. | ||
| + | wiretapping-end-to-end-encrypted-voip-calls-real-world-attacks-on-zrtp :: [sentences] PETS 2017 — one vendor, one CVE. | ||
| + | from-patching-delays-to-infection-symptoms-using-risk-profiles-for-an-early-disc :: [sentences] USENIX Sec 2018 — public disclosure and patch data. | ||
| + | wpse-fortifying-web-protocols-via-browser-side-security-monitoring :: [sentences] USENIX Sec 2018 — disclosed to the owners of 55 websites and to library vendors; no counts, under the floor. | ||
| + | a-usability-evaluation-of-lets-encrypt-and-certbot-usable-security-done-right :: [sentences] CCS 2019 — the matched sentence | ||
| + | automating-patching-of-vulnerable-open-source-software-versions-in-application-binaries :: [sentences] NDSS 2019 — describes Google' | ||
| + | digital-healthcare-associated-infection-a-case-study-on-the-security-of-a-major-multi-campus-hospital-system :: [sentences] NDSS 2019 — one hospital system' | ||
| + | we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy :: [sentences] NDSS 2019 — 'cookie consent notifications'. | ||
| + | accessileaks-investigating-privacy-leaks-exposed-by-the-android-accessibility-se :: [sentences] PETS 2019 — a user-facing warning notification and pull requests to app developers; no campaign. | ||
| + | 50-ways-to-leak-your-data-an-exploration-of-apps-circumvention-of-the-android-pe :: [sentences] USENIX Sec 2019 — disclosed to Google and the FTC. | ||
| + | evaluating-the-contextual-integrity-of-privacy-regulation-parents-iot-toy-privac :: [sentences] USENIX Sec 2019 — COPPA notification-and-consent principles in a survey. | ||
| + | the-betrayal-at-cloud-city-an-empirical-analysis-of-cloud-based-mobile-backends :: [read] USENIX Sec 2019 — tiered notification (Play Store contact, then WHOIS, then Google's tracker) to developers of vulnerable backends, but 'awaiting remediation' | ||
| + | studying-preferences-and-concerns-about-information-disclosure-in-email-notifica :: [sentences] WWW 2019 — privacy of email notifications shown on screens; a user study. | ||
| + | dangerous-skills-got-certified-measuring-the-trustworthiness-of-skill-certificat :: [sentences] CCS 2020 — responsible disclosure | ||
| + | a-security-analysis-of-the-facebook-ad-library :: [sentences] IEEE S&P 2020 — ' | ||
| + | the-many-kinds-of-creepware-used-for-interpersonal-attacks :: [read] IEEE S&P 2020 — 1,095 apps reported to Google, 813 removed. A bulk report to one platform rather than to operators; quoted on the page as a platform take-down figure. | ||
| + | behind-closed-doors-a-network-tale-of-spoofing-intrusion-and-false-dns-security :: [read] IMC 2020 — 43 resolver administrators reached through the SOA RNAME field, 5 replies (3 from people the authors knew), plus two operators of loopback resolvers; under the floor. The wider outreach | ||
| + | broken-metre-attacking-resource-metering-in-evm :: [sentences] NDSS 2020 — Ethereum Foundation bounty. | ||
| + | the-price-is-not-right-comparing-privacy-in-free-and-paid-apps :: [sentences] PETS 2020 — privacy-policy disclosure. | ||
| + | actions-speak-louder-than-words-entity-sensitive-privacy-policy-and-data-flow-an :: [sentences] USENIX Sec 2020 — policy ' | ||
| + | cached-and-confused-web-cache-deception-in-the-wild :: [sentences] USENIX Sec 2020 — notification letters to the publicly listed security contacts of 16 sites (93 domains); | ||
| + | plug-n-pwned-comprehensive-vulnerability-analysis-of-obd-ii-dongles-as-a-new-ove :: [sentences] USENIX Sec 2020 — 29 dongle vendors emailed; vendors, under the floor. | ||
| + | an-empirical-study-of-the-use-of-integrity-verification-mechanisms-for-web-subre :: [sentences] WWW 2020 — survey respondents. | ||
| + | i-need-a-better-description-an-investigation-into-user-expectations-for-differen :: [sentences] CCS 2021 — ' | ||
| + | sok-quantifying-cyber-risk :: [sentences] IEEE S&P 2021 — an SoK citing the notification studies already on the page. | ||
| + | all-the-numbers-are-us-large-scale-abuse-of-contact-discovery-in-mobile-messengers :: [sentences] NDSS 2021 — WhatsApp, Signal | ||
| + | shadow-attacks-hiding-and-replacing-content-in-signed-pdfs :: [sentences] NDSS 2021 — 15 PDF vendors via CERT-Bund. | ||
| + | defining-privacy-how-users-interpret-technical-terms-in-privacy-policies :: [sentences] PETS 2021 — survey. | ||
| + | digital-inequality-through-the-lens-of-self-disclosure :: [sentences] PETS 2021 — self-disclosure on social media. | ||
| + | a-large-scale-interview-study-on-information-security-in-and-attacks-against-sma :: [sentences] USENIX Sec 2021 — CATI recruitment response rate (43,219 companies called). | ||
| + | injection-attacks-reloaded-tunnelling-malicious-payloads-over-dns :: [sentences] USENIX Sec 2021 — ' | ||
| + | now-im-a-bit-angry-individuals-awareness-perception-and-responses-to-data-breach :: [sentences] USENIX Sec 2021 — breach notifications to consumers; a user study. | ||
| + | clues-in-tweets-twitter-guided-discovery-and-analysis-of-sms-spam :: [sentences] CCS 2022 — ' | ||
| + | timing-based-browsing-privacy-vulnerabilities-via-site-isolation :: [sentences] IEEE S&P 2022 — Chrome and Edge teams. | ||
