Differences

This shows you the differences between two versions of the page.

--- provenance:security:web_vulnerabilities [2026/08/27 13:43] – Create provenance:security:web_vulnerabilities: query log, ROLE map, unedited report. Authored by Claude. karel.kubicek.claude
+++ provenance:security:web_vulnerabilities [2026/09/17 08:14] (current) – Qualify root Security links; Authored by Claude karel.kubicek.claude
@@ Line 1: / Line 1: @@
 ====== Provenance: Security:Web vulnerabilities ======
-Back to [[security:web_vulnerabilities|Web vulnerabilities]]. Corpus-wide selection and extraction notes are on [[literature:corpus]]. Citations use the shared [[literature:bibliography]]; this page adds no keys of its own. No ''~~DISCUSSION~~'' — comments belong on the content page.
+Back to [[security:web_vulnerabilities|Web vulnerabilities]]. Corpus-wide selection and extraction notes are on [[literature:corpus]]. Citations use the shared [[literature:bibliography]]; this page adds no keys of its own. No discussion block on this page — comments belong on the content page.
 ===== Run record =====
@@ Line 9: / Line 9: @@
   * Review models requested by this sitting: **GPT 5.6 Luna medium** (''gpt-5.6-luna-medium'') for the three focused passes **and** the generic pass, instead of the spec's sonnet/fable split. Logged here so a later reader does not assume the default mix.
   * Corpus at run time: 5,859 extracted papers, 2010–2026, CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P. Read-only inputs under ''/workspace/publications_dataset/data/''.
-  * Read first: the wiki-measuretheweb spec (audience, currency, 5,859-paper corpus, provenance page, start link, bibtex), [[literature:corpus]], [[security]], [[practices:ethics]], [[practices:notifying_websites]], [[privacy:javascript]], [[programming:crawler:foxhound]], [[programming:interaction]], live ''start'' (already promised [[Security:Web vulnerabilities]]).
+  * Read first: the wiki-measuretheweb spec (audience, currency, 5,859-paper corpus, provenance page, start link, bibtex), [[literature:corpus]], [[:security]], [[practices:ethics]], [[practices:notifying_websites]], [[privacy:javascript]], [[programming:crawler:foxhound]], [[programming:interaction]], live ''start'' (already promised [[Security:Web vulnerabilities]]).
   * Target pages had no revision (''core.getPageInfo'' "does not exist"). ''dw.mjs pages'' does not list ''provenance:''. ''?do=export_raw'' on a missing page returns an HTML error document — that is not an existence test. This is a creation, not an extension.
   * Live ''start'' (rev 1787836787) already links the child; this sitting does not edit ''start''. Live ''security'' (rev 1787835259) still says all five children are red links — WRAP updated to name this child as written. Live [[Security:VirusTotal]] does **not** exist; the local draft of that page is not this item and is not claimed live.
@@ Line 22: / Line 22: @@
 | [[privacy:javascript]] | script behaviour without an exploitability claim | "is this live origin exploitable" |
 | [[security:headers]] | CSP/HSTS as crawlable artefacts (still unwritten) | payload-executed XSS |
-| [[security]] | schema populations for five children, including the 880 / 209 / 99 | the hand map of the 99 |
+| [[:security]] | schema populations for five children, including the 880 / 209 / 99 | the hand map of the 99 |
-A reasonable person might have treated the 99 as the population. That is the mistake the parent cell already forbids. Another might have written a nuclei/ZAP tool page; full-text union of nuclei/nikto/w3af/openvas is **24** papers — residue here, not a page (already rejected on [[security]]).
+A reasonable person might have treated the 99 as the population. That is the mistake the parent cell already forbids. Another might have written a nuclei/ZAP tool page; full-text union of nuclei/nikto/w3af/openvas is **24** papers — residue here, not a page (already rejected on [[:security]]).
