Differences

This shows you the differences between two versions of the page.

--- provenance:security:web_vulnerabilities [2026/08/27 13:45] – Log focused-review empty findings (3x gpt-5.6-luna-medium). Authored by Claude. karel.kubicek.claude
+++ provenance:security:web_vulnerabilities [2026/09/17 08:14] (current) – Qualify root Security links; Authored by Claude karel.kubicek.claude
@@ Line 1: / Line 1: @@
 ====== Provenance: Security:Web vulnerabilities ======
-Back to [[security:web_vulnerabilities|Web vulnerabilities]]. Corpus-wide selection and extraction notes are on [[literature:corpus]]. Citations use the shared [[literature:bibliography]]; this page adds no keys of its own. No ''~~DISCUSSION~~'' — comments belong on the content page.
+Back to [[security:web_vulnerabilities|Web vulnerabilities]]. Corpus-wide selection and extraction notes are on [[literature:corpus]]. Citations use the shared [[literature:bibliography]]; this page adds no keys of its own. No discussion block on this page — comments belong on the content page.
 ===== Run record =====
@@ Line 9: / Line 9: @@
   * Review models requested by this sitting: **GPT 5.6 Luna medium** (''gpt-5.6-luna-medium'') for the three focused passes **and** the generic pass, instead of the spec's sonnet/fable split. Logged here so a later reader does not assume the default mix.
   * Corpus at run time: 5,859 extracted papers, 2010–2026, CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P. Read-only inputs under ''/workspace/publications_dataset/data/''.
-  * Read first: the wiki-measuretheweb spec (audience, currency, 5,859-paper corpus, provenance page, start link, bibtex), [[literature:corpus]], [[security]], [[practices:ethics]], [[practices:notifying_websites]], [[privacy:javascript]], [[programming:crawler:foxhound]], [[programming:interaction]], live ''start'' (already promised [[Security:Web vulnerabilities]]).
+  * Read first: the wiki-measuretheweb spec (audience, currency, 5,859-paper corpus, provenance page, start link, bibtex), [[literature:corpus]], [[:security]], [[practices:ethics]], [[practices:notifying_websites]], [[privacy:javascript]], [[programming:crawler:foxhound]], [[programming:interaction]], live ''start'' (already promised [[Security:Web vulnerabilities]]).
   * Target pages had no revision (''core.getPageInfo'' "does not exist"). ''dw.mjs pages'' does not list ''provenance:''. ''?do=export_raw'' on a missing page returns an HTML error document — that is not an existence test. This is a creation, not an extension.
   * Live ''start'' (rev 1787836787) already links the child; this sitting does not edit ''start''. Live ''security'' (rev 1787835259) still says all five children are red links — WRAP updated to name this child as written. Live [[Security:VirusTotal]] does **not** exist; the local draft of that page is not this item and is not claimed live.
@@ Line 22: / Line 22: @@
 | [[privacy:javascript]] | script behaviour without an exploitability claim | "is this live origin exploitable" |
 | [[security:headers]] | CSP/HSTS as crawlable artefacts (still unwritten) | payload-executed XSS |
-| [[security]] | schema populations for five children, including the 880 / 209 / 99 | the hand map of the 99 |
+| [[:security]] | schema populations for five children, including the 880 / 209 / 99 | the hand map of the 99 |
-A reasonable person might have treated the 99 as the population. That is the mistake the parent cell already forbids. Another might have written a nuclei/ZAP tool page; full-text union of nuclei/nikto/w3af/openvas is **24** papers — residue here, not a page (already rejected on [[security]]).
+A reasonable person might have treated the 99 as the population. That is the mistake the parent cell already forbids. Another might have written a nuclei/ZAP tool page; full-text union of nuclei/nikto/w3af/openvas is **24** papers — residue here, not a page (already rejected on [[:security]]).