| + | characterizing-permanently-dead-links-on-wikipedia :: [sentences] IMC 2022 — the Internet Archive informed the authors. | ||
| + | mind-your-manrs-measuring-the-manrs-ecosystem :: [read] IMC 2022 — six large network operators told about non-conformant announcements; | ||
| + | auto-draft-219 :: [sentences] NDSS 2022 (SpiralSpy) — ' | ||
| + | developers-say-the-darnedest-things-privacy-compliance-processes-followed-by-dev :: [sentences] PETS 2022 — developers report receiving app-store notifications; | ||
| + | exploring-the-privacy-concerns-of-bystanders-in-smart-homes-from-the-perspective :: [sentences] PETS 2022 — notifying bystanders about data practices; a user study. | ||
| + | we-may-share-the-number-of-diaper-changes-a-privacy-and-security-analysis-of-mob :: [sentences] PETS 2022 — vendors of child-care apps. | ||
| + | movery-a-precise-approach-for-modified-vulnerable-code-clone-discovery-from-modi :: [sentences] USENIX Sec 2022 — ' | ||
| + | understanding-the-practice-of-security-patch-management-across-multiple-branches :: [sentences] WWW 2022 — CVE disclosure dates. | ||
| + | dont-leak-your-keys-understanding-measuring-and-exploiting-the-appsecret-leaks-i :: [sentences] CCS 2023 — Tencent and Baidu bounties. | ||
| + | passive-ssh-key-compromise-via-lattices :: [sentences] CCS 2023 — four manufacturers and CERT/CC; the authors ' | ||
| + | no-one-drinks-from-the-firehose-how-organizations-filter-and-prioritize-vulnerab :: [sentences] IEEE S&P 2023 — interviews on how organisations consume vulnerability notifications; | ||
| + | no-privacy-in-the-electronics-repair-industry :: [sentences] IEEE S&P 2023 — survey respondents. | ||
| + | three-birds-with-one-stone-efficient-partitioning-attacks-on-interdependent-cryp :: [sentences] IEEE S&P 2023 — nodes that ' | ||
| + | utopia-automatic-generation-of-fuzz-driver-using-unit-tests :: [sentences] IEEE S&P 2023 — 123 bug reports to open-source projects, 70 confirmed; bug reporting to maintainers, | ||
| + | a-longitudinal-study-of-vulnerable-client-side-resources-and-web-developers-upda :: [sentences] IMC 2023 — disclosure to Google' | ||
| + | rovista-measuring-and-analyzing-the-route-origin-validation-rov-in-rpki :: [sentences] IMC 2023 — reached out to network operators, one response (BIT), plus AT&T and APNIC; under the floor. | ||
| + | wolf-in-sheeps-clothing-evaluating-security-risks-of-the-undelegated-record-on-d :: [sentences] IMC 2023 — DNS hosting providers named in the paper. | ||
| + | investigating-how-users-imagine-their-personal-privacy-assistant :: [sentences] PETS 2023 — UI notifications. | ||
| + | lessons-in-vcr-repair-compliance-of-android-app-developers-with-the-california-c :: [sentences] PETS 2023 — CCPA verifiable consumer requests to app developers (69 substantive responses); a rights-request study, not a notification. See practices: | ||
| + | on-the-role-and-form-of-personal-information-disclosure-in-cyberbullying-inciden :: [sentences] PETS 2023 — self-disclosure. | ||
| + | privacy-rarely-considered-exploring-considerations-in-the-adoption-of-third-part :: [sentences] PETS 2023 — 37,000 survey invitations; | ||
| + | revoked-just-now-users-behaviors-toward-fitness-data-sharing-with-third-party-ap :: [sentences] PETS 2023 — survey. | ||
| + | a-bugs-life-analyzing-the-lifecycle-and-mitigation-process-of-content-security-p :: [sentences] USENIX Sec 2023 — CSP browser-bug lifecycle from bug trackers. | ||
| + | all-of-them-claim-to-be-the-best-multi-perspective-study-of-vpn-users-and-vpn-pr :: [sentences] USENIX Sec 2023 — 15 VPN providers invited to interviews. | ||
| + | arana-discovering-and-characterizing-password-guessing-attacks-in-practice :: [sentences] USENIX Sec 2023 — compromised usernames disclosed to two universities' | ||
| + | downgrading-dnssec-how-to-exploit-crypto-agility-for-hijacking-signed-zones :: [sentences] USENIX Sec 2023 — five named DNS vendors and operators. | ||
| + | internet-service-providers-and-individuals-attitudes-barriers-and-incentives-to :: [sentences] USENIX Sec 2023 — ISP survey on barriers to notifying IoT owners under Japan' | ||
| + | my-privacy-for-their-security-employees-privacy-perspectives-and-expectations-wh :: [sentences] USENIX Sec 2023 — employee survey. | ||
| + | panda-security-analysis-of-algorand-smart-contracts :: [sentences] USENIX Sec 2023 — one DeFi developer, a bounty. | ||
| + | pushed-by-accident-a-mixed-methods-study-on-strategies-of-handling-secret-inform :: [sentences] USENIX Sec 2023 — GitHub secret-leak notifications recalled by survey participants. | ||
| + | whip-improving-static-vulnerability-detection-in-web-application-by-forcing-tool :: [sentences] USENIX Sec 2023 — 35 zero-days disclosed to the developers of 14 applications. | ||
| + | airgapagent-protecting-privacy-conscious-conversational-agents :: [sentences] CCS 2024 — ' | ||
| + | defying-the-odds-solanas-unexpected-resilience-in-spite-of-the-security-challeng :: [sentences] CCS 2024 — participant recruitment. | ||
| + | breach-extraction-attacks-exposing-and-addressing-the-leakage-in-second-generati :: [sentences] IEEE S&P 2024 — Cloudflare. | ||
