| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| provenance:practices:notifying_websites [2026/09/04 12:50] – Fix namespace-relative [[start]] red link. Authored by Claude karel.kubicek.claude | provenance:practices:notifying_websites [2026/09/17 07:23] (current) – Markup rendering sweep: wrap escapes, CLI flag typography, and heading quotes. Authored by Claude. karel.kubicek.claude |
|---|
| |
| ^ Field ^ Value ^ | ^ Field ^ Value ^ |
| | Date | 2026-08-13 (page created); **2026-09-04 (this revision: the 144 unreviewed campaign candidates read, 10 campaigns added, security.txt questions resolved as far as the sources allow)** | | | Date | 2026-08-13 (page created); **2026-09-04 (this revision: the 144 unreviewed campaign candidates screened, 18 of them read in full, 10 campaigns added, security.txt questions resolved as far as the sources allow)** | |
| | Page status | **new page**. ''practices:notifying_websites'' was a red link promised from [[:start]] since the site's outline was written; nothing existed at that id. | | | Page status | **new page**. ''practices:notifying_websites'' was a red link promised from [[:start]] since the site's outline was written; nothing existed at that id. | |
| | Corpus at the time | ''data/extract/run1/extractions.jsonl'', 5,859 papers, 7 venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P), 2010–2026. 5,869 ''paper.cols.txt'' files. | | | Corpus at the time | ''data/extract/run1/extractions.jsonl'', 5,859 papers, 7 venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P), 2010–2026. 5,869 ''paper.cols.txt'' files. | |
| ===== Report script and its unedited output ===== | ===== Report script and its unedited output ===== |
| |
| Run as ''node scripts/report_notifying_websites.mjs''. Flags: ''--wiki'' for DokuWiki tables, ''--list'' for the hand-classified campaigns and every rejection with its reason, ''--quotes'' for ethics evidence quotes, ''--residue'' for every unmapped fold entry and every unreviewed candidate (none, as of 2026-09-04). The block below is the unedited output of a fresh run on 2026-09-04 (''out/notifying_websites-output-20260904.txt''); sections A–D are byte-identical to the 2026-08-13 run, section E changed. | Run as ''node scripts/report_notifying_websites.mjs''. Flags: ''%%--wiki%%'' for DokuWiki tables, ''%%--list%%'' for the hand-classified campaigns and every rejection with its reason, ''%%--quotes%%'' for ethics evidence quotes, ''%%--residue%%'' for every unmapped fold entry and every unreviewed candidate (none, as of 2026-09-04). The block below is the unedited output of a fresh run on 2026-09-04 (''out/notifying_websites-output-20260904.txt''); sections A–D are byte-identical to the 2026-08-13 run, section E changed. |
| |
| <WRAP todo>''out/notifying_websites-output.txt'' in the workdir is **two concatenated runs**: the plain run followed by the ''--list'' run, which repeats the plain output before adding the campaign list. A ''diff'' against a single fresh invocation therefore shows a few hundred spurious extra lines, and this misled one reviewer. Do not hard-code the split point — it moves whenever a table row is added. Derive it: ''BASE=$(node scripts/report_notifying_websites.mjs | wc -l)'', then ''head -$BASE'' and ''tail -n +$((BASE+1))'' each match a fresh run byte-for-byte. As of the 2026-09-04 revision ''BASE'' is 168 (''out/notifying_websites-output-20260904.txt'' is a single plain run; ''out/notifying_websites-output-list-20260904.txt'' is a single ''--list'' run). The script itself is deterministic — re-verified 2026-09-04.</WRAP> | <WRAP todo>''out/notifying_websites-output.txt'' in the workdir is **two concatenated runs**: the plain run followed by the ''%%--list%%'' run, which repeats the plain output before adding the campaign list. A ''diff'' against a single fresh invocation therefore shows a few hundred spurious extra lines, and this misled one reviewer. Do not hard-code the split point — it moves whenever a table row is added. Derive it: ''BASE=$(node scripts/report_notifying_websites.mjs | wc -l)'', then ''head -$BASE'' and ''tail -n +$((BASE+1))'' each match a fresh run byte-for-byte. As of the 2026-09-04 revision ''BASE'' is 168 (''out/notifying_websites-output-20260904.txt'' is a single plain run; ''out/notifying_websites-output-list-20260904.txt'' is a single ''%%--list%%'' run). The script itself is deterministic — re-verified 2026-09-04.</WRAP> |
| |
| Sections of the script, so a figure on the content page can be traced to the block that produced it: | Sections of the script, so a figure on the content page can be traced to the block that produced it: |
| * **D** — ''ethics.disclosureDetail'' folded into channel and outcome families with residue, plus every entry carrying a countable ratio | * **D** — ''ethics.disclosureDetail'' folded into channel and outcome families with residue, plus every entry carrying a countable ratio |
| * **E** — full-text candidate scan (narrow rule and, since 2026-09-04, the wide recall probe), hand classification, and the unreviewed residue | * **E** — full-text candidate scan (narrow rule and, since 2026-09-04, the wide recall probe), hand classification, and the unreviewed residue |
| * **F** — (''--quotes'') ethics evidence quotes for web papers with ''notifiedAffectedParties == yes'' | * **F** — (''%%--quotes%%'') ethics evidence quotes for web papers with ''notifiedAffectedParties == yes'' |
| |
| <code> | <code> |
| campaigns in total (CAMPAIGNS) 32 | campaigns in total (CAMPAIGNS) 32 |
| |
| sanity: campaigns caught by neither rule (added from a wider first-pass scan): 1 — the-security-lottery-measuring-client-side-web-security-inconsistencies | sanity: campaigns caught by neither rule (found by a topical full-text grep, see notify_fold.mjs caught:'grep'): 1 — the-security-lottery-measuring-client-side-web-security-inconsistencies |
| campaigns caught only by the wide probe: 3 — playing-without-paying-detecting-vulnerable-payment-verification-in-native-binar, lazy-gatekeepers-a-large-scale-study-on-spf-configuration-in-the-wild, demystifying-rpki-invalid-prefixes-hidden-causes-and-security-risks | campaigns caught only by the wide probe: 3 — playing-without-paying-detecting-vulnerable-payment-verification-in-native-binar, lazy-gatekeepers-a-large-scale-study-on-spf-configuration-in-the-wild, demystifying-rpki-invalid-prefixes-hidden-causes-and-security-risks |
| REJECTED slugs caught by neither rule: 3 — how-website-owners-face-privacy-issues-thematic-analysis-of-responses-from-a-cov, from-whois-to-whowas-a-large-scale-measurement-study-of-domain-registration-privacy-under-the-gdpr, the-cve-wayback-machine-measuring-coordinated-disclosure-from-exploits-against-t | REJECTED slugs caught by neither rule: 3 — how-website-owners-face-privacy-issues-thematic-analysis-of-responses-from-a-cov, from-whois-to-whowas-a-large-scale-measurement-study-of-domain-registration-privacy-under-the-gdpr, the-cve-wayback-machine-measuring-coordinated-disclosure-from-exploits-against-t |
| </code> | </code> |
| |
| Two of the four figures in ''ethics.disclosureDetail'' ratios above are quoted on the content page and were re-verified against the JSONL by exact substring match: ''an-extensive-study-of-residential-proxies-in-china'' (CCS 2022) and ''fv8-a-forced-execution-javascript-engine-for-detecting-evasive-techniques'' (USENIX Sec 2024), one match each. | Two of the seven ''ethics.disclosureDetail'' ratios above are quoted on the content page and were re-verified against the JSONL by exact substring match: ''an-extensive-study-of-residential-proxies-in-china'' (CCS 2022) and ''fv8-a-forced-execution-javascript-engine-for-detecting-evasive-techniques'' (USENIX Sec 2024), one match each. |
| |
| ===== Folding: rules and residue ===== | ===== Folding: rules and residue ===== |
| Free-text fields agree run-to-run on roughly 20% of exact strings, so nothing here is aggregated by exact string. Three folds were written, in ''scripts/report_notifying_websites.mjs'' and ''scripts/notify_fold.mjs''. | Free-text fields agree run-to-run on roughly 20% of exact strings, so nothing here is aggregated by exact string. Three folds were written, in ''scripts/report_notifying_websites.mjs'' and ''scripts/notify_fold.mjs''. |
| |
| ==== 1. ''ethics.disclosureDetail'' → channel families ==== | ==== 1. ethics.disclosureDetail → channel families ==== |
| |
| Nine regex families, **not mutually exclusive** (a paper that told a CERT and the vendor belongs in both; papers counted once per family). Published on the content page as a ranking, never as adoption rates. | Nine regex families, **not mutually exclusive** (a paper that told a CERT and the vendor belongs in both; papers counted once per family). Published on the content page as a ranking, never as adoption rates. |
| * ''hosting provider / ISP / upstream'' also matches the bare token ''registrar'', which overlaps the WHOIS family. Both are under 1.5% and reported as a ranking, so the overlap is stated rather than resolved. | * ''hosting provider / ISP / upstream'' also matches the bare token ''registrar'', which overlaps the WHOIS family. Both are under 1.5% and reported as a ranking, so the overlap is stated rather than resolved. |
| |
| ==== 2. ''ethics.disclosureDetail'' → outcome families ==== | ==== 2. ethics.disclosureDetail → outcome families ==== |
| |
| Five families, non-exclusive. Residue 2,155 of 2,870 (75.1%), published above. Not used on the content page except as the 75.1% figure. | Five families, non-exclusive. Residue 2,155 of 2,870 (75.1%), published above. Not used on the content page except as the 75.1% figure. |
| |
| ==== 3. ''ethics.harmMitigation'' → families ==== | ==== 3. ethics.harmMitigation → families ==== |
| |
| Eleven families, non-exclusive. **Residue 1,069 of 3,186 (33.6%).** This fold is **diagnostic only — no folded harm-mitigation figure appears on the content page**; the page uses only the non-null count (71.2%) and its per-bucket trend, neither of which depends on the fold. The residue is therefore recorded here by shape rather than in full, and prints with ''node scripts/report_notifying_websites.mjs --residue''. | Eleven families, non-exclusive. **Residue 1,069 of 3,186 (33.6%).** This fold is **diagnostic only — no folded harm-mitigation figure appears on the content page**; the page uses only the non-null count (71.2%) and its per-bucket trend, neither of which depends on the fold. The residue is therefore recorded here by shape rather than in full, and prints with ''node scripts/report_notifying_websites.mjs %%--residue%%''. |
| |
| Shape of the 1,069, read from the first ~60 entries and a shuffled sample of 45: almost entirely **study-specific harm limitation with no generalisable family** — "Used a wired testbed and 900-MHz transmitter to minimize GPS interference", "Purchased unlimited daily plans so test traffic was not counted", "Suppressed uploads from BitTorrent clients to avoid distributing illegal software", "Captured only four bytes of application payload to minimise privacy impact". A first attempt with mutually-exclusive first-match-wins rules and narrower regexes gave 46.5% residue and a nonsensical zero in one family; broadening the regexes and making families non-exclusive took it to 33.6%. **It was not driven lower, because the remainder is genuinely one-off.** Anyone wanting a publishable harm-mitigation taxonomy should treat that residue as the work, not as noise. | Shape of the 1,069, read from the first ~60 entries and a shuffled sample of 45: almost entirely **study-specific harm limitation with no generalisable family** — "Used a wired testbed and 900-MHz transmitter to minimize GPS interference", "Purchased unlimited daily plans so test traffic was not counted", "Suppressed uploads from BitTorrent clients to avoid distributing illegal software", "Captured only four bytes of application payload to minimise privacy impact". A first attempt with mutually-exclusive first-match-wins rules and narrower regexes gave 46.5% residue and a nonsensical zero in one family; broadening the regexes and making families non-exclusive took it to 33.6%. **It was not driven lower, because the remainder is genuinely one-off.** Anyone wanting a publishable harm-mitigation taxonomy should treat that residue as the work, not as noise. |
| |
| ==== 4. The campaign classification (''scripts/notify_fold.mjs'') ==== | ==== 4. The campaign classification (scripts/notify_fold.mjs) ==== |
| |
| The one fold that is a hand list rather than a regex family list, and the reason is in the file: the corpus signal for "the authors ran a campaign" is a sentence, not a name. ''ethics.notifiedAffectedParties == yes'' does not distinguish a bulk campaign to thousands of strangers from one email to Google's security team, and those are different methods with different rates. | The one fold that is a hand list rather than a regex family list, and the reason is in the file: the corpus signal for "the authors ran a campaign" is a sentence, not a name. ''ethics.notifiedAffectedParties == yes'' does not distinguish a bulk campaign to thousands of strangers from one email to Google's security team, and those are different methods with different rates. |
| Inclusion threshold, applied by hand: the authors notified parties they did not already know, at a scale where the contact had to be looked up, //and// reported a delivery, response or remediation outcome. Rough scale floor ≥100 parties, which is why PETS 2022's 40-organisation SAR re-test is in the rejected list and quoted only in prose. | Inclusion threshold, applied by hand: the authors notified parties they did not already know, at a scale where the contact had to be looked up, //and// reported a delivery, response or remediation outcome. Rough scale floor ≥100 parties, which is why PETS 2022's 40-organisation SAR re-test is in the rejected list and quoted only in prose. |
| |
