| Both sides previous revisionPrevious revision | |
| provenance:programming:crawler:tracker_radar_collector [2026/09/03 09:04] – Fill the generic-pass review log: twelve findings, all accepted, incl. that one of the ten papers did not run TRC and an open issue #77 two of them cite; add the mutation test proving the new timeout guard fires; and correct this page's own overstatement karel.kubicek.claude | provenance:programming:crawler:tracker_radar_collector [2026/09/17 07:24] (current) – Markup rendering sweep: wrap escapes, CLI flag typography, and heading quotes. Authored by Claude. karel.kubicek.claude |
|---|
| | [[https://doi.org/10.1145/3366423.3380113|ahmad2020_apophanies]] | Read in ''paper.cols.txt''. Verified verbatim: "a qualitative comparative evaluation of a selected set of **eight** crawling tools", "there were **932 unique domains** (of which 30 domains were removed as they returned SOA records) which were crawled by each of our workers", and "the choice of crawler has a critical impact on the data generated". The page quotes the 932 as the paper words it rather than saying "over 932", because 30 were then dropped. | | | [[https://doi.org/10.1145/3366423.3380113|ahmad2020_apophanies]] | Read in ''paper.cols.txt''. Verified verbatim: "a qualitative comparative evaluation of a selected set of **eight** crawling tools", "there were **932 unique domains** (of which 30 domains were removed as they returned SOA records) which were crawled by each of our workers", and "the choice of crawler has a critical impact on the data generated". The page quotes the 932 as the paper words it rather than saying "over 932", because 30 were then dropped. | |
| | [[https://www.usenix.org/conference/usenixsecurity23/presentation/sanchez-rola|sanchezrola2023_rods]] | Read in ''paper.cols.txt''. Verified verbatim, including the resolution the page leans on: "we analyzed a random sample of 1, 000 phishing websites using both techniques. In total, we found 728 websites calling fingerprint-related APIs. Our crawler was able to detect and log all invocations, while OpenWPM missed calls in 348 (47.8%) of the websites. The main reason behind this result lies in the fact that OpenWPM monitors a smaller set of fingerprinting APIs ... In this experiment 48 different types of APIs calls were detected, out of which Open-WPM supported only 36 ... After this update, both our crawler and OpenWPM were able to detect all the 2092 calls performed on the test set". Publishing only the 47.8% would have inverted the paper's own conclusion. | | | [[https://www.usenix.org/conference/usenixsecurity23/presentation/sanchez-rola|sanchezrola2023_rods]] | Read in ''paper.cols.txt''. Verified verbatim, including the resolution the page leans on: "we analyzed a random sample of 1, 000 phishing websites using both techniques. In total, we found 728 websites calling fingerprint-related APIs. Our crawler was able to detect and log all invocations, while OpenWPM missed calls in 348 (47.8%) of the websites. The main reason behind this result lies in the fact that OpenWPM monitors a smaller set of fingerprinting APIs ... In this experiment 48 different types of APIs calls were detected, out of which Open-WPM supported only 36 ... After this update, both our crawler and OpenWPM were able to detect all the 2092 calls performed on the test set". Publishing only the 47.8% would have inverted the paper's own conclusion. | |
| | [[https://github.com/duckduckgo/tracker-radar-collector|duckduckgo/tracker-radar-collector]] | Clone at ''8b64006...''; ''main'' at ''4ad2472b...'' (2026-08-24), and ''git diff --stat 8b64006..HEAD'' is ''.github/workflows/asana-sync.yml'' (+25) and one deleted test line (-2), reproduced independently by two passes. Read ''crawler.js'', ''crawlerConductor.js'', ''constants.js'', ''cli/crawl-cli.js'', ''cli/crawlConfig.js'', ''cli/metadataFile.js'', ''browser/*'', ''helpers/*'' and all nine collectors. {[duckduckgo_trc_2026]} | | | [[https://github.com/duckduckgo/tracker-radar-collector|duckduckgo/tracker-radar-collector]] | Clone at ''8b64006...''; ''main'' at ''4ad2472b...'' (2026-08-24), and ''git diff %%--stat%% 8b64006..HEAD'' is ''.github/workflows/asana-sync.yml'' (+25) and one deleted test line (-2), reproduced independently by two passes. Read ''crawler.js'', ''crawlerConductor.js'', ''constants.js'', ''cli/crawl-cli.js'', ''cli/crawlConfig.js'', ''cli/metadataFile.js'', ''browser/*'', ''helpers/*'' and all nine collectors. {[duckduckgo_trc_2026]} | |
