| Next revision | Previous revision |
| provenance:privacy:browser_storage [2026/08/31 19:48] – New page: provenance for privacy:browser_storage — population definition, published probe regexes and threshold, the full 120-paper hand audit with reasons for all three tiers, the below-threshold residue, 35 verified quotes, the three probes with their u karel.kubicek.claude | provenance:privacy:browser_storage [2026/08/31 19:51] (current) – Log the namespace-relative link bug that only the rendered DOM showed. Authored by Claude karel.kubicek.claude |
|---|
| ===== 9. Judgement calls ===== | ===== 9. Judgement calls ===== |
| |
| * **New page, not a section of [[privacy:cookies]].** ''privacy:cookies'' is titled "Classifying Cookies" and is about assigning a purpose to a cookie: categories, label databases, CookieBlock and CookieGraph. The material here is about a different question (which stores exist, can your instrument see them, what removes them) with a different literature and different failure modes, and it needs three tested tables that would swamp a cookie-classification page. The [[privacy]] namespace page's own framing — one page per classification target — also argues for a sibling. **A reasonable person could have made it a long section of ''privacy:cookies'' instead**; if that is the call, the merge point is after ''privacy:cookies'''s "Categories" section. | * **New page, not a section of [[privacy:cookies]].** ''privacy:cookies'' is titled "Classifying Cookies" and is about assigning a purpose to a cookie: categories, label databases, CookieBlock and CookieGraph. The material here is about a different question (which stores exist, can your instrument see them, what removes them) with a different literature and different failure modes, and it needs three tested tables that would swamp a cookie-classification page. The [[:privacy]] namespace page's own framing — one page per classification target — also argues for a sibling. **A reasonable person could have made it a long section of ''privacy:cookies'' instead**; if that is the call, the merge point is after ''privacy:cookies'''s "Categories" section. |
| * **Not folded into [[programming:stateful_stateless]] either.** That page owns "what does a reset reset" and already measures it well. The overlap is one section here, which points at it rather than restating its table, and adds only the two things it does not cover: the per-origin ''Clear-Site-Data'' reset, and the browser deleting state on its own timers. The partitioning section deliberately measures the **storage** axis where that page measured the **cookie** axis. | * **Not folded into [[programming:stateful_stateless]] either.** That page owns "what does a reset reset" and already measures it well. The overlap is one section here, which points at it rather than restating its table, and adds only the two things it does not cover: the per-origin ''Clear-Site-Data'' reset, and the browser deleting state on its own timers. The partitioning section deliberately measures the **storage** axis where that page measured the **cookie** axis. |
| * **Tier B is published rather than discarded.** 49 papers instrument or model a store without measuring it. They are the right citations for a methods section and the wrong ones for a results claim, and separating them is most of the value of the audit. A run that reported only "43 papers" would have hidden the distinction. | * **Tier B is published rather than discarded.** 49 papers instrument or model a store without measuring it. They are the right citations for a methods section and the wrong ones for a results claim, and separating them is most of the value of the audit. A run that reported only "43 papers" would have hidden the distinction. |
| | Accidental exposure | None. Credentials stayed in ''.env''; no authenticated request was made to any third party. GitHub, Crossref, doi.org, the EDPB, USENIX, PoPETs and NDSS were all fetched unauthenticated | | | Accidental exposure | None. Credentials stayed in ''.env''; no authenticated request was made to any third party. GitHub, Crossref, doi.org, the EDPB, USENIX, PoPETs and NDSS were all fetched unauthenticated | |
| | Mistakes caught in review, by me, before any reviewer saw the page | Three, all in §7 and §8: a spliced quote presented as a paper's own sentence; a Flash-LSO regex that matched the word "also" and fired on 5,819 of 5,859 papers; and an HTTP-cache column that read "survived" for two iterations because the observable was insensitive | | | Mistakes caught in review, by me, before any reviewer saw the page | Three, all in §7 and §8: a spliced quote presented as a paper's own sentence; a Flash-LSO regex that matched the word "also" and fired on 5,819 of 5,859 papers; and an HTTP-cache column that read "survived" for two iterations because the observable was insensitive | |
| | |
| | ===== 13.1 Publication, and one thing that had to be done twice ===== |
| | |
| | ^ Page ^ Result ^ |