| An earlier, wider first-pass scan (a looser regex, 197 candidates) was used to seed the 2026-08-13 hand list; the script reports that 3 rejections fall outside both committed rules — ''how-website-owners-face-privacy-issues…'', ''from-whois-to-whowas…'' and ''the-cve-wayback-machine…'' — kept in ''REJECTED'' because they are papers a future run will want the reason for. **The recall lesson of 2026-09-04:** the narrow rule had a precision of 28/179 and, against the union of everything found, a recall of 28/32; the two rules together still missed one campaign that a topical grep found. A third rule — say, any sentence with a notification verb and a five-digit or larger count — would find more. That is the residual uncertainty behind "32 campaigns". | An earlier, wider first-pass scan (a looser regex, 197 candidates) was used to seed the 2026-08-13 hand list; the script reports that 3 rejections fall outside both committed rules — ''how-website-owners-face-privacy-issues…'', ''from-whois-to-whowas…'' and ''the-cve-wayback-machine…'' — kept in ''REJECTED'' because they are papers a future run will want the reason for. **The recall lesson of 2026-09-04:** the narrow rule had a precision of 28/179 and caught 28 of the 32 campaigns now known; **true recall is unmeasured**, because the 32 are the union of what the rules and two ad-hoc greps found, not an independent gold set, so the miss count is a lower bound. The two committed rules together still miss one of the 32. A third rule — say, any sentence with a notification verb and a five-digit or larger count — would find more. That is the residual uncertainty behind "32 campaigns". |
| |
| **Rejections, with the deciding reason** (this is the part that stops the next run re-adding them): | **Rejections, with the deciding reason** (this is the part that stops the next run re-adding them): |
| | ''revisiting-identification-issues-in-gdpr-right-of-access-policies-a-technical-an'' | PETS 2022 — 40 organisations re-tested after disclosure. Under the ≥100-party floor; quoted in prose only. | | | ''revisiting-identification-issues-in-gdpr-right-of-access-policies-a-technical-an'' | PETS 2022 — 40 organisations re-tested after disclosure. Under the ≥100-party floor; quoted in prose only. | |
| |
| **The seven campaigns not on the content page's rates table**, because they report a volume sent but no response or remediation figure: ''freely-given-consent…'' (CCS 2022, 1,127 developers), ''extended-hell-o…'' (USENIX Sec 2023), ''dancer-in-the-dark…'' (USENIX Sec 2024, 19% response — this one //is// quoted in prose), ''beyond-exploit-scanning…'' (USENIX Sec 2025, 4,983 emails), ''hey-your-secrets-leaked…'' (IEEE S&P 2025, 3,906 emails), ''beyond-the-horizon…'' (IEEE S&P 2025, 15,837 ASes), and — added 2026-09-04 — {[zuo2022_playing]} (USENIX Sec 2022, 5,494 game developers emailed via their Play Store address; "Many of the developers have acknowledged our findings", no count). | **The six campaigns not on the content page's rates table**, because they report a volume sent but no response or remediation figure: ''freely-given-consent…'' (CCS 2022, 1,127 developers), ''dancer-in-the-dark…'' (USENIX Sec 2024, 19% response — this one //is// quoted in prose), ''beyond-exploit-scanning…'' (USENIX Sec 2025, 4,983 emails), ''hey-your-secrets-leaked…'' (IEEE S&P 2025, 3,906 emails), ''beyond-the-horizon…'' (IEEE S&P 2025, 15,837 ASes), and — added 2026-09-04 — {[zuo2022_playing]} (USENIX Sec 2022, 5,494 game developers emailed via their Play Store address; "Many of the developers have acknowledged our findings", no count). |
| |
| So the rates table has **26 rows: 25 of the 32 hand-classified campaigns, plus {[stock2018_didnt]}**, which is not in ''CAMPAIGNS'' because its full text is not in the corpus (see below) and the fold only classifies papers the scan could read. ''catch-22…'' and ''seeking-nonsense…'' are on the table for their channel, not for a rate. 25 + 7 = 32. | So the rates table has **27 rows: 26 of the 32 hand-classified campaigns, plus {[stock2018_didnt]}**, which is not in ''CAMPAIGNS'' because its full text is not in the corpus (see below) and the fold only classifies papers the scan could read. ''catch-22…'' and ''seeking-nonsense…'' are on the table for their channel, not for a rate. 26 + 6 = 32. (''extended-hell-o…'', USENIX Sec 2023, was listed among the not-shown on 2026-08-13 although ''CAMPAIGNS'' records its 39.7% remediation figure; the 2026-09-04 figures reviewer caught the carry-over and it is now row {[blechschmidt2023_hello]} on the table.) |
| |
| ==== The 144 candidates that were unreviewed on 2026-08-13, and the 78 from the recall probe — all classified 2026-09-04 ==== | ==== The 144 candidates that were unreviewed on 2026-08-13, and the 78 from the recall probe — all classified 2026-09-04 ==== |
| |
| How they were read. ''scripts/notify_residue_context.mjs'' dumped, for each candidate, **every sentence in ''paper.cols.txt'' that carries a notification-act verb** (notify/disclose/report to/contact/reach out/inform, minus the noise senses: information disclosure, self-disclosure, push notification, disclosure date), with its line number — 5,584 lines for the 144 papers, tightened to 1,701 by requiring a number or an outcome word in the same sentence. Those were read in full by the orchestrator. Anything that looked like a campaign, or was cited on the page for some other reason, was then read in full: nine papers by four Sonnet sub-agents (''notes/notify_read_batch1.md''–''batch4.md''), eight more by the orchestrator from the relevant passages. The tag on each rejection records which: ''[sentences]'' or ''[read]''. **201 of the 229 rejections are sentence-level screens** — a paper that describes its campaign without a notification verb in the same sentence as a number would have slipped past. | How they were read. ''scripts/notify_residue_context.mjs'' dumped, for each candidate, **every sentence in ''paper.cols.txt'' that carries a notification-act verb** (notify/disclose/report to/contact/reach out/inform, minus the noise senses: information disclosure, self-disclosure, push notification, disclosure date), with its line number — 5,584 lines for the 144 papers, tightened to 1,701 by requiring a number or an outcome word in the same sentence. Those were read in full by the orchestrator. **The 78 probe candidates were screened differently and more thinly: on the one to three probe-matching sentences the probe itself printed (''out/notify_recall_probe-output.txt''), not on every notification-verb sentence.** Anything that looked like a campaign, or was cited on the page for some other reason, was then read in full: nine papers by four Sonnet sub-agents (''notes/notify_read_batch1.md''–''batch4.md''), eight more by the orchestrator from the relevant passages. The tag on each rejection records which: ''[sentences]'' or ''[read]''. **201 of the 229 rejections are sentence-level screens (126 on all notification-verb sentences, 75 on the probe sentences only); 28 rest on a full read** — a paper that describes its campaign without a notification verb in the same sentence as a number would have slipped past. |