 ===== Population and queries =====
@@ Line 41: / Line 41: @@
 | … used + offline-only | 880 | **260 (29.5%)** |
 | ROLE = wild among the 99 | 99; 1,120 crawled | **30 (30.3% of 99; 2.7% of crawled)** — page population for in-the-wild figures |
+| … of which archive-surface (Lerner rewriting-history; Stock Wayback {[stock2017web]}) | 30 | **2** |
+| … of which crawled then-live sites | 30 | **28** |
+| wild classification method: dynamic-analysis / heuristic-rules / manual-labelling | 30, multi | **14 (46.7%) / 12 (40.0%) / 8 (26.7%)** |
 | ROLE = lab | 99 | **27 (27.3%)** |
 | ROLE = cve | 99 | **8 (8.1%)** |
@@ Line 73: / Line 76: @@
   * **ROLE** (''scripts/vuln_fold.mjs''): one label per paper of the 99. Deciding sentence inline, quote-checked against ''paper.cols.txt''. The report throws if a key of the 99 is missing from ROLE or ROLE contains a key that is not in the 99.
   * **Kind fold**: ordered regex families over title, slug and vulnerability tuples; multi-label. Residue **62 of 99** is printed in full in the report block below. Clickjacking as a primary study is essentially absent from this schema slice (1 of 99, 0 wild).
-  * Borderline calls a different reader might flip:
+  * **Archive-surface split** (added after generic review): two keys, not a regex — CCS/2017/rewriting-history and USENIX/2017/how-the-web-tangled-itself. White Rabbit also reports archived redirects as a second experiment; it stays in the 28 because the crawl was then-live. The report throws if the two sets do not partition the 30.
     * USENIX/2010/searching-the-searchers-with-searchaudit → **wild** (SQL error oracle on live search engines), not lab.
     * PETS/2023/comparing-large-scale-privacy-and-security-notifications → **wild** (they notified live operators about findings from a crawl), not offtopic.
@@ Line 139: / Line 142: @@
   * OWASP Top 10 **2017 A7** as the current XSS letter — superseded 2021 (A03) and 2025 (A05).
   * Chromium XSS Auditor as a 2026 defence to evaluate against.
-  * A nuclei / nikto / w3af / OpenVAS scanner-tool page — 24 full-text hits, already rejected on [[security]].
+  * A nuclei / nikto / w3af / OpenVAS scanner-tool page — 24 full-text hits, already rejected on [[:security]].
   * MDN / textbook explanations of ''X-Frame-Options'' to pad the clickjacking hole.
   * SEO "top web vulnerabilities 2026" listicles.
@@ Line 171: / Line 174: @@
 ===== Published code =====
-''pages/count_vuln_sites.py'' is byte-identical to the ''%%<file python count_vuln_sites.py>%%'' block. ''uv run python pages/count_vuln_sites.py --selftest'' OK. ''%%--demo%%'' output on 2026-08-27:
+''pages/count_vuln_sites.py'' is byte-identical to the ''%%<file python count_vuln_sites.py>%%'' block. ''uv run python pages/count_vuln_sites.py %%--selftest%%'' OK. ''%%--demo%%'' output on 2026-08-27:
 <code>
@@ Line 193: / Line 196: @@
 ^ Pass ^ Model ^ Findings ^ Disposition ^
-| 1. Figures vs script | GPT 5.6 Luna medium | none | **Accepted as empty.** Re-ran report, ''verify_web_vuln_figures.mjs'', page-number checks (windowed, whole-page, ''--code''), table/wrap guards, ''count_vuln_sites.py --demo/--selftest'', freeze byte-compare. |
+| 1. Figures vs script | GPT 5.6 Luna medium | none | **Accepted as empty.** Re-ran report, ''verify_web_vuln_figures.mjs'', page-number checks (windowed, whole-page, ''%%--code%%''), table/wrap guards, ''count_vuln_sites.py %%--demo%%/%%--selftest%%'', freeze byte-compare. |
 | 2. Citations and quotes | GPT 5.6 Luna medium | none | **Accepted as empty.** All 17 content-page keys resolve; eight additions unique; cover-paper figures present in ''paper.cols.txt''. |
 | 3. External currency | GPT 5.6 Luna medium | none | **Accepted as empty.** Re-fetched OWASP 2025, Chrome 78/80, ZAP Checkmarx blog, ''zaproxy/zