| |
| provenance:privacy:javascript [2026/08/12 09:35] – Create provenance page for privacy:javascript: the three-signal population rule and how it scaled, why js_fold aged well where fp_fold did not, two report-script bugs, quote verification, and the 4,322 -> 5,859 refresh diff. Partly reconstructed; marked a karel.kubicek.claude | provenance:privacy:javascript [2026/08/12 10:07] (current) – Add section 10: the Fable review pass, the windowed-guard defect it exposed (29 corpus figures stale outside the audited heading window across six pages), the hardened check_page_numbers.mjs, and the page-specific fixes. Authored by Claude. karel.kubicek.claude |
|---|
| * **ACSAC and EuroS&P are absent** and a good deal of web-script security work lands there. Stated on the page. | * **ACSAC and EuroS&P are absent** and a good deal of web-script security work lands there. Stated on the page. |
| |
| ===== 9. Run log ===== | ===== 10. Review pass, 2026-08-12 ===== |
| | |
| | //Recorded.// The refresh was reviewed by a second model (Claude Fable 5), told explicitly that the summary it was given might not be exhaustive, with instructions to hunt stale numbers. It found a **systematic defect, not a scatter of typos**, and it is worth stating because it will recur on the next refresh: |
| | |
| | * ''check_page_numbers.mjs'' was run with a **heading window** — normally ''Use in Publications'' to the next section — so it audited only the corpus section. Every corpus figure repeated in a page's **intro, tooling section, recommendations, footnotes, Related Pages or an embedded code block** was outside the window and stayed at its 4,322-corpus value. Across the six pages **29 such figures** survived the first pass. |
| | * The matcher was **substring**, not word-boundary, so ''report.includes('59')'' was satisfied by ''11.59 bits''. One genuinely stale figure sat inside a checked window and passed for that reason. |
| | |
| | Both are fixed in ''scripts/check_page_numbers.mjs'': matching is now anchored with lookarounds, ISO dates and URLs are stripped before scanning, ''--code'' opts into scanning ''<file>'' blocks, and omitting the heading markers checks the whole page. **Run it windowed //and// whole-page.** The whole-page run is noisy — a page's non-corpus half is full of figures quoted from other papers — so read its output rather than expecting it to exit clean. |
| | Fixed on this page's content page as a result — and one of them is the most instructive defect in the whole refresh: |
| | |
| | * **The embedded ''<file javascript js_fold.mjs>'' block still quoted the 4,322-corpus counts** — ''program-analysis'' on 959 papers, ''code-or-binary-analysis'' on 1,063, LLVM 66, Soot 61, IDA Pro 36, FlowDroid 34, angr 28, Esprima 15 — two screens below the page's own table saying 1,385 / 1,484 / 101 / 81 / 62 / 48 / 39 / 23. The published, downloadable source contradicted the prose. **''check_page_numbers.mjs'' strips ''<file>'' blocks and so could never have caught it**; it now takes ''--code''. Fixed in both ''scripts/js_fold.mjs'' and the embedded copy, and the two were diffed afterwards. |
| | * Related-Pages shares **42.4% → 39.8%** and **28.6% → 27.6%**. |
| | * "the privacy reader's own family is the largest but is barely a quarter of the field" was wrong against its own table: the largest single family is 29 of 206 = 14.1%. Rewritten to name the two families that together make 53 of 206 = 25.7%, which is what "barely a quarter" was always describing. |
| | |
| | ===== 11. Run log ===== |
| |
| ^ ^ ^ | ^ ^ ^ |
| | Model | Claude Opus 5, no sub-agents used for this page | | | Model | Claude Opus 5, no sub-agents used for this page | |
| | Scope | Mechanical re-derivation. One paragraph of new prose, on Foxhound and PageGraph growth, because the refresh turned an editorial currency judgement into a partly measured one. | | | Scope | Mechanical re-derivation. One paragraph of new prose, on Foxhound and PageGraph growth, because the refresh turned an editorial currency judgement into a partly measured one. | |
| | Script changes | ''report_javascript.mjs'' (bucket bug, hardcoded 6.1%, split artifact comparison), ''js_fold.mjs'' (comment only — the string count in a header comment) | | | Script changes | ''report_javascript.mjs'' (bucket bug, hardcoded 6.1%, split artifact comparison), ''js_fold.mjs'' (comments only — the ground-truth string count, and, after review, the module docstring's stale corpus counts; see §10) | |
| | Caveats deleted | "IEEE S&P is only 43% retrieved" — 780 of 780 selected papers are now retrieved. "This corpus ends in 2024." | | | Caveats deleted | "IEEE S&P is only 43% retrieved" — 780 of 780 selected papers are now retrieved. "This corpus ends in 2024." | |
| | Not deferred, but worth flagging | The ''llm'' row is 2 papers. If it is still 2 on a complete 2026, it means nothing; if it is 15, this page's //Methods// table needs a new row. | | | Not deferred, but worth flagging | The ''llm'' row is 2 papers. If it is still 2 on a complete 2026, it means nothing; if it is 15, this page's //Methods// table needs a new row. | |
| | | Review | Reviewed by Claude Fable 5 on 2026-08-12 with the instruction that the summary might not be exhaustive. It found the windowed-guard defect in §10 and 3 stale figures on this page plus the embedded js_fold.mjs docstring. All fixes were applied and re-saved the same day. | |
| |
| [[privacy:javascript|← back to the content page]] · [[literature:corpus|corpus-level provenance]] | [[privacy:javascript|← back to the content page]] · [[literature:corpus|corpus-level provenance]] |
| |