| | [[https://github.com/duckduckgo/tracker-radar|duckduckgo/tracker-radar]] | ''pushed_at'' 2026-09-02, so genuinely current; the pinned ''a1d894db...'' (2026-08-12) is a real ancestor two commits behind HEAD. All four generated files present and populated: ''domain_map.json'' 10.4 MB, ''entity_map.json'' 4.7 MB, ''domain_summary.json'' 16.3 MB, ''data_by_site.json'' 20.1 MB. ''docs/DATA_MODEL.md'' matches the page's field description including ''exampleSites''. {[duckduckgo_tracker_radar_2026]} | | | [[https://github.com/duckduckgo/tracker-radar|duckduckgo/tracker-radar]] | ''pushed_at'' 2026-09-02, so genuinely current; the pinned ''a1d894db...'' (2026-08-12) is a real ancestor two commits behind HEAD. All four generated files present and populated: ''domain_map.json'' 10.4 MB, ''entity_map.json'' 4.7 MB, ''domain_summary.json'' 16.3 MB, ''data_by_site.json'' 20.1 MB. ''docs/DATA_MODEL.md'' matches the page's field description including ''exampleSites''. {[duckduckgo_tracker_radar_2026]} | |
| | [[https://github.com/duckduckgo/tracker-radar-detector|duckduckgo/tracker-radar-detector]] | ''"archived": false, "pushed_at": "2025-03-31T15:00:37Z"''. The pinned ''0f6eb7db...'' **is** HEAD — no commit in roughly seventeen months, no deprecation notice. ''config.json'' line 2 is ''"minSites": 2,'', used at ''src/trackers/classes/crawl.js:72''; ''keepFirstParty'' and ''treatCnameAsFirstParty'' confirmed in ''config.json'' and ''site.js:152,174''. {[duckduckgo_tracker_radar_detector_2026]} | | | [[https://github.com/duckduckgo/tracker-radar-detector|duckduckgo/tracker-radar-detector]] | ''"archived": false, "pushed_at": "2025-03-31T15:00:37Z"''. The pinned ''0f6eb7db...'' **is** HEAD — no commit in roughly seventeen months, no deprecation notice. ''config.json'' line 2 is ''"minSites": 2,'', used at ''src/trackers/classes/crawl.js:72''; ''keepFirstParty'' and ''treatCnameAsFirstParty'' confirmed in ''config.json'' and ''site.js:152,174''. {[duckduckgo_tracker_radar_detector_2026]} | |
| Five passes over the **published** pages, each told explicitly that the author's context might not be exhaustive and to verify from primary sources. Every pass was handed the page text, the provenance text, the report script, its real output, the recall probe and its output, and the two neighbouring pages. Findings are recorded whether accepted or rejected: a rejection is the only record of whether a reviewer earns its slot. | Five passes over the **published** pages, each told explicitly that the author's context might not be exhaustive and to verify from primary sources. Every pass was handed the page text, the provenance text, the report script, its real output, the recall probe and its output, and the two neighbouring pages. Findings are recorded whether accepted or rejected: a rejection is the only record of whether a reviewer earns its slot. |
| |
| ==== 10.1 Coordinator's own pass (''opus''), by running the tool ==== | ==== 10.1 Coordinator's own pass (opus), by running the tool ==== |
| |
| ^ # ^ Finding ^ Action ^ | ^ # ^ Finding ^ Action ^ |
| | X3 | ''expires'' is milliseconds (''Math.floor(cdpDate * 1000)''), and ''-1'' becomes ''undefined'' so the key is **absent**; ''sameSite'' likewise. Real output has 5 keys on one cookie and 6 in the union | **accepted**, both stated | | | X3 | ''expires'' is milliseconds (''Math.floor(cdpDate * 1000)''), and ''-1'' becomes ''undefined'' so the key is **absent**; ''sameSite'' likewise. Real output has 5 keys on one cookie and 6 in the union | **accepted**, both stated | |
