| Both sides previous revisionPrevious revision | |
| provenance:practices:notifying_websites [2026/09/04 13:10] – Log the Fable generic review (17 findings); regenerate the classification block and script output; recall wording; screening-level split. Authored by Claude karel.kubicek.claude | provenance:practices:notifying_websites [2026/09/17 07:23] (current) – Markup rendering sweep: wrap escapes, CLI flag typography, and heading quotes. Authored by Claude. karel.kubicek.claude |
|---|
| ===== Report script and its unedited output ===== | ===== Report script and its unedited output ===== |
| |
| Run as ''node scripts/report_notifying_websites.mjs''. Flags: ''--wiki'' for DokuWiki tables, ''--list'' for the hand-classified campaigns and every rejection with its reason, ''--quotes'' for ethics evidence quotes, ''--residue'' for every unmapped fold entry and every unreviewed candidate (none, as of 2026-09-04). The block below is the unedited output of a fresh run on 2026-09-04 (''out/notifying_websites-output-20260904.txt''); sections A–D are byte-identical to the 2026-08-13 run, section E changed. | Run as ''node scripts/report_notifying_websites.mjs''. Flags: ''%%--wiki%%'' for DokuWiki tables, ''%%--list%%'' for the hand-classified campaigns and every rejection with its reason, ''%%--quotes%%'' for ethics evidence quotes, ''%%--residue%%'' for every unmapped fold entry and every unreviewed candidate (none, as of 2026-09-04). The block below is the unedited output of a fresh run on 2026-09-04 (''out/notifying_websites-output-20260904.txt''); sections A–D are byte-identical to the 2026-08-13 run, section E changed. |
| |
| <WRAP todo>''out/notifying_websites-output.txt'' in the workdir is **two concatenated runs**: the plain run followed by the ''--list'' run, which repeats the plain output before adding the campaign list. A ''diff'' against a single fresh invocation therefore shows a few hundred spurious extra lines, and this misled one reviewer. Do not hard-code the split point — it moves whenever a table row is added. Derive it: ''BASE=$(node scripts/report_notifying_websites.mjs | wc -l)'', then ''head -$BASE'' and ''tail -n +$((BASE+1))'' each match a fresh run byte-for-byte. As of the 2026-09-04 revision ''BASE'' is 168 (''out/notifying_websites-output-20260904.txt'' is a single plain run; ''out/notifying_websites-output-list-20260904.txt'' is a single ''--list'' run). The script itself is deterministic — re-verified 2026-09-04.</WRAP> | <WRAP todo>''out/notifying_websites-output.txt'' in the workdir is **two concatenated runs**: the plain run followed by the ''%%--list%%'' run, which repeats the plain output before adding the campaign list. A ''diff'' against a single fresh invocation therefore shows a few hundred spurious extra lines, and this misled one reviewer. Do not hard-code the split point — it moves whenever a table row is added. Derive it: ''BASE=$(node scripts/report_notifying_websites.mjs | wc -l)'', then ''head -$BASE'' and ''tail -n +$((BASE+1))'' each match a fresh run byte-for-byte. As of the 2026-09-04 revision ''BASE'' is 168 (''out/notifying_websites-output-20260904.txt'' is a single plain run; ''out/notifying_websites-output-list-20260904.txt'' is a single ''%%--list%%'' run). The script itself is deterministic — re-verified 2026-09-04.</WRAP> |
| |
| Sections of the script, so a figure on the content page can be traced to the block that produced it: | Sections of the script, so a figure on the content page can be traced to the block that produced it: |
| * **D** — ''ethics.disclosureDetail'' folded into channel and outcome families with residue, plus every entry carrying a countable ratio | * **D** — ''ethics.disclosureDetail'' folded into channel and outcome families with residue, plus every entry carrying a countable ratio |
| * **E** — full-text candidate scan (narrow rule and, since 2026-09-04, the wide recall probe), hand classification, and the unreviewed residue | * **E** — full-text candidate scan (narrow rule and, since 2026-09-04, the wide recall probe), hand classification, and the unreviewed residue |
| * **F** — (''--quotes'') ethics evidence quotes for web papers with ''notifiedAffectedParties == yes'' | * **F** — (''%%--quotes%%'') ethics evidence quotes for web papers with ''notifiedAffectedParties == yes'' |
| |
| <code> | <code> |
| Free-text fields agree run-to-run on roughly 20% of exact strings, so nothing here is aggregated by exact string. Three folds were written, in ''scripts/report_notifying_websites.mjs'' and ''scripts/notify_fold.mjs''. | Free-text fields agree run-to-run on roughly 20% of exact strings, so nothing here is aggregated by exact string. Three folds were written, in ''scripts/report_notifying_websites.mjs'' and ''scripts/notify_fold.mjs''. |
| |
| ==== 1. ''ethics.disclosureDetail'' → channel families ==== | ==== 1. ethics.disclosureDetail → channel families ==== |
| |
| Nine regex families, **not mutually exclusive** (a paper that told a CERT and the vendor belongs in both; papers counted once per family). Published on the content page as a ranking, never as adoption rates. | Nine regex families, **not mutually exclusive** (a paper that told a CERT and the vendor belongs in both; papers counted once per family). Published on the content page as a ranking, never as adoption rates. |