| + | from-virtual-touch-to-tesla-command-unlocking-unauthenticated-control-chains-fro :: [sentences] IEEE S&P 2024 — named stakeholders. | ||
| + | shedding-light-on-cvss-scoring-inconsistencies-a-user-centric-study-on-evaluatin :: [sentences] IEEE S&P 2024 — study participants re-contacted. | ||
| + | sok-sgx-fail-how-stuff-gets-exposed :: [sentences] IEEE S&P 2024 — SoK; disclosure timing from prior work. | ||
| + | tabbed-out-subverting-the-android-custom-tab-security-model :: [sentences] IEEE S&P 2024 — Google' | ||
| + | dont-interrupt-me-a-large-scale-study-of-on-device-permission-prompt-quieting-in-chrome :: [sentences] NDSS 2024 — browser notification-permission prompts. | ||
| + | understanding-the-implementation-and-security-implications-of-protective-dns-services :: [sentences] NDSS 2024 — DNS vendors. | ||
| + | exploring-the-privacy-experiences-of-closeted-users-of-online-dating-services-in :: [sentences] PETS 2024 — survey. | ||
| + | security-and-privacy-with-second-hand-storage-devices-a-user-centric-perspective :: [sentences] PETS 2024 — whether buyers would notify anyone about found data; a survey. | ||
| + | the-medium-is-the-message-how-secure-messaging-apps-leak-sensitive-data-to-push :: [sentences] PETS 2024 — 11 app developers, 6 had not replied; under the floor. | ||
| + | diffie-hellman-picture-show-key-exchange-stories-from-commercial-vowifi-deployme :: [sentences] USENIX Sec 2024 — MediaTek, the GSMA CVD programme, Apple and Google. | ||
| + | digital-discrimination-of-users-in-sanctioned-states-the-case-of-the-cuba-embarg :: [sentences] USENIX Sec 2024 — geoblocking ' | ||
| + | globalconfusion-trustzone-trusted-application-0-days-by-design :: [sentences] USENIX Sec 2024 — TrustZone vendors, four CVEs. | ||
| + | malla-demystifying-real-world-large-language-model-integrated-malicious-services :: [sentences] USENIX Sec 2024 — OpenAI, Anthropic, Meta, Poe and FlowGPT; platforms. | ||
| + | rethinking-the-security-threats-of-stale-dns-glue-records :: [read] USENIX Sec 2024 — TLD registries, resolver vendors and ICANN; the 6 million affected domains were handed to the national CERT (' | ||
| + | spf-beyond-the-standard-management-and-operational-challenges-in-practice-and-pr :: [sentences] USENIX Sec 2024 — one vendor report and an operator survey. | ||
| + | towards-more-practical-threat-models-in-artificial-intelligence-security :: [sentences] USENIX Sec 2024 — survey respondents. | ||
| + | unpacking-privacy-labels-a-measurement-and-developer-perspective-on-googles-data :: [read] USENIX Sec 2024 — the top 10,000 developers per label pattern were emailed questions about their Data Safety labels (3,500 responses, 889 usable): recruitment for a developer study, not notification of a defect. | ||
| + | unfiltered-measuring-cloud-based-email-filtering-bypasses :: [read] WWW 2024 — chose NOT to notify the affected domains, citing Bennett et al.'s finding that 'over 80% of the domains contacted were unresponsive', | ||
| + | a-decade-long-landscape-of-advanced-persistent-threats-longitudinal-analysis-and :: [sentences] CCS 2025 — CVE disclosure dates. | ||
| + | is-this-a-scam-the-nature-and-quality-of-reddit-discussion-about-scams :: [sentences] CCS 2025 — Reddit posts. | ||
| + | gptracker-a-large-scale-measurement-of-misused-gpts :: [read] IEEE S&P 2025 — two disclosures to OpenAI; 1,316 of 1,804 GPTs reported on 11 September 2024 removed by 25 September. A bulk report to one platform; quoted on the page as a platform take-down figure. | ||
| + | sniffing-location-privacy-of-video-conference-users-using-free-audio-channels :: [sentences] IEEE S&P 2025 — notification tones. | ||
| + | hitchhiking-vaccine-enhancing-botnet-remediation-with-remote-code-deployment-reuse :: [sentences] NDSS 2025 — remediation payloads that notify infected users; not a campaign by the authors. | ||
| + | was-this-you-investigating-the-design-considerations-for-suspicious-login-notifications :: [sentences] NDSS 2025 — login-notification design, interviews. | ||
| + | who-is-trying-to-access-my-account-exploring-user-perceptions-and-reactions-to-risk-based-authentication-notifications :: [sentences] NDSS 2025 — risk-based-authentication notifications, | ||
| + | ai-is-from-the-devil-behaviors-and-concerns-toward-personal-data-sharing-with-ll :: [sentences] PETS 2025 — survey. | ||
| + | how-unique-is-whose-web-browser-the-role-of-demographics-in-browser-fingerprinti :: [sentences] PETS 2025 — informed consent of participants. | ||
| + | privacy-perceptions-and-behaviors-towards-targeted-advertising-on-social-media-a :: [sentences] PETS 2025 — survey. | ||
| + | the-effect-of-platform-policies-on-app-privacy-compliance-a-study-of-child-direc :: [sentences] PETS 2025 — Google Play's own notifications to developers. | ||
| + | a-mixed-methods-study-of-open-source-software-maintainers-on-vulnerability-manag :: [sentences] USENIX Sec 2025 — recruitment. | ||
| + | an-industry-interview-study-of-software-signing-for-supply-chain-security :: [sentences] USENIX Sec 2025 — recruitment (30 candidates). | ||
| + | collisionrepair-first-aid-and-automated-patching-for-storage-collision-vulnerabi :: [sentences] USENIX Sec 2025 — a prior tool 'did not disclose runtime overhead' | ||