| | X4 | "The CLI can use a fresh context" — there is no such flag; ''LocalChrome'' mkdtemps a profile unconditionally. Meanwhile the README offers a ''browserContext'' option that exists only in the README | **accepted**; the page now says a fresh temp profile is unconditional and cannot be turned off from the CLI | | | X4 | "The CLI can use a fresh context" — there is no such flag; ''LocalChrome'' mkdtemps a profile unconditionally. Meanwhile the README offers a ''browserContext'' option that exists only in the README | **accepted**; the page now says a fresh temp profile is unconditional and cannot be turned off from the CLI | |
| | X5 | The CLI cannot be pointed at a browser you already have (no ''--executable-path''; ''PUPPETEER_EXECUTABLE_PATH'' ignored), and Chrome for Testing has no linux-arm64 build, so the CLI cannot start on aarch64 | **accepted**; new install section with the real error | | | X5 | The CLI cannot be pointed at a browser you already have (no ''%%--executable-path%%''; ''PUPPETEER_EXECUTABLE_PATH'' ignored), and Chrome for Testing has no linux-arm64 build, so the CLI cannot start on aarch64 | **accepted**; new install section with the real error | |
| | X6 | No published command, no %%<file>%% block, no evidence the tool was ever run — unlike every sibling crawler page | **accepted**; ''--help'', a runnable script and real output are now published | | | X6 | No published command, no %%<file>%% block, no evidence the tool was ever run — unlike every sibling crawler page | **accepted**; ''%%--help%%'', a runnable script and real output are now published | |
| | X7 | The OpenWPM comparison rests on "TRC = Puppeteer/CDP vs OpenWPM = Selenium/Firefox", but TRC has ''--selenium-hub'' and a ''selenium-webdriver'' dependency | **accepted in part**; pass (c) established that Selenium only provisions a remote **Chrome** and CDP is still the instrument, so the conclusion stands and the sentence was corrected rather than the row | | | X7 | The OpenWPM comparison rests on "TRC = Puppeteer/CDP vs OpenWPM = Selenium/Firefox", but TRC has ''%%--selenium-hub%%'' and a ''selenium-webdriver'' dependency | **accepted in part**; pass (c) established that Selenium only provisions a remote **Chrome** and CDP is still the instrument, so the conclusion stands and the sentence was corrected rather than the row | |
| | X8 | ''targets'' on a real crawl is one row, ''{"type":"page","url":"about:blank"}'' — the URL is captured at attach time | **accepted**, stated in the schema table | | | X8 | ''targets'' on a real crawl is one row, ''{"type":"page","url":"about:blank"}'' — the URL is captured at attach time | **accepted**, stated in the schema table | |
| | X9 | The ''CollectorData'' typedef is in ''helpers/collectorsList.js'' and omits ''trace'' while declaring ''elements'' | **accepted**; the page now names the file and says the typedef is not the authority | | | X9 | The ''CollectorData'' typedef is in ''helpers/collectorsList.js'' and omits ''trace'' while declaring ''elements'' | **accepted**; the page now names the file and says the typedef is not the authority | |
| X14 (the revision-log timing of the first run) and X17 (the script repairs) are recorded in §1.1 and §10.2 rather than as page changes. X19 is §6.2. | X14 (the revision-log timing of the first run) and X17 (the script repairs) are recorded in §1.1 and §10.2 rather than as page changes. X19 is §6.2. |
| |
| ==== 10.2 Figures against the script (''sonnet'') ==== | ==== 10.2 Figures against the script (sonnet) ==== |
| |