| |
| Inclusion rule, unchanged from 2026-08-13: the authors notified parties they did not already know, at a scale where the contact had to be looked up (roughly ≥100 parties), and reported a delivery, response or remediation outcome. Two judgement calls at the edge, both recorded in the fold file: ''seeking-nonsense…'' (IEEE S&P 2016) is in because a national CERT notified the organisations on the authors' behalf and 27 fixes are reported, even though the denominator is not — the same pattern as ''catch-22…''; ''demystifying-rpki-invalid-prefixes…'' (NDSS 2026) is in although its mail asked for confirmation rather than a fix, because it is the only 2025–2026 delivery figure for RIR WHOIS contacts in the corpus and the page says what it is. | Inclusion rule, unchanged from 2026-08-13: the authors notified parties they did not already know, at a scale where the contact had to be looked up (roughly ≥100 parties), and reported a delivery, response or remediation outcome. Two judgement calls at the edge, both recorded in the fold file: ''seeking-nonsense…'' (IEEE S&P 2016) is in because a national CERT notified the organisations on the authors' behalf and 27 fixes are reported, even though the denominator is not — the same pattern as ''catch-22…''; ''demystifying-rpki-invalid-prefixes…'' (NDSS 2026) is in although its mail asked for confirmation rather than a fix, because it is the only 2025–2026 delivery figure for RIR WHOIS contacts in the corpus and the page says what it is. |
| portrait-of-a-privacy-invasion :: [sentences] PETS 2015 — users disclosing relationship status. | portrait-of-a-privacy-invasion :: [sentences] PETS 2015 — users disclosing relationship status. |
| talos-neutralizing-vulnerabilities-with-security-workarounds-for-rapid-response :: [sentences] IEEE S&P 2016 — patch timing after public disclosure from CVE data. | talos-neutralizing-vulnerabilities-with-security-workarounds-for-rapid-response :: [sentences] IEEE S&P 2016 — patch timing after public disclosure from CVE data. |
| weak-keys-remain-widespread-in-network-devices :: [read] IMC 2016 — vendor disclosure: 61 vendors in 2012 (37 with RSA issues: 5 public advisory, 11 private response, 12 auto-response, 9 no response) and 5 more in May 2016 (2 acknowledged, 1 advisory). Manufacturers rather than operators, and under the 100-party floor; quoted on the page for 'little correlation with end-user security'. | weak-keys-remain-widespread-in-network-devices :: [read] IMC 2016 — vendor disclosure: 61 vendors in 2012 (37 with RSA issues: 5 public advisory, 11 private response, 3 auto-response, 18 no response — Table 2 is a flattened four-column layout; the 12/9 reading of 2026-09-04 was corrected to 3/18 by a reviewer working from the PDF's column positions, and the caption's 'about half acknowledged receipt' (19 of 37) confirms it) and 5 more in May 2016 (2 acknowledged, 1 advisory). Manufacturers rather than operators, and under the 100-party floor; quoted on the page for 'little correlation with end-user security'. |
| towards-mining-latent-client-identifiers-from-network-traffic :: [sentences] PETS 2016 — Apple Push Notification traffic. | towards-mining-latent-client-identifiers-from-network-traffic :: [sentences] PETS 2016 — Apple Push Notification traffic. |
| if-you-are-not-paying-for-it-you-are-the-product-how-much-do-advertisers-pay-to :: [sentences] IMC 2017 — RTB winning-price notifications. | if-you-are-not-paying-for-it-you-are-the-product-how-much-do-advertisers-pay-to :: [sentences] IMC 2017 — RTB winning-price notifications. |
| # FOUND OUTSIDE BOTH RULES (1) | # FOUND OUTSIDE BOTH RULES (1) |
| the-security-lottery-measuring-client-side-web-security-inconsistencies :: USENIX 2022 — delivery-failed for 197 of 256 domains; 21 non-automatic answers, 7 confirmed and fixed or explained; second round May 2022: 184 still affec | the-security-lottery-measuring-client-side-web-security-inconsistencies :: USENIX 2022 — delivery-failed for 197 of 256 domains; 21 non-automatic answers, 7 confirmed and fixed or explained; second round May 2022: 184 still affec |
| # REJECTED (75), all screened at sentence level | # REJECTED (75), all screened on the probe-matching sentences only |
| botmagnifier-locating-spambots-on-the-internet :: bots contacted C&C servers | botmagnifier-locating-spambots-on-the-internet :: bots contacted C&C servers |
| peerpress-utilizing-enemies-p2p-strength-against-them :: probing accuracy | peerpress-utilizing-enemies-p2p-strength-against-them :: probing accuracy |
| ===== Quotes spot-checked ===== | ===== Quotes spot-checked ===== |
| |
| ==== ''ethics.evidence.quote'' against the source text ==== | ==== ethics.evidence.quote against the source text ==== |
| |
| Seven papers with ''notifiedAffectedParties == yes ∧ platforms ∋ web'', picked deterministically one per year across 2013–2026, checked after de-hyphenating and whitespace-collapsing both the quote and ''paper.cols.txt'': | Seven papers with ''notifiedAffectedParties == yes ∧ platforms ∋ web'', picked deterministically one per year across 2013–2026, checked after de-hyphenating and whitespace-collapsing both the quote and ''paper.cols.txt'': |
| ==== Quotes added on 2026-09-04 ==== | ==== Quotes added on 2026-09-04 ==== |
| |
| Every quote written onto the content page in this revision, plus the figures behind the new table rows, is in ''out/notify_quotes_20260904.json'' — **67 quotes across 21 papers** — and ''scripts/notify_quotecheck2.mjs'' re-checks them against ''paper.cols.txt'' after normalising both sides (de-hyphenation, straight quotes, non-ASCII dropped, whitespace collapsed). Result on 2026-09-04: **67 EXACT, 0 MISSING** (''out/notify_quotecheck2-output.txt''). Five of the 67 are short fragments because the full sentence is column-spliced in ''paper.cols.txt'' and only exists interleaved with another column: the Alexa paper's "111 (45.12%) no longer pose a threat" and "whenever we have their contact details"; the SEISE paper's whole disclosure paragraph (lines 1668–1678 interleave with a Related-Work paragraph about Evilseed); and the ASI paper's "acknowledgement for 38 disclosures". Each was read in place by the orchestrator. Three normaliser bugs were found and fixed before the check passed — the first version dropped newlines with the non-ASCII characters and reported 54 of 67 missing; the ''sed'' repair then deleted the whitespace collapse. Recorded because a quote check that fails for the wrong reason is easy to "fix" by weakening it. The repaired checker was mutation-tested: a fabricated sentence appended to the JSON is reported MISSING and the exit code is non-zero. | Every quote written onto the content page in this revision, plus the figures behind the new table rows, is