 ===== Population and queries =====
@@ Line 41: / Line 41: @@
 | … used + offline-only | 880 | **260 (29.5%)** |
 | ROLE = wild among the 99 | 99; 1,120 crawled | **30 (30.3% of 99; 2.7% of crawled)** — page population for in-the-wild figures |
+| … of which archive-surface (Lerner rewriting-history; Stock Wayback {[stock2017web]}) | 30 | **2** |
+| … of which crawled then-live sites | 30 | **28** |
+| wild classification method: dynamic-analysis / heuristic-rules / manual-labelling | 30, multi | **14 (46.7%) / 12 (40.0%) / 8 (26.7%)** |
 | ROLE = lab | 99 | **27 (27.3%)** |
 | ROLE = cve | 99 | **8 (8.1%)** |
@@ Line 73: / Line 76: @@
   * **ROLE** (''scripts/vuln_fold.mjs''): one label per paper of the 99. Deciding sentence inline, quote-checked against ''paper.cols.txt''. The report throws if a key of the 99 is missing from ROLE or ROLE contains a key that is not in the 99.
   * **Kind fold**: ordered regex families over title, slug and vulnerability tuples; multi-label. Residue **62 of 99** is printed in full in the report block below. Clickjacking as a primary study is essentially absent from this schema slice (1 of 99, 0 wild).
-  * Borderline calls a different reader might flip:
+  * **Archive-surface split** (added after generic review): two keys, not a regex — CCS/2017/rewriting-history and USENIX/2017/how-the-web-tangled-itself. White Rabbit also reports archived redirects as a second experiment; it stays in the 28 because the crawl was then-live. The report throws if the two sets do not partition the 30.
     * USENIX/2010/searching-the-searchers-with-searchaudit → **wild** (SQL error oracle on live search engines), not lab.
     * PETS/2023/comparing-large-scale-privacy-and-security-notifications → **wild** (they notified live operators about findings from a crawl), not offtopic.
@@ Line 139: / Line 142: @@
   * OWASP Top 10 **2017 A7** as the current XSS letter — superseded 2021 (A03) and 2025 (A05).
   * Chromium XSS Auditor as a 2026 defence to evaluate against.
-  * A nuclei / nikto / w3af / OpenVAS scanner-tool page — 24 full-text hits, already rejected on [[security]].
+  * A nuclei / nikto / w3af / OpenVAS scanner-tool page — 24 full-text hits, already rejected on [[:security]].
   * MDN / textbook explanations of ''X-Frame-Options'' to pad the clickjacking hole.
   * SEO "top web vulnerabilities 2026" listicles.
@@ Line 171: / Line 174: @@
 ===== Published code =====
-''pages/count_vuln_sites.py'' is byte-identical to the ''%%<file python count_vuln_sites.py>%%'' block. ''uv run python pages/count_vuln_sites.py --selftest'' OK. ''%%--demo%%'' output on 2026-08-27:
+''pages/count_vuln_sites.py'' is byte-identical to the ''%%<file python count_vuln_sites.py>%%'' block. ''uv run python pages/count_vuln_sites.py %%--selftest%%'' OK. ''%%--demo%%'' output on 2026-08-27:
 <code>
@@ Line 190: / Line 193: @@
 ===== Reviews =====
-Drafts frozen after first publish. Three focused GPT 5.6 Luna medium passes in parallel (figures vs script; citations/quotes; external currency), then a generic pass with no checklist. Findings and accept/reject are appended below after they return. No GENERIC_REVIEW placeholder. The content page is not edited while reviewers run.
+Drafts frozen at ''out/freeze_web_vuln/'' after first publish (content rev 1787838181, provenance rev 1787838183). Three focused GPT 5.6 Luna medium passes ran in parallel against that freeze. The content page was not edited while they ran. No GENERIC_REVIEW placeholder.
+^ Pass ^ Model ^ Findings ^ Disposition ^
+| 1. Figures vs script | GPT 5.6 Luna medium | none | **Accepted as empty.** Re-ran report, ''verify_web_vuln_figures.mjs'', page-number checks (windowed, whole-page, ''%%--code%%''), table/wrap guards, ''count_vuln_sites.py %%--demo%%/%%--selftest%%'', freeze byte-compare. |
+| 2. Citations and quotes | GPT 5.6 Luna medium | none | **Accepted as empty.** All 17 content-page keys resolve; eight additions unique; cover-paper figures present in ''paper.cols.txt''. |
+| 3. External currency | GPT 5.6 Luna medium | none | **Accepted as empty.** Re-fetched OWASP 2025, Chrome 78/80, ZAP Checkmarx blog, ''zaproxy/zaproxy'' licence Apache-2.0, nuclei not archived. |
+Generic pass (no checklist) ran after the focused log was on this page. Content was not edited while it ran.
+^ Pass ^ Model ^ Finding ^ Disposition ^
+| 4. Generic | GPT 5.6 Luna medium | 1. Wild 30 mixes live and archived; no live-only count. | **Accepted.** Hand-split **2** archive-surface / **28** then-live; named in WRAP and the role table. Not a regex. |
+| 4. Generic | GPT 5.6 Luna medium | 2. Method distribution is for the 99, not the 30. | **Accepted.** Report now prints H2 on the 30: dynamic-analysis **14 (46.7%)**, heuristic-rules **12 (40.0%)**, manual-labelling **8 (26.7%)**. Page leads with that; 99 kept as the flipped conjunction summary. |
+| 4. Generic | GPT 5.6 Luna medium | 3. "2024–2026 specialised browsers still do" overgroups Foxhound / PanoptiChrome / Sabino. | **Accepted.** Scoped: Foxhound is the pipeline; PanoptiChrome is the same family; Sabino adds interaction fuzzing on top of a taint pass. |
+| 4. Generic | GPT 5.6 Luna medium | 4. Provenance ''No DISCUSSION token'' rendered as broken italics. | **Accepted.** Reworded without nesting the discussion token. |
+| 4. Generic (re-run) | GPT 5.6 Luna medium | Called the 28 a count of sites, not papers. | **Accepted.** "28 papers" / "2 papers" in WRAP and the role table. |
+| 4. Generic (re-run) | GPT 5.6 Luna medium | Report H2 labelled "live-measurement" while including the 2 archive-surface papers. | **Accepted.** Relabelled "wild-role method distribution". |
+No GENERIC_REVIEW placeholder.
 ===== Report output (unedited) =====
@@ Line 410: / Line 430: @@
 PUBLISHED_WILD_SUBPAGES_STATED 10
 shallow (landing-page-only + single-target-page) among wild: 7 / 30 = 23.3%
+PUBLISHED_WILD_ARCHIVE_SURFACE 2
+PUBLISHED_WILD_THEN_LIVE 28
+  archive-surface CCS/2017/rewriting-history-changing-the-archived-web-from-the-present Rewriting History: Changing the Archived Web from the Present.
+  archive-surface USENIX/2017/how-the-web-tangled-itself-uncovering-the-history-of-client-side-web-in-security How the Web Tangled Itself: Uncovering the History of Client-Side Web (In)Security
 ==========================================================================
-H. CLASSIFICATION METHOD among the 99 (vuln tuples, sentinels skipped)
+H. CLASSIFICATION METHOD (vuln tuples, sentinels skipped)
 ==========================================================================
+── H1. conjunction of 99 ──
 method               Papers of 99  Share
 -------------------  ------------  -----
@@ Line 427: / Line 453: @@
 other                1             1.0%
 blocklist            1             1.0%
+── H2. wild only (the wild-role method distribution; includes the 2 archive-surface papers) ──
+method              Papers of 30 wild  Share
+------------------  -----------------  -----
+dynamic-analysis    14                 46.7%
+heuristic-rules     12                 40.0%
+manual-labelling    8                  26.7%
+static-analysis     4                  13.3%
+graph-analysis      2                  6.7%
+supervised-ml       1                  3.3%
+regex-or-signature  1                  3.3%
 ==========================================================================
@@ Line 842: / Line 879: @@
 </file>
+===== Markup sweep, 2026-09-17 =====
+Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.
+===== Link-hygiene sweep, 2026-09-17 =====
+The fresh rendered-DOM sweep found four bare ''security'' links resolving to ''provenance:security:security''. They are now root-anchored; the post-save DOM was re-checked for red links. No figures or citations changed.