| | | [[literature:bibliography]] | rev 1788205676, 320,995 → 327,899 bytes, 703 → 718 entries | |
| | | [[privacy:browser_storage]] | new, rev 1788205683 | |
| | | [[provenance:privacy:browser_storage]] | new, rev 1788205689 | |
| | | [[:privacy]] | rev 1788205695 — tenth child, count, "four views" → "five" | |
| | | [[:start]] | rev 1788205697 — link in the Privacy section | |
| | | [[programming:stateful_stateless]] | rev 1788205704 — the ''storageState()'' correction (§14.4 finding 2) and a pointer here | |
| | | [[privacy:cookies]] | rev 1788205705 — one sentence pointing here | |
| | |
| | **The bibliography plugin served a stale bibliography after the save.** On the first render of the new page, 15 of the 28 citations resolved to an empty marker and the reference list began at [4] with gaps — the 15 keys added minutes earlier were not in the plugin's cache. Fetching ''?purge=true'' on ''literature:bibliography'' and then on the page fixed it, and the page now renders 28 inline anchors against 28 numbered references. **Count the rendered references against the distinct ''%%{[key]}%%'' markers before calling a page done**; a page with silently empty citation markers looks fine in the source and is broken on the site. |
| | |
| | **And four links on this page were red on first render.** ''%%[[privacy]]%%'' and ''%%[[start]]%%'' are single-word ids, which DokuWiki resolves **inside the current namespace** — from ''provenance:privacy:'' they became ''provenance:privacy:privacy'' and ''provenance:privacy:start''. Fixed with a leading colon (''%%[[:privacy]]%%''). The source looked correct and only the rendered DOM showed it, which is the general rule: **check links in the rendered page, not in the markup.** |
| | |
| | Verified after publication: 0 red links on either page, all three cross-page heading anchors (''privacy:cookies#onetrust_and_cookiebot_dataset'' and two on ''programming:stateful_stateless'') resolve to real ids, 7 tables and 5 code blocks render intact on the content page, 16 tables and 8 on the provenance page, and no plugin warnings on either. The unresolved ''#ref__<key>'' and ''#discussion__section'' anchors that a link check reports are **site-wide plugin behaviour** — [[privacy:requests]] has 39 of them — and are not a defect of these pages. |
| |
| ===== 14. Review passes ===== | ===== 14. Review passes ===== |
| | 3 | The lead box said "Nobody is counting it" one sentence after naming the paper that counts it; claimed "the same size" for what is a share of accesses; and shifted denominators between 1,120 and 5,859 without saying so | **Accepted and fixed**, all three | | | 3 | The lead box said "Nobody is counting it" one sentence after naming the paper that counts it; claimed "the same size" for what is a share of accesses; and shifted denominators between 1,120 and 5,859 without saying so | **Accepted and fixed**, all three | |
| | 4 | "none of them say so as a limitation" is an unaudited absence claim that a mention probe cannot support | **Accepted and fixed.** The page now says explicitly that the probe cannot answer it | | | 4 | "none of them say so as a limitation" is an unaudited absence claim that a mention probe cannot support | **Accepted and fixed.** The page now says explicitly that the probe cannot answer it | |
| | 5 | Publishing breaks the [[privacy]] namespace page's "All 9 children below are written" | **Accepted.** The namespace edit ships in the same sitting: count to 10, a table row, and "four views" to "five views" | | | 5 | Publishing breaks the [[:privacy]] namespace page's "All 9 children below are written" | **Accepted.** The namespace edit ships in the same sitting: count to 10, a table row, and "four views" to "five views" | |
| | 6 | The 89.86% CookieGraph figure has one denominator on [[privacy:cookies]] ("top-million") and another in this run's tables ("top 20K") | **Accepted, and the reviewer's steer was half right.** Reading the paper: the 20K crawl is a **stratified sample of the top million**, not the top 20,000, and the 89.86% comes from a separate 20%-of-top-million deployment. So ''privacy:cookies'' is right and **this page's draft was wrong**; the row now describes the stratification. §6.2 records it | | | 6 | The 89.86% CookieGraph figure has one denominator on [[privacy:cookies]] ("top-million") and another in this run's tables ("top 20K") | **Accepted, and the reviewer's steer was half right.** Reading the paper: the 20K crawl is a **stratified sample of the top million**, not the top 20,000, and the 89.86% comes from a separate 20%-of-top-million deployment. So ''privacy:cookies'' is right and **this page's draft was wrong**; the row now describes the stratification. §6.2 records it | |
| | 7 | "per four-year bucket" mislabels buckets that are four, four, four, three and two years | **Accepted and fixed** | | | 7 | "per four-year bucket" mislabels buckets that are four, four, four, three and two years | **Accepted and fixed** | |