| Re-ran the report independently and confirmed byte-identity with both the committed output and the %%<file text>%% block on the published provenance page (one trailing blank line apart). Hand-verified every per-year denominator, numerator and percentage, the 6/4 window split, the 21/11 paper-level figures, the ''9 = 4 + 5'' string audit, and that all 10 TRC papers are inside CRAWLED. Confirmed no shelled-out or back-calculated denominator anywhere in the script. | Re-ran the report independently and confirmed byte-identity with both the committed output and the %%<file text>%% block on the published provenance page (one trailing blank line apart). Hand-verified every per-year denominator, numerator and percentage, the 6/4 window split, the 21/11 paper-level figures, the ''9 = 4 + 5'' string audit, and that all 10 TRC papers are inside CRAWLED. Confirmed no shelled-out or back-calculated denominator anywhere in the script. |
| | R | It listed "30 s ''maxLoadTimeMs'' verified directly at the pinned commit" among things it checked as **correct** | **rejected**. It read the README, not ''crawler.js''. Same error as the page, and as pass (b) | | | R | It listed "30 s ''maxLoadTimeMs'' verified directly at the pinned commit" among things it checked as **correct** | **rejected**. It read the README, not ''crawler.js''. Same error as the page, and as pass (b) | |
| |
| ==== 10.3 Citations and quotes (''sonnet'') ==== | ==== 10.3 Citations and quotes (sonnet) ==== |
| |
| Checked all 14 published keys, the render on both pages, a DOI-and-title duplicate scan, BibTeX hygiene, every author list and DOI against a primary source, all 10 quotes by hand, and every clause of every row of the ten-paper table. | Checked all 14 published keys, the render on both pages, a DOI-and-title duplicate scan, BibTeX hygiene, every author list and DOI against a primary source, all 10 quotes by hand, and every clause of every row of the ten-paper table. |
| | R | It confirmed the 30-second load window "in README lines 70/90" among its correct list | **rejected**, same reason as §10.2 | | | R | It confirmed the 30-second load window "in README lines 70/90" among its correct list | **rejected**, same reason as §10.2 | |
| |
| ==== 10.4 External currency (''sonnet'') ==== | ==== 10.4 External currency (sonnet) ==== |
| |
| Fetched rather than recalled: three fresh clones, ''npm ci'', a real ''--help'', a real crawl, the Node release schedule, the npm registry and all three repository links. | Fetched rather than recalled: three fresh clones, ''npm ci'', a real ''%%--help%%'', a real crawl, the Node release schedule, the npm registry and all three repository links. |
| |
| ^ # ^ Finding ^ Action ^ | ^ # ^ Finding ^ Action ^ |
| | R | It graded the Consent-O-Matic problem **PLAUSIBLE** on the basis that ''grep'' finds no mention in the current source | **not accepted as the final grading**: pass (d) read the dependency's changelog and found the removal, which makes it CONFIRMED. Two passes reached different confidence on one fact because one looked for absence and the other for the removal event | | | R | It graded the Consent-O-Matic problem **PLAUSIBLE** on the basis that ''grep'' finds no mention in the current source | **not accepted as the final grading**: pass (d) read the dependency's changelog and found the removal, which makes it CONFIRMED. Two passes reached different confidence on one fact because one looked for absence and the other for the removal event | |
| |
| ==== 10.5 The OpenWPM comparison (''sonnet'') ==== | ==== 10.5 The OpenWPM comparison (sonnet) ==== |
| |
| Read the openwpm page in full, cloned OpenWPM (v0.36.0, HEAD ''61d285f''), and checked every cell of the comparison table against both. | Read the openwpm page in full, cloned OpenWPM (v0.36.0, HEAD ''61d285f''), and checked every cell of the comparison table against both. |
| | R | It called the index's 21 "no contradiction" because each number is correct for its own rule | **partly rejected**: correct about the rules, wrong that the labelling is harmless. The row is labelled after the crawler and the prose attributed the growth to the crawler. See §2.2 | | | R | It called the index's 21 "no contradiction" because each number is correct for its own rule | **partly rejected**: correct about the rules, wrong that the labelling is harmless. The row is labelled after the crawler and the prose attributed the growth to the crawler. See §2.2 | |
| |
| ==== 10.6 Generic pass (''fable'', no checklist) ==== | ==== 10.6 Generic pass (fable, no checklist) ==== |
| |
| It returned after the pages were already published, and it justified its slot: **twelve findings on a page four focused passes had cleared**, including the one boundary the whole page is about. Every finding was verified against the paper or the repository before being accepted, and every one was accepted. | It returned after the pages were already published, and it justified its slot: **twelve findings on a page four focused passes had cleared**, including the one boundary the whole page is about. Every finding was verified against the paper or the repository before being accepted, and every one was accepted. |
| ==== 10.8 What the generic pass checked and found correct ==== | ==== 10.8 What the generic pass checked and found correct ==== |
| |
| Worth reading before re-checking anything. It independently reproduced the rendered-DOM audit on both pages (all anchors resolve, zero real red links — it correctly identified that the one ''wikilink2'' string on this page is literal text inside a code block — no list item containing preformatted text, no uneven table rows, all four WRAP boxes rendering as plugins, the footnote rendering, and the citekey-to-reference counts on both pages); confirmed the ''--help'' block is byte-identical to the real command at the pinned commit; and re-verified some thirty repository facts including the user-agent constants, the viewports, ''VISUAL_DEBUG'', the 60000/2500 defaults, the UA and browser-close gating, the unconditional ''downloadChrome'', the ''size'' coercion and its clickhouse comment, the ''saveHeaders'' default, the ''responseReceivedExtraInfo'' listener that makes ''set-cookie'' real, ''filterListMatched'' being written once and only read, and 82 commits since 2026-01-01 (so "actively developed" holds). It also established that ''example.com'' currently returns **none** of the nine safelisted headers, so the empty ''responseHeaders'' in the published output is correct rather than a capture failure — a check nobody else thought to make. On the index page it confirmed the diff contains only the three intended edits and that the 9/1/1 footnote split matches the reconcile output. | Worth reading before re-checking anything. It independently reproduced the rendered-DOM audit on both pages (all anchors resolve, zero real red links — it correctly identified that the one ''wikilink2'' string on this page is literal text inside a code block — no list item containing preformatted text, no uneven table rows, all four WRAP boxes rendering as plugins, the footnote rendering, and the citekey-to-reference counts on both pages); confirmed the ''%%--help%%'' block is byte-identical to the real command at the pinned commit; and re-verified some thirty repository facts including the user-agent constants, the viewports, ''VISUAL_DEBUG'', the 60000/2500 defaults, the UA and browser-close gating, the unconditional ''downloadChrome'', the ''size'' coercion and its clickhouse comment, the ''saveHeaders'' default, the ''responseReceivedExtraInfo'' listener that makes ''set-cookie'' real, ''filterListMatched'' being written once and only read, and 82 commits since 2026-01-01 (so "actively developed" holds). It also established that ''example.com'' currently returns **none** of the nine safelisted headers, so the empty ''responseHeaders'' in the published output is correct rather than a capture failure — a check nobody else thought to make. On the index page it confirmed the diff contains only the three intended edits and that the 9/1/1 footnote split matches the reconcile output. |
| |
| ===== 11. Judgement calls ===== | ===== 11. Judgement calls ===== |
| |
| <bibtex bibliography></bibtex> | <bibtex bibliography></bibtex> |
| | |
| | ===== Markup sweep, 2026-09-17 ===== |
| | |
| | Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving. |
| |