in ''out/notify_quotes_20260904.json'' — **69 quotes across 22 papers** — and ''scripts/notify_quotecheck2.mjs'' re-checks them against ''paper.cols.txt'' after normalising both sides (de-hyphenation, straight quotes, non-ASCII dropped, whitespace collapsed). Result on 2026-09-04: **69 EXACT, 0 MISSING** (67 before the figures review added two) (''out/notify_quotecheck2-output.txt''). Five of the 69 are short fragments because the full sentence is column-spliced in ''paper.cols.txt'' and only exists interleaved with another column: the Alexa paper's "111 (45.12%) no longer pose a threat" and "whenever we have their contact details"; the SEISE paper's whole disclosure paragraph (lines 1668–1678 interleave with a Related-Work paragraph about Evilseed); and the ASI paper's "acknowledgement for 38 disclosures". Each was read in place by the orchestrator. Three normaliser bugs were found and fixed before the check passed — the first version dropped newlines with the non-ASCII characters and reported 54 of 67 missing; the ''sed'' repair then deleted the whitespace collapse. Recorded because a quote check that fails for the wrong reason is easy to "fix" by weakening it. The repaired checker was mutation-tested: a fabricated sentence appended to the JSON is reported MISSING and the exit code is non-zero. |
| |
| Sub-agent findings **not** carried onto the page, because the orchestrator re-read the passage and judged them inferences rather than the paper's statement: the ROAlert paper's "52 administrators" (assembled across a 58-line column gap; the page says "52 administrators engaged", which is what the two fragments say, but the denominator for the 52 is not stated and is not implied on the page); the ROAlert "~15% of uncontactable operators" as a "control" (the page calls it a comparison group the paper reports, not a randomised control). Internal inconsistencies the sub-agents flagged and the page carries as the paper states them: the Alexa paper's 45 + 24 + 41 = 110 against its own 111 (stated on the page); the CSP paper's discussion-section denominators of 30 against Section IX-B's 31 (the page uses none of the survey percentages); "Tickets to Hide" printing 11.1% (table) and 11.7% (prose) for the same botnet-C&C rate (neither is on the page). | Sub-agent findings **not** carried onto the page, because the orchestrator re-read the passage and judged them inferences rather than the paper's statement: the ROAlert paper's "52 administrators" (assembled across a 58-line column gap; the page says "52 administrators engaged", which is what the two fragments say, but the denominator for the 52 is not stated and is not implied on the page); the ROAlert "~15% of uncontactable operators" as a "control" (the page calls it a comparison group the paper reports, not a randomised control). Internal inconsistencies the sub-agents flagged and the page carries as the paper states them: the Alexa paper's 45 + 24 + 41 = 110 against its own 111 (stated on the page); the CSP paper's discussion-section denominators of 30 against Section IX-B's 31 (the page uses none of the survey percentages); "Tickets to Hide" printing 11.1% (table) and 11.7% (prose) for the same botnet-C&C rate (neither is on the page). |
| ^ Claim on the page ^ Source ^ How verified ^ | ^ Claim on the page ^ Source ^ How verified ^ |
| | 0.49% of the Tranco top 1M and 1.6% of the top 100K had a valid ''security.txt'' in October–November 2021; only 11.5% of files matched the then-current draft; 84.3% offered an email contact; no notification was sent | Findlay & Abdou, MADweb 2022 (NDSS workshop), DOI ''10.14722/madweb.2022.23014'' | PDF fetched from ''ndss-symposium.org'', text extracted with ''pypdf'' (''out/findlay2022_madweb.txt''), figures read in place. ''WebFetch'' could not read the PDF; the author-copy URL at Carleton 404s. The paper's own WHOIS cross-check — 2,477 WHOIS abuse contacts, "not a single WHOIS abuse contact was found to match a Security.txt contact" — is noted here, not on the page | | | 0.49% of the Tranco top 1M and 1.6% of the top 100K had a valid ''security.txt'' in October–November 2021; only 11.5% of files matched the then-current draft; 84.3% offered an email contact; no notification was sent | Findlay & Abdou, MADweb 2022 (NDSS workshop), DOI ''10.14722/madweb.2022.23014'' | PDF fetched from ''ndss-symposium.org'', text extracted with ''pypdf'' (''out/findlay2022_madweb.txt''), figures read in place. ''WebFetch'' could not read the PDF; the author-copy URL at Carleton 404s. The paper's own WHOIS cross-check — 2,477 WHOIS abuse contacts, "not a single WHOIS abuse contact was found to match a Security.txt contact" — is noted here, not on the page | |
| | 55 weekly scans of the Tranco top 1M, 26 December 2021 to 15 January 2023: top 100 32.0→34.0%, top 1K 16.1→18.8%, top 10K 7.9→9.8%, top 100K 2.4→3.2%, top 1M 0.7→1.0%; Contact field in 89% of files; testing the contacts named as future work | Hilbig, Geras, Kupris, Schreck, //Digital Threats: Research and Practice// 4(3):36, October 2023, DOI ''10.1145/3609234'' | PDF fetched from the authors' lab site (''seclab.cs.hm.edu''), extracted with ''pypdf'' (''out/sectxt_revisited_2023.txt''); Table 2 and Section 6.2 read in place. The list was generated 6 February 2021, a year before the first scan — the paper says so and gives the intersection sizes | | | 42 successful weekly scans of the Tranco top 1M over 55 weeks, 26 December 2021 to 15 January 2023: top 100 32.0→34.0%, top 1K 16.1→18.8%, top 10K 7.9→9.8%, top 100K 2.4→3.2%, top 1M 0.7→1.0%; Contact field in 89% of files; testing the contacts named as future work | Hilbig, Geras, Kupris, Schreck, //Digital Threats: Research and Practice// 4(3):36, October 2023, DOI ''10.1145/3609234'' | PDF fetched from the authors' lab site (''seclab.cs.hm.edu''), extracted with ''pypdf'' (''out/sectxt_revisited_2023.txt''); Table 2 and Section 6.2 read in place. The list was generated 6 February 2021, a year before the first scan — the paper says so and gives the intersection sizes | |
| | A gTLD zone-file scan finds 573,123 of 241,285,150 domains (0.238%) with a ''security.txt'' in 2026, from 82,343 of 151,402,656 (0.054%) in 2021 | [[https://blog.iotdef.com/the-state-of-security-txt-adoption-an-analysis-of-240-million-domains-in-2026/|blog.iotdef.com]], 1 February 2026 | Fetched 2026-09-04. Methodology is stated (gTLD zone files only, no ccTLDs, annual scans, DuckDB over a 68 GB JSONL); **data and code are not published**, so the figure cannot be checked. **This reverses the 2026-08-13 decision to reject iotdef as an adoption-statistics blog**, for one reason: it is the only 2025–2026 figure of any kind, and the page carries it in a footnote labelled as an unverifiable vendor scan and an order of magnitude, never as a citation. A reader who wants a citeable current figure is told there is none | | | A gTLD zone-file scan finds 573,123 of 241,285,150 domains (0.238%) with a ''security.txt'' in 2026, from 82,343 of 151,402,656 (0.054%) in 2021 | [[https://blog.iotdef.com/the-state-of-security-txt-adoption-an-analysis-of-240-million-domains-in-2026/|blog.iotdef.com]], 1 February 2026 | Fetched 2026-09-04. Methodology is stated (gTLD zone files only, no ccTLDs, annual scans, DuckDB over a 68 GB JSONL); **data and code are not published**, so the figure cannot be checked. **This reverses the 2026-08-13 decision to reject iotdef as an adoption-statistics blog**, for one reason: it is the only 2025–2026 figure of any kind, and the page carries it in a footnote labelled as an unverifiable vendor scan and an order of magnitude, never as a citation. A reader who wants a citeable current figure is told there is none | |
| | Six corpus campaigns used ''security.txt'' as a channel and none separates its delivery | ''drakonakis2020_cookie'' (only 23 domains had one), ''ghasemisharif2022_saat'', ''roth2022_security'' (25 of 256), ''czybik2023_lazy'', ''innocenti2025_only'' (first of six contact-point priorities for 55 brokers), ''bhattacharya2026_asi'' (34 of 100) | all six passages read in ''paper.cols.txt''; the six were found by ''grep -a -l -i 'security\.txt''' over every ''paper.cols.txt'' — 13 files mention it at all, listed in ''out/securitytxt_papers.txt'' | | | Six corpus papers that notified used ''security.txt'' as a channel and none separates its delivery | ''drakonakis2020_cookie'' (only 23 domains had one), ''ghasemisharif2022_saat'', ''roth2022_security'' (25 of 256), ''czybik2023_lazy'', ''innocenti2025_only'' (first of six contact-point priorities for 55 brokers), ''bhattacharya2026_asi'' (34 of 100) | all six passages read in ''paper.cols.txt''; the six were found by ''grep -a -l -i 'security\.txt''' over every ''paper.cols.txt'' — 13 files mention it at all, listed in ''out/securitytxt_papers.txt'' | |
| |
| ==== Rejected or not used, 2026-09-04 ==== | ==== Rejected or not used, 2026-09-04 ==== |
| ===== What could not be established ===== | ===== What could not be established ===== |
| |
| * **Whether the 32 hand-classified campaigns are the whole set.** Nothing is unreviewed, but two of the ten campaigns added on 2026-09-04 were caught by neither of the two committed rules and one only by a topical grep, and 201 of 229 rejections were screened at sentence level. A third rule would find more. See //The recall lesson// above. | * **Whether the 32 hand-classified campaigns are the whole set.** Nothing is unreviewed, but two of the ten campaigns added on 2026-09-04 were found by a topical grep rather than by the narrow rule; the probe written afterwards catches one of them, so one campaign (''the-security-lottery'') remains outside both committed rules, and 201 of 229 rejections were screened at sentence level. A third rule would find more. See //The recall lesson// above. |
| * **Any response rate from the corpus schema.** ''ethics.disclosureDetail'' carries a countable ratio in **7 of 2,870** cases. Every rate on the content page came from a paper's results section, read by hand. A schema field for "notification outcome, with denominator" would make this page regenerable; there isn't one. | * **Any response rate from the corpus schema.** ''ethics.disclosureDetail'' carries a countable ratio in **7 of 2,870** cases. Every rate on the content page came from a paper's results section, read by hand. A schema field for "notification outcome, with denominator" would make this page regenerable; there isn't one. |
| * **Whether ''security.txt'' contacts actually work — narrowed on 2026-09-04, not closed.** Six corpus campaigns sent to ''security.txt'' contacts (list above), so the channel has been used; none reports delivery or response for it separately, so the per-channel question stands. What the corpus does answer is coverage: 23 domains ({[drakonakis2020_cookie]}), 25 of 256 ({[roth2022_security]}), 34 of the top-100 services ({[bhattacharya2026_asi]}). {[hilbig2023_securitytxt]} states the delivery test as future work in so many words. | * **Whether ''security.txt'' contacts actually work — narrowed on 2026-09-04, not closed.** Six corpus papers that notified sent to ''security.txt'' contacts (list above; two of them are campaigns in ''CAMPAIGNS'', four are rejected as campaigns), so the channel has been used; none reports delivery or response for it separately, so the per-channel question stands. What the corpus does answer is coverage: 23 domains ({[drakonakis2020_cookie]}), 25 of 256 ({[roth2022_security]}), 34 of the top-100 services ({[bhattacharya2026_asi]}). {[hilbig2023_securitytxt]} states the delivery test as future work in so many words. |
| * **Current ''security.txt'' adoption — closed to the extent the literature allows.** Still no re-measurement in the seven corpus venues after 2021. Two peer-reviewed measurements outside them ({[findlay2022_securitytxt]}, {[hilbig2023_securitytxt]}) run to January 2023 on Tranco, and the page now carries them; the only 2025–2026 figure is a vendor zone scan (0.24%) that the page footnotes as unverifiable. A reader in September 2026 still has no citeable figure newer than January 2023. | * **Current ''security.txt'' adoption — closed to the extent the literature allows.** Still no re-measurement in the seven corpus venues after 2021. Two peer-reviewed measurements outside them ({[findlay2022_securitytxt]}, {[hilbig2023_securitytxt]}) run to January 2023 on Tranco, and the page now carries them; the only 2025–2026 figure is a vendor zone scan (0.24%) that the page footnotes as unverifiable. A reader in September 2026 still has no citeable figure newer than January 2023. |
| * **Whether the framing effect is real.** {[maass2021_effective]} found a large, significant fine-framing effect; {[utz2023_comparing]} found none. Different countries, issues, media and populations. The page presents the contradiction rather than picking a side. Resolving it needs a study that varies framing while holding medium and jurisdiction fixed. | * **Whether the framing effect is real.** {[maass2021_effective]} found a large, significant fine-framing effect; {[utz2023_comparing]} found none. Different countries, issues, media and populations. The page presents the contradiction rather than picking a side. Resolving it needs a study that varies framing while holding medium and jurisdiction fixed. |
| ===== Reviewer findings ===== | ===== Reviewer findings ===== |
| |
| <WRAP todo>**2026-09-04 revision: published before its review layer completed.** Three Sonnet reviewers (figures vs script, citations and quotes, external currency) were launched on the drafts and had not reported when the run was terminated by the harness; the Fable generic pass was not run. Every corpus figure in this revision comes from a fresh run of ''scripts/report_notifying_websites.mjs'' (deterministic, re-verified), all 67 added quotes pass ''scripts/notify_quotecheck2.mjs'' (mutation-tested), both pages pass ''check_wrap.mjs'' and ''check_tables.mjs'', and every citekey resolves — but no second pair of eyes has read this revision. The next run should re-run the three focused reviewers and the generic one on the live pages and log their findings here, accepted or rejected. The 2026-08-13 reviewer log below is unchanged.</WRAP> | <WRAP todo>**2026-09-04 revision: published before its review layer completed, then corrected as the reviews arrived.** Three Sonnet reviewers (figures vs script, citations and quotes, external currency) were launched on the drafts and had not reported when the harness forced publication; all three, and the Fable generic pass, reported afterwards and every finding is logged below with what was done. Every corpus figure in this revision comes from a fresh run of ''scripts/report_notifying_websites.mjs'' (deterministic, re-verified), all 67 added quotes pass ''scripts/notify_quotecheck2.mjs'' (mutation-tested), both pages pass ''check_wrap.mjs'' and ''check_tables.mjs'', and every citekey resolves — but no second pair of eyes has read this revision. The next run should re-run the three focused reviewers and the generic one on the live pages and log their findings here, accepted or rejected. The 2026-08-13 reviewer log below is unchanged. **Update, same day:** the external-currency reviewer reported after publication; its findings are logged directly below. The figures reviewer and a verification sub-agent of the citations reviewer reported next (both logged below); the citations reviewer's own summary had not arrived when this was written.</WRAP> |
| | |
| | ==== Fable — generic, 2026-09-04 revision ==== |
| | |
| | Run after the three focused passes and their fixes. Seventeen findings; fourteen accepted, three partly. |
| | |
| | ^ Finding ^ Action ^ |
| | | The lead box said "both randomised, control-arm experiments on network operators … found no significant effect", contradicted by two rows of the page's own table: {[li2016_youve]} and {[durumeric2014_heartbleed]} randomised network-operator contacts and found effects. "The one sentence they will remember." | **ACCEPTED.** Rewritten to the two most recent RCTs on SAV and ROV, with the distinction (expensive, low-visibility configuration changes) and the earlier positive RCTs named. | |
| | | "The one campaign in the corpus at the 100,000 scale" — Utz 2023 (159,035), Durumeric 2014 (150,000) and Li 2016 (760,935) are larger. | **ACCEPTED**, now "the largest fully automated email campaign since {[utz2023_comparing]}". | |
| | | The new {[blechschmidt2023_hello]} row omitted the paper's own funnel (4,484 sent, ≥2,700 bounced, 26 human replies) and its comparison group (bounced domains fell 20.7% vs 39.7%), and marked the control column "—". | **ACCEPTED**, figures verified in ''paper.cols.txt'' lines 943–1001 and filled in, with the paper's own "cannot conclude a causal relation". | |
| | | The rates table's Outcome column mixes remediation, response, delivery and platform removal, and the intro named only the two channel-only exceptions. | **ACCEPTED in part.** One sentence now names the four kinds with example rows. Per-cell tags were not added — each cell already states what it measures. | |
| | | The ''security.txt'' channel row is a section in a table cell and says the corpus counts "agree" although Poteat 2021 and Hilbig 2023 differ by about 2× at the same ranks. | **ACCEPTED in part.** The contradiction is now stated (Alexa vs Tranco; Kaplan–Meier estimate vs snapshots; corpus counts sit with the Tranco series). The cell was **not** moved into its own subsection — a structural change deferred to the next revision, recorded here. | |
| | | "Six campaigns in the corpus used it": four of the six are rejected as campaigns. "23 of the vulnerable domains" has no denominator. | **ACCEPTED**, both pages now say "six corpus papers that notified", and "23 domains (no denominator given)". | |
| | | The script-output caption compared five giants' 80% with Poteat's 3–4% at the top 10K as "an order of magnitude", while the page now carries 32–34% for the top 100. | **ACCEPTED**, compares with both tiers. | |
| | | "Three papers look at what happens after a report arrives" cites four, two of them about disclosure programmes, and omits {[stivala2026_behind]}. | **ACCEPTED**, count fixed and Stivala named; the three-point restructuring was not done. | |
| | | "seven vendors instead of thousands of domains" (Rao's sample is 1,577 domains, 1,262 misconfigured); ">80% unresponsive" in quotation marks is not verbatim; Ryan "recovered SSH host keys from millions of devices" (189 keys from a scan of millions). No cross-link from the earlier "deciding not to notify is defensible" paragraph. | **ACCEPTED**, all four fixed; figures verified in the papers (Rao line 473; Ryan lines 108–109, 944–945). | |
| | | Fix-difficulty row: "the message was identical" overstates — the paper says "fixed template", and its explanation is "We assume that these are often non-trivial to fix"; no control, so churn may differ by error type. | **ACCEPTED**, reworded with the paper's own hedge. | |
| | | Methodology bullet bolded the reassuring half ("Nothing is unreviewed") and described one screening method for two populations that were screened differently. | **ACCEPTED**: the caveat is bolded and the count split 126 / 75 / 28; the provenance paragraph "How they were read" now says the 78 probe candidates were screened on the probe sentences only. | |
| | | The provenance classification code block still said 12 / 9 for weak-keys after the fold was corrected to 3 / 18 — it had been edited, not regenerated. | **ACCEPTED**, regenerated from ''notify_fold.mjs''. The listing's header for the probe rejections now also says "screened on the probe-matching sentences only". | |
| | | "a recall of 28/32 against the union of everything found" is not recall; no gold set exists. | **ACCEPTED**, reworded: true recall unmeasured, the miss count a lower bound. | |
| | | The "What could not be established" bullet contradicted itself about how many campaigns lie outside the committed rules. | **ACCEPTED**, now: two found by grep, the probe catches one of them, one remains outside both rules. | |
| | | The script's sanity line labelled ''the-security-lottery'' as "added from a wider first-pass scan" although the fold records ''caught: 'grep'''. | **ACCEPTED**, string fixed in ''report_notifying_websites.mjs'', outputs regenerated and re-pasted above. | |
| | | "Two of the four figures in disclosureDetail ratios" — seven are listed (pre-existing). The review WRAP note was stale. | **ACCEPTED**, both fixed. | |
| | | Verified and not a problem: the Roth 2020, Nan 2023, Li 2024, Gilad 2017, Liao 2016 and Edu 2022 rows; Ryan's quote; all "Tickets to Hide" figures; Czybik's 5.73% / 1.60% and 111,951; the live render (25 headings, 6 tables, 0 raw citekeys). Verdict: the page answers its question for its reader once the lead box is fixed. | No action. | |
| | |