| + | exploring-user-security-and-privacy-attitudes-and-concerns-toward-the-use-of-gen :: [sentences] USENIX Sec 2025 — interviews. | ||
| + | gpuhammer-rowhammer-attacks-on-gpu-memories-are-practical :: [sentences] USENIX Sec 2025 — NVIDIA. | ||
| + | malicious-llm-based-conversational-ai-makes-users-reveal-personal-information :: [sentences] USENIX Sec 2025 — UI pop-up notifications. | ||
| + | misty-registry-an-empirical-study-of-flawed-domain-registry-operation :: [sentences] USENIX Sec 2025 — registries and their backend providers, named. | ||
| + | privacy-law-enforcement-under-centralized-governance-a-qualitative-analysis-of-f :: [sentences] USENIX Sec 2025 — government notifications to app providers, interviews. | ||
| + | regulating-smart-device-support-periods-user-expectations-and-the-european-cyber :: [sentences] USENIX Sec 2025 — survey. | ||
| + | your-shield-is-my-sword-a-persistent-denial-of-service-attack-via-the-reuse-of-u :: [sentences] USENIX Sec 2025 — DNS vendors. | ||
| + | consumer-beware-exploring-data-brokers-ccpa-compliance :: [sentences] IEEE S&P 2026 — CCPA requests to data brokers (41.2% answered emails where the form was broken); a rights-request study. See practices: | ||
| + | chameleoscan-demystifying-and-detecting-ios-chameleon-apps-via-llm-powered-ui-exploration :: [sentences] NDSS 2026 — Apple. | ||
| + | cross-boundary-mobile-tracking-exploring-java-to-javascript-information-diffusion-in-webviews :: [sentences] NDSS 2026 — 'zip code disclosures' | ||
| + | demystifying-the-access-control-mechanism-of-esxi-vmkernel :: [sentences] NDSS 2026 — VMware bounty. | ||
| + | tickets-to-hide-an-inside-look-into-the-anti-abuse-ecosystem-through-internal-abuse-data :: [read] NDSS 2026 — the receiving end: 1.3 million abuse reports at one hosting provider, 2.6% linked to a client notification. Not a campaign; cited on the page for what happens to a report after it arrives. | ||
| + | time-and-time-again-leveraging-tcp-timestamps-to-improve-remote-timing-attacks :: [sentences] NDSS 2026 — ' | ||
| + | unveiling-byovd-threats-malwares-use-and-abuse-of-kernel-drivers :: [sentences] NDSS 2026 — Microsoft and driver vendors. | ||
| + | more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr :: [sentences] PETS 2026 — no notification. | ||
| + | personal-data-flows-and-privacy-policy-traceability-in-third-party-llm-apps-in-t :: [sentences] PETS 2026 — privacy-policy disclosure. | ||
| + | precision-leads-recalling-you-improved-location-privacy-for-shared-mobility-serv :: [sentences] PETS 2026 — dataset maintainers. | ||
| + | the-role-of-online-forums-in-developer-understanding-of-privacy-law-a-reddit-cas :: [sentences] PETS 2026 — GDPR breach notification as a discussion topic. | ||
| + | abuse-risks-are-often-inherent-to-product-features-exploring-ai-vendors-bug-boun :: [read] USENIX Sec 2026 — catalogues AI vendors' | ||
| + | inconsistent-incomplete-and-insecure-a-survey-of-account-security-interfaces :: [read] USENIX Sec 2026 — 58 disclosure briefings to a defined set of top-100 services (38 acknowledged, | ||
| + | the-art-of-hide-and-seek-making-pickle-based-model-supply-chain-poisoning-stealt :: [sentences] USENIX Sec 2026 — NVIDIA, Keras, Protect AI; bounty. | ||
| + | bowling-with-chatgpt-on-the-evolving-user-interactions-with-conversational-ai-sy :: [sentences] WWW 2026 — survey. | ||
| + | falconscope-effective-and-efficient-detection-of-hidden-web-interfaces-in-iot-de :: [sentences] WWW 2026 — coordinated disclosure to IoT vendors, 50 CVEs. | ||
| + | unveiling-the-resilience-of-llm-enhanced-search-engines-against-black-hat-seo-ma :: [sentences] WWW 2026 — 1,602 sites reported to Google; a platform report. | ||
| + | |||
| + | # WIDE PROBE: 78 candidates outside the narrow rule | ||
| + | # PROMOTED (3) | ||
| + | playing-without-paying-detecting-vulnerable-payment-verification-in-native-binar :: USENIX 2022 — "Many of the developers have acknowledged our findings"; | ||
| + | lazy-gatekeepers-a-large-scale-study-on-spf-configuration-in-the-wild :: IMC 2023 — 6,931 of 211,018 errors fixed two weeks later — "a success rate of 3.3 %"; 300 thank-you mails, 3 spam complaints put on an opt-out list; bo | ||
| + | demystifying-rpki-invalid-prefixes-hidden-causes-and-security-risks :: NDSS 2026 — 302 of 1,385 undeliverable (21.8%); 174 organisations responded (16.1% of the 1,083 delivered), confirming 349 prefixes as misconfigurations | ||
| + | # FOUND OUTSIDE BOTH RULES (1) | ||
| + | the-security-lottery-measuring-client-side-web-security-inconsistencies :: USENIX 2022 — delivery-failed for 197 of 256 domains; 21 non-automatic answers, 7 confirmed and fixed or explained; second round May 2022: 184 still affec | ||
| + | # REJECTED (75), all screened on the probe-matching sentences only | ||
| + | botmagnifier-locating-spambots-on-the-internet :: bots contacted C&C servers | ||
| + | peerpress-utilizing-enemies-p2p-strength-against-them :: probing accuracy | ||
| + | an-evaluation-of-the-google-chrome-extension-security-architecture :: 32 extension developers contacted, 19 fixed — real but under the floor and to a known set | ||
| + | juice-a-longitudinal-study-of-an-seo-botnet :: IPs contacted a proxy | ||
| + | an-internet-wide-view-of-internet-wide-scanning :: how organisations contacted the scanning team to opt out; receiving end of scanning, see practices: | ||
| + | on-the-practical-exploitability-of-dual-ec-in-tls-implementations :: servers contacted by a scan | ||
| + | security-by-any-other-name-on-the-effectiveness-of-provider-based-email-security :: MTAs contacted by a scan | ||
| + | ad-injection-at-scale-assessing-deceptive-advertisement-modifications :: domains contacted by extensions | ||
| + | copperdroid-automatic-reconstruction-of-android-malware-behaviors :: ' | ||
| + | domain-z-28-registrations-later-measuring-the-exploitation-of-residual-trust-in :: domains contacted by malware | ||
| + | recommended-for-you-a-first-look-at-content-recommendation-networks :: websites contacting a CRN | ||
| + | internet-jones-and-the-raiders-of-the-lost-trackers-an-archaeological-study-of-w :: third parties contacted by sites | ||
| + | investigating-commercial-pay-per-install-and-the-distribution-of-unwanted-softwa :: domains contacted by binaries | ||
| + | privacy-in-epigenetics-temporal-linkability-of-microrna-expression-profiles :: ' | ||
| + | no-honor-among-thieves-a-large-scale-analysis-of-malicious-web-shells :: domains contacted by shells | ||
| + | a-lustrum-of-malware-network-communication-evolution-and-insights :: domains contacted by malware | ||
| + | vuddy-a-scalable-approach-for-vulnerable-code-clone-discovery :: one Red Hat security officer | ||
| + | internet-scale-probing-of-cps-inference-characterization-and-orchestration-analy :: darkspace contacted by a scanning campaign | ||
| + | a-longitudinal-end-to-end-view-of-the-dnssec-ecosystem :: four operators asked for a reason | ||
| + | how-tracking-companies-circumvented-ad-blockers-using-websockets :: receivers contacted by parties | ||
| + | o-peer-where-art-thou-uncovering-remote-peering-interconnections-at-ixps :: IXP operators asked to validate | ||
| + | understanding-tor-usage-with-privacy-preserving-measurement :: Amazon employees; guards contacted by clients | ||
| + | adversarial-perceptual-ad-blocking-meets-adversarial-machine-learning :: ad-disclosure logos | ||
| + | just-the-tip-of-the-iceberg-internet-scale-exploitation-of-routers-for-cryptojac :: asked Censys about its crawl | ||
| + | watching-you-watch-the-tracking-ecosystem-of-over-the-top-tv-streaming-devices :: tracker domains contacted | ||
| + | scanning-the-scanners-sensing-the-internet-from-a-massively-distributed-network :: IPs contacted by scanners | ||
| + | hack-for-hire-exploring-the-emerging-market-for-account-hijacking :: 27 hack-for-hire services contacted as customers | ||
| + | a-systematic-study-of-elastic-objects-in-kernel-exploitation :: ' | ||
| + | a-haystack-full-of-needles-scalable-detection-of-iot-devices-in-the-wild :: service IPs contacted by devices | ||
| + | when-push-comes-to-ads-measuring-the-rise-of-malicious-push-advertising :: notification permission requests | ||
| + | angel-or-devil-a-privacy-study-of-mobile-parental-control-apps :: service contacted by apps | ||
| + | nomoats-towards-automatic-detection-of-mobile-tracking :: hostnames contacted | ||
| + | ethbmc-a-bounded-model-checker-for-smart-contracts :: authors of a prior tool contacted for data | ||
| + | dark-matter-uncovering-the-darkcomet-rat-ecosystem :: IRB approval to report 57,805 victims to their ISPs — ' | ||
| + | the-chameleon-attack-manipulating-content-display-in-online-social-media :: Facebook groups contacted as a test | ||
| + | crawlphish-large-scale-analysis-of-client-side-cloaking-techniques-in-phishing :: users allowing notifications | ||
| + | follow-the-scent-defeating-ipv6-prefix-rotation-privacy :: one CPE manufacturer | ||
| + | privacyflash-pro-automating-privacy-policy-generation-for-mobile-apps :: a few policy-generator operators | ||
| + | reining-in-the-webs-inconsistencies-with-site-policy :: disclosure to a few named sites, qualitative feedback | ||
| + | privacy-preference-signals-past-present-and-future :: second-level domains contacted per site | ||
| + | shhh-be-quiet-reducing-the-unwanted-interruptions-of-notification-permission-pro :: notification permission prompts | ||
| + | websocket-adoption-and-the-landscape-of-the-real-time-web :: WebSocket push notifications | ||
| + | measuring-and-mitigating-the-risk-of-ip-reuse-on-public-clouds :: IPs contacted by traffic | ||
| + | deep-dive-into-the-iot-backend-ecosystem :: backend servers contacted | ||
| + | malnet-a-binary-centric-network-level-profiling-of-iot-malware :: C2 servers contacted | ||
| + | where-to-recruit-for-security-development-studies-comparing-six-software-develop :: 76,978 developers contacted for study recruitment | ||
| + | when-free-tier-becomes-free-to-enter-a-non-intrusive-way-to-identify-security-ca :: camera motion notifications | ||
| + | detection-of-inconsistencies-in-privacy-practices-of-browser-extensions :: dashboard disclosures | ||
| + | hope-of-delivery-extracting-user-locations-from-mobile-instant-messengers :: delivery-notification timing | ||
| + | usability-and-enforceability-of-global-privacy-control :: BuiltWith operators contacted with a suggestion | ||
| + | dscope-a-cloud-native-internet-telescope :: scanners contacting telescopes | ||
| + | locin-inferring-semantic-location-from-spatial-maps-in-mixed-reality :: IRB contacted | ||
| + | the-ok-is-not-enough-a-large-scale-study-of-consent-dialogs-in-smartphone-applic :: tracking endpoints contacted by apps | ||
| + | timeless-timing-attacks-and-preload-defenses-in-tors-dns-cache :: the Tor Project | ||
| + | user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers :: survey | ||
| + | on-how-zero-knowledge-proof-blockchain-mixers-improve-and-worsen-user-privacy :: authors of a prior paper contacted for data | ||
| + | characterizing-and-mitigating-phishing-attacks-at-cctld-scale :: registry-side suspension time after a Netcraft notification; | ||
| + | content-nudges-and-incentives-a-study-on-the-effectiveness-and-perception-of-emb :: recruitment | ||
| + | targeted-and-troublesome-tracking-and-advertising-on-childrens-websites :: ad disclosures | ||
| + | diffaudit-auditing-privacy-practices-of-online-services-for-children-and-adolesc :: domains contacted | ||
| + | the-roots-go-deep-measuring-under-change :: anycast site contacted | ||
| + | content-censorship-in-the-interplanetary-file-system :: peers contacted | ||
| + | like-comment-get-scammed-characterizing-comment-scams-on-media-platforms :: scammers contacted as bait | ||
| + | masterkey-automated-jailbreaking-of-large-language-model-chatbots :: jailbreak disclosure to vendors | ||
| + | why-privacy-preserving-protocols-are-sometimes-not-enough-a-case-study-of-the-br :: ' | ||
| + | can-virtual-reality-protect-users-from-keystroke-inference-attacks :: ' | ||
| + | ghostrace-exploiting-and-mitigating-speculative-race-conditions :: NFC driver maintainers, | ||
| + | the-unusual-suspects-studying-reasons-for-lacking-updates-in-wordpress :: 482 webshop owners cold-called to recruit interviewees (287 answered), deliberately not framed as a vulnerability notification | ||
| + | transparency-or-information-overload-evaluating-users-comprehension-and-perceptions-of-the-ios-app-privacy-report :: 'Most Contacted Domains' | ||
| + | empirically-measuring-data-localization-in-the-eu :: servers contacted | ||
| + | lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps :: app hostnames | ||
| + | because-i-didnt-touch-these-and-even-dont-know-why-i-should-to-change-these-why :: 5,000 developers contacted for a survey about privacy labels | ||
| + | dead-domains-living-data-a-privacy-risk-analysis-of-domain-lifecycle-in-android :: apps contacting a domain | ||
| + | the-tcf-doesn-t-really-a-a-id-automatic-privacy-analysis-and-legal-compliance-of :: domains contacted with AAID | ||
| + | missing-present-and-conflicting-a-large-scale-analysis-of-iot-update-information :: customer service contacted as a buyer | ||
| + | </ | ||
| - | The list above is the honest coverage boundary of this page. The highest-value follow-up is reading the ~15 of these that look like real campaigns — '' | + | The kind label '' |
| ===== Quotes spot-checked ===== | ===== Quotes spot-checked ===== | ||
| - | ==== '' | + | ==== ethics.evidence.quote against the source text ==== |
| Seven papers with '' | Seven papers with '' | ||
| Line 487: | Line 588: | ||
| | {[stock2016_hey]} 5.8% received / 74.5% still exploitable / Table 1 fix rates / Abusix / RFC 2142 aliases / legal threat on day two / 5 opt-outs covering 187 domains | read directly by the orchestrator from '' | | {[stock2016_hey]} 5.8% received / 74.5% still exploitable / Table 1 fix rates / Abusix / RFC 2142 aliases / legal threat on day two / 5 opt-outs covering 187 domains | read directly by the orchestrator from '' | ||
| | {[lone2022_sav]} PeeringDB-before-WHOIS contact cascade | read directly by the orchestrator | | | {[lone2022_sav]} PeeringDB-before-WHOIS contact cascade | read directly by the orchestrator | | ||
| + | |||
| + | ==== Quotes added on 2026-09-04 ==== | ||
| + | |||
| + | Every quote written onto the content page in this revision, plus the figures behind the new table rows, is in '' | ||
| + | |||
| + | Sub-agent findings **not** carried onto the page, because the orchestrator re-read the passage and judged them inferences rather than the paper' | ||
| **Two errors in the first published version, caught by the orchestrator' | **Two errors in the first published version, caught by the orchestrator' | ||
| Line 536: | Line 643: | ||
| * **CERT/CC Vultron.** Reported as explicitly "not yet ready for production use". Cut, because a non-production protocol is not a channel a PhD student can use this year. | * **CERT/CC Vultron.** Reported as explicitly "not yet ready for production use". Cut, because a non-production protocol is not a channel a PhD student can use this year. | ||
| * **Bugcrowd / Intigriti / YesWeHack third-party report acceptance.** No primary policy page found either way. The page therefore claims the 2016 " | * **Bugcrowd / Intigriti / YesWeHack third-party report acceptance.** No primary policy page found either way. The page therefore claims the 2016 " | ||
| + | |||
| + | ==== Fetched by the orchestrator, | ||