| * ''hosting provider / ISP / upstream'' also matches the bare token ''registrar'', which overlaps the WHOIS family. Both are under 1.5% and reported as a ranking, so the overlap is stated rather than resolved. | * ''hosting provider / ISP / upstream'' also matches the bare token ''registrar'', which overlaps the WHOIS family. Both are under 1.5% and reported as a ranking, so the overlap is stated rather than resolved. |
| |
| ==== 2. ''ethics.disclosureDetail'' → outcome families ==== | ==== 2. ethics.disclosureDetail → outcome families ==== |
| |
| Five families, non-exclusive. Residue 2,155 of 2,870 (75.1%), published above. Not used on the content page except as the 75.1% figure. | Five families, non-exclusive. Residue 2,155 of 2,870 (75.1%), published above. Not used on the content page except as the 75.1% figure. |
| |
| ==== 3. ''ethics.harmMitigation'' → families ==== | ==== 3. ethics.harmMitigation → families ==== |
| |
| Eleven families, non-exclusive. **Residue 1,069 of 3,186 (33.6%).** This fold is **diagnostic only — no folded harm-mitigation figure appears on the content page**; the page uses only the non-null count (71.2%) and its per-bucket trend, neither of which depends on the fold. The residue is therefore recorded here by shape rather than in full, and prints with ''node scripts/report_notifying_websites.mjs --residue''. | Eleven families, non-exclusive. **Residue 1,069 of 3,186 (33.6%).** This fold is **diagnostic only — no folded harm-mitigation figure appears on the content page**; the page uses only the non-null count (71.2%) and its per-bucket trend, neither of which depends on the fold. The residue is therefore recorded here by shape rather than in full, and prints with ''node scripts/report_notifying_websites.mjs %%--residue%%''. |
| |
| Shape of the 1,069, read from the first ~60 entries and a shuffled sample of 45: almost entirely **study-specific harm limitation with no generalisable family** — "Used a wired testbed and 900-MHz transmitter to minimize GPS interference", "Purchased unlimited daily plans so test traffic was not counted", "Suppressed uploads from BitTorrent clients to avoid distributing illegal software", "Captured only four bytes of application payload to minimise privacy impact". A first attempt with mutually-exclusive first-match-wins rules and narrower regexes gave 46.5% residue and a nonsensical zero in one family; broadening the regexes and making families non-exclusive took it to 33.6%. **It was not driven lower, because the remainder is genuinely one-off.** Anyone wanting a publishable harm-mitigation taxonomy should treat that residue as the work, not as noise. | Shape of the 1,069, read from the first ~60 entries and a shuffled sample of 45: almost entirely **study-specific harm limitation with no generalisable family** — "Used a wired testbed and 900-MHz transmitter to minimize GPS interference", "Purchased unlimited daily plans so test traffic was not counted", "Suppressed uploads from BitTorrent clients to avoid distributing illegal software", "Captured only four bytes of application payload to minimise privacy impact". A first attempt with mutually-exclusive first-match-wins rules and narrower regexes gave 46.5% residue and a nonsensical zero in one family; broadening the regexes and making families non-exclusive took it to 33.6%. **It was not driven lower, because the remainder is genuinely one-off.** Anyone wanting a publishable harm-mitigation taxonomy should treat that residue as the work, not as noise. |
| |
| ==== 4. The campaign classification (''scripts/notify_fold.mjs'') ==== | ==== 4. The campaign classification (scripts/notify_fold.mjs) ==== |
| |
| The one fold that is a hand list rather than a regex family list, and the reason is in the file: the corpus signal for "the authors ran a campaign" is a sentence, not a name. ''ethics.notifiedAffectedParties == yes'' does not distinguish a bulk campaign to thousands of strangers from one email to Google's security team, and those are different methods with different rates. | The one fold that is a hand list rather than a regex family list, and the reason is in the file: the corpus signal for "the authors ran a campaign" is a sentence, not a name. ''ethics.notifiedAffectedParties == yes'' does not distinguish a bulk campaign to thousands of strangers from one email to Google's security team, and those are different methods with different rates. |
| ===== Quotes spot-checked ===== | ===== Quotes spot-checked ===== |
| |
| ==== ''ethics.evidence.quote'' against the source text ==== | ==== ethics.evidence.quote against the source text ==== |
| |
| Seven papers with ''notifiedAffectedParties == yes ∧ platforms ∋ web'', picked deterministically one per year across 2013–2026, checked after de-hyphenating and whitespace-collapsing both the quote and ''paper.cols.txt'': | Seven papers with ''notifiedAffectedParties == yes ∧ platforms ∋ web'', picked deterministically one per year across 2013–2026, checked after de-hyphenating and whitespace-collapsing both the quote and ''paper.cols.txt'': |
| |
| [[practices:notifying_websites|← back to the content page]] · [[literature:corpus|corpus-level provenance]] | [[practices:notifying_websites|← back to the content page]] · [[literature:corpus|corpus-level provenance]] |
| | |
| | ===== Markup sweep, 2026-09-17 ===== |
| | |
| | Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving. |
| |