| | ==== Sonnet — figures against the script, 2026-09-04 revision ==== |
| | |
| | Re-ran both script invocations (byte-identical to the committed outputs), checked every number in sections A–D, the trend table, the count reconciliation (32 = 26 + 6; 179 = 28 + 151; 78 = 3 + 75; 229 = 154 + 75; 201 sentence-level; 13/13/6), all rates-table rows and the new prose against ''paper.cols.txt'', ran the quote checker and ''find_contacts.py''. Roughly 150 figures; five findings. |
| | |
| | ^ Finding ^ Action ^ |
| | | ''extended-hell-o…'' (USENIX Sec 2023) was listed among the campaigns "not on the table because they report no remediation figure", yet ''CAMPAIGNS'' itself records its "decrease of 39.7%". A carry-over from 2026-08-13. | **ACCEPTED.** Added as a table row (quote re-checked, bibliography entry generated from the index with authors from usenix.org); the not-shown count is now six and the table has 27 rows. | |
| | | "61 device vendors — 5 issued a public advisory, 11 answered privately, …": the split is Table 2's 37 RSA-key vendors, not all 61. The fold entry had it right; the page prose dropped the qualifier. | **ACCEPTED**, prose now says "of the 37 with weak RSA keys". | |
| | | The quote JSON carried a quote from ''towards-automated-auditing…'' (gifyu.com) that supports no sentence on the page. | **ACCEPTED in part.** The paper //is// cited (''ghasemisharif2022_saat'', in the security.txt row's list of campaigns that used the file); the quote that supports that claim ("This included collecting websites' security.txt files") was missing from the JSON and is now in it. The gifyu quote stays as the record of why the paper was rejected as a campaign. | |
| | | ''find_contacts.py'' on the page differs from ''notes/find_contacts.py'' in nine lines: ASCII ''--'' on the page against em-dashes in the file. | **REJECTED as a defect** — deliberate and already recorded in the 2026-08-13 log ("a transcribed copy with em-dashes substituted for ASCII"); the reviewer re-ran the downloaded code and it works. | |
| | | Only the NDSS 2026 row carried the provisional asterisk although the legend says "2025–2026". | **ACCEPTED**, the two 2025 rows are now starred too. | |
| | |
| | ==== Sonnet — citations and quotes, 2026-09-04 revision (verification sub-agent) ==== |
| | |
| | Checked six load-bearing attributions against the source text. Five matched: the "Tickets to Hide" figures (2.6%; 72% Netcraft; Spamhaus 60%, 83% and 84% across three categories, which the page brackets as 60–84%; 126,085 → 411 → 4; 30,467 → none); the ROAlert "about 15%" as an observational comparison group, not a randomised arm; every ''bhattacharya2026_asi'' figure and quote; the Hilbig et al. table and its future-work sentence; the Findlay & Abdou 0.49% / 1.6% and dates. Two findings: |
| | |
| | ^ Finding ^ Action ^ |
| | | **Weak-keys Table 2 was mis-reconstructed.** The flattened four-column layout reads 5 public advisory / 11 private response / **3 auto-response / 18 no response**, not 12 / 9. The reviewer re-extracted the PDF in layout mode and cross-checked the caption's "About half of the vendors acknowledged receipt" (5 + 11 + 3 = 19 of 37). | **ACCEPTED.** The batch-4 sub-agent's reconstruction (which it had itself flagged as a reconstruction) was wrong on the second block; the page, the fold entry and this log now say 3 / 18. The 2012 population is 61 vendors notified, 37 of them about RSA keys; the page says both. | |
| | | "55 weekly scans": the paper says 55 weeks with **42 successful scans**. | **ACCEPTED**, reworded on both pages. | |
| | |
| | ==== Sonnet — external currency, 2026-09-04 revision ==== |
| | |
| | ^ Finding ^ Action ^ |
| | | iotdef blog: URL live, every number the provenance table quotes (573,123 / 241,285,150; 82,343 / 151,402,656; DuckDB, zone files, 68 GB, dated 2026-02-01) present in the page body; no data or code published. | No action — confirms the footnote's labelling as an unverifiable vendor scan. | |
| | | DOI ''10.1145/3609234'' resolves (Crossref: DTRAP vol. 4 issue 3, published 2023-09-30); DOI ''10.14722/madweb.2022.23014'' resolves to the MADweb PDF, authors confirmed. | No action. | |
| | | RFC 9116 unchanged, three errata; erratum 7264 (Reported) concerns the case of the ISO 8601 example in the ''Expires'' field, so the page's "none touching the field list" is loose but not wrong. | **NOTED, no change**: the field names the script parses are unaffected. | |
| | | RFC 2142, ICANN RDAP announcement, IANA bootstrap (publication 2026-07-23, 590 services), RIPEstat (build v0.11.13-2026.09.03), HackerOne Disclosure Assistance (11 June 2024), Shadowserver (201 CSIRTs, 175 countries), CERT/CC 45 days, Project Zero 90+30 and the blogspot redirect, all five venue CfP quotes (usenix.org fetched with a browser User-Agent, no 403): verbatim as the page states. | No action. | |
| | | EUR-Lex returned HTTP 202 with an empty body to every automated fetch on 2026-09-04; the NIS2 Article 12 sentence was confirmed only against three secondary legal mirrors. | **NOTED**: the 2026-08-13 primary fetch stands; the page's quote is unchanged. Re-fetch the primary when EUR-Lex answers. | |
| | | Abusix, PeeringDB API, Tranco, Search Console security-issue messages, 360 Store and APKPure: none renamed or discontinued. | No action. | |
| | | A newer peer-reviewed ''security.txt'' data point exists: "Do (Not) Tell Me About My Insecurities: Assessing the Status Quo of Coordinated Vulnerability Disclosure in Germany Amid New EU Cybersecurity Regulations", EuroUSEC 2025, DOI ''10.1109/EuroUSEC69254.2025.00020'' — 10 of the 40 DAX companies had a ''security.txt'' in 2023, with 25 files added by January 2025. | **NOT ADDED to the content page** in this revision: the orchestrator did not open the paper, and a 40-company national blue-chip sample does not answer the page's question about the top million. Recorded here as the first thing the next run should read; it would be the only post-January-2023 peer-reviewed figure and fits the page's NIS2 framing. The reviewer found no 2024–2026 web-scale re-measurement anywhere, so the page's "no citeable figure newer than January 2023" stands. | |
| |
| Four reviewers, all told the context might not be exhaustive, all given the page text, the report script, its output, and these notes. Three focused passes ran in parallel first; the generic pass ran after their findings were applied. | Four reviewers, all told the context might not be exhaustive, all given the page text, the report script, its output, and these notes. Three focused passes ran in parallel first; the generic pass ran after their findings were applied. |
| |
| [[practices:notifying_websites|← back to the content page]] · [[literature:corpus|corpus-level provenance]] | [[practices:notifying_websites|← back to the content page]] · [[literature:corpus|corpus-level provenance]] |
| | |
| | ===== Markup sweep, 2026-09-17 ===== |
| | |
| | Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving. |
| |