| + | |||
| + | ^ Claim on the page ^ Source ^ How verified ^ | ||
| + | | 0.49% of the Tranco top 1M and 1.6% of the top 100K had a valid '' | ||
| + | | 42 successful weekly scans of the Tranco top 1M over 55 weeks, 26 December 2021 to 15 January 2023: top 100 32.0→34.0%, | ||
| + | | A gTLD zone-file scan finds 573,123 of 241,285,150 domains (0.238%) with a '' | ||
| + | | Six corpus papers that notified used '' | ||
| + | |||
| + | ==== Rejected or not used, 2026-09-04 ==== | ||
| + | |||
| + | * **uriports.com, | ||
| + | * **hexiosec.com "1 Million Websites — How Many Use Security.txt?" | ||
| + | * **Vekaria, Nithyanand, Shafiq, " | ||
| + | * **Brandt et al., "Snail Mail Beats Email Any Day" (ARES 2021)**: surfaced by search as a postal-letter notification study on network operators. Outside the seven venues and not fetched; the postal result the page already carries is {[maass2021_effective]}. | ||
| ==== Rejected sources ==== | ==== Rejected sources ==== | ||
| Line 570: | Line 692: | ||
| ===== What could not be established ===== | ===== What could not be established ===== | ||
| - | * **Whether the 22 hand-classified campaigns are the whole set.** | + | * **Whether the 32 hand-classified campaigns are the whole set.** |
| * **Any response rate from the corpus schema.** '' | * **Any response rate from the corpus schema.** '' | ||
| - | * **Whether '' | + | * **Whether '' |
| - | * **Current '' | + | * **Current '' |
| * **Whether the framing effect is real.** {[maass2021_effective]} found a large, significant fine-framing effect; {[utz2023_comparing]} found none. Different countries, issues, media and populations. The page presents the contradiction rather than picking a side. Resolving it needs a study that varies framing while holding medium and jurisdiction fixed. | * **Whether the framing effect is real.** {[maass2021_effective]} found a large, significant fine-framing effect; {[utz2023_comparing]} found none. Different countries, issues, media and populations. The page presents the contradiction rather than picking a side. Resolving it needs a study that varies framing while holding medium and jurisdiction fixed. | ||
| * **Whether the RCT result generalises.** {[lone2022_sav]} found no effect on **network operators deploying SAV** — an expensive, low-visibility configuration change. It does not follow that notification fails for a web vulnerability an operator can fix in ten minutes, and {[maass2021_effective]}' | * **Whether the RCT result generalises.** {[lone2022_sav]} found no effect on **network operators deploying SAV** — an expensive, low-visibility configuration change. It does not follow that notification fails for a web vulnerability an operator can fix in ten minutes, and {[maass2021_effective]}' | ||
| Line 580: | Line 702: | ||
| ===== Reviewer findings ===== | ===== Reviewer findings ===== | ||
| + | |||
| + | <WRAP todo> | ||
| + | |||
| + | ==== Fable — generic, 2026-09-04 revision ==== | ||
| + | |||
| + | Run after the three focused passes and their fixes. Seventeen findings; fourteen accepted, three partly. | ||
| + | |||
| + | ^ Finding ^ Action ^ | ||
| + | | The lead box said "both randomised, control-arm experiments on network operators … found no significant effect", | ||
| + | | "The one campaign in the corpus at the 100,000 scale" — Utz 2023 (159,035), Durumeric 2014 (150,000) and Li 2016 (760,935) are larger. | **ACCEPTED**, | ||
| + | | The new {[blechschmidt2023_hello]} row omitted the paper' | ||
| + | | The rates table' | ||
| + | | The '' | ||
| + | | "Six campaigns in the corpus used it": four of the six are rejected as campaigns. "23 of the vulnerable domains" | ||
| + | | The script-output caption compared five giants' | ||
| + | | "Three papers look at what happens after a report arrives" | ||
| + | | "seven vendors instead of thousands of domains" | ||
| + | | Fix-difficulty row: "the message was identical" | ||
| + | | Methodology bullet bolded the reassuring half (" | ||
| + | | The provenance classification code block still said 12 / 9 for weak-keys after the fold was corrected to 3 / 18 — it had been edited, not regenerated. | **ACCEPTED**, | ||
| + | | "a recall of 28/32 against the union of everything found" is not recall; no gold set exists. | **ACCEPTED**, | ||
| + | | The "What could not be established" | ||
| + | | The script' | ||
| + | | "Two of the four figures in disclosureDetail ratios" | ||
| + | | Verified and not a problem: the Roth 2020, Nan 2023, Li 2024, Gilad 2017, Liao 2016 and Edu 2022 rows; Ryan's quote; all " | ||
| + | |||
| + | ==== Sonnet — figures against the script, 2026-09-04 revision ==== | ||
| + | |||
| + | Re-ran both script invocations (byte-identical to the committed outputs), checked every number in sections A–D, the trend table, the count reconciliation (32 = 26 + 6; 179 = 28 + 151; 78 = 3 + 75; 229 = 154 + 75; 201 sentence-level; | ||
| + | |||
| + | ^ Finding ^ Action ^ | ||
| + | | '' | ||
| + | | "61 device vendors — 5 issued a public advisory, 11 answered privately, …": the split is Table 2's 37 RSA-key vendors, not all 61. The fold entry had it right; the page prose dropped the qualifier. | **ACCEPTED**, | ||
| + | | The quote JSON carried a quote from '' | ||
| + | | '' | ||
| + | | Only the NDSS 2026 row carried the provisional asterisk although the legend says " | ||
| + | |||
| + | ==== Sonnet — citations and quotes, 2026-09-04 revision (verification sub-agent) ==== | ||
| + | |||
| + | Checked six load-bearing attributions against the source text. Five matched: the " | ||
| + | |||
| + | ^ Finding ^ Action ^ | ||
| + | | **Weak-keys Table 2 was mis-reconstructed.** The flattened four-column layout reads 5 public advisory / 11 private response / **3 auto-response / 18 no response**, not 12 / 9. The reviewer re-extracted the PDF in layout mode and cross-checked the caption' | ||
| + | | "55 weekly scans": | ||
| + | |||
| + | ==== Sonnet — external currency, 2026-09-04 revision ==== | ||
| + | |||
| + | ^ Finding ^ Action ^ | ||
| + | | iotdef blog: URL live, every number the provenance table quotes (573,123 / 241, | ||
| + | | DOI '' | ||
| + | | RFC 9116 unchanged, three errata; erratum 7264 (Reported) concerns the case of the ISO 8601 example in the '' | ||
| + | | RFC 2142, ICANN RDAP announcement, | ||
| + | | EUR-Lex returned HTTP 202 with an empty body to every automated fetch on 2026-09-04; the NIS2 Article 12 sentence was confirmed only against three secondary legal mirrors. | **NOTED**: the 2026-08-13 primary fetch stands; the page's quote is unchanged. Re-fetch the primary when EUR-Lex answers. | | ||
| + | | Abusix, PeeringDB API, Tranco, Search Console security-issue messages, 360 Store and APKPure: none renamed or discontinued. | No action. | | ||
| + | | A newer peer-reviewed '' | ||
| Four reviewers, all told the context might not be exhaustive, all given the page text, the report script, its output, and these notes. Three focused passes ran in parallel first; the generic pass ran after their findings were applied. | Four reviewers, all told the context might not be exhaustive, all given the page text, the report script, its output, and these notes. Three focused passes ran in parallel first; the generic pass ran after their findings were applied. | ||
| Line 616: | Line 793: | ||
| * **A table rendered with every figure in the wrong column, and no reviewer caught it.** The trend table' | * **A table rendered with every figure in the wrong column, and no reviewer caught it.** The trend table' | ||
| - | * **The downloadable code was verified end to end.** '' | + | * **The downloadable code was verified end to end.** '' |
| + | * **A stale page cache made most citations render as raw keys, and it survived four reviewers and every verification pass above.** After the bibliography was extended and the pages saved, '' | ||
| * All eight internal links ('' | * All eight internal links ('' | ||
| Line 622: | Line 800: | ||
| The '' | The '' | ||
| + | |||
| + | ==== Fable — generic, no checklist, run after the three focused passes ==== | ||
| + | |||
| + | The most productive of the four. Eleven findings, **all accepted**; five were wrong or self-contradicting claims on the content page. | ||
| + | |||
| + | ^ Finding ^ Action ^ | ||
| + | | The lead box said "both of the **properly randomised**, | ||
| + | | The rescoping justification claimed the excluded group "is participant-debriefing notes" | ||
| + | | " | ||
| + | | The opening said "you **have to tell** those 8,000 operators, and **every venue** … expects you to say so" — contradicting the page's own PoPETs bullet, and its own paragraph saying that deciding not to notify is defensible. The footnote also covered only four of the seven corpus venues. | **ACCEPTED**: | ||
| + | | {[stock2018_didnt]}' | ||
| + | | 22 + 16 + 144 = 182 ≠ 179 on the content page, with the explanation only here. | **ACCEPTED**: | ||
| + | | The rates table' | ||
| + | | " | ||
| + | | The provenance itself conceded that neither the script docstring nor the page says why RIPEstat was chosen over Abusix, and left it unfixed. | **ACCEPTED**, | ||
| + | | This provenance page said "Four reviewers … logged below" with three logged, and " | ||
| + | | Voice: the only first-person singular on the site ("no cadence **I** could verify" | ||
| + | |||
| + | Also confirmed by this pass and not changed: the page answers its own question and the top-to-bottom ordering works; no dead-weight sections; all DokuWiki constructs well-formed in the current revision; the rates table' | ||
| ==== Nothing was rejected outright ==== | ==== Nothing was rejected outright ==== | ||
| - | Every substantive finding across | + | Every substantive finding across |
| * The **figures** pass found no figure error at all — every corpus number checked out — but found the one real **code** defect. Re-running beats re-reading. | * The **figures** pass found no figure error at all — every corpus number checked out — but found the one real **code** defect. Re-running beats re-reading. | ||
| Line 634: | Line 831: | ||
| [[practices: | [[practices: | ||
| + | |||
| + | ===== Markup sweep, 2026-09-17 ===== | ||
| + | |||
| + | Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with '' | ||
provenance/practices/notifying_websites.1786651733.txt.gz · Last modified: by karel.kubicek.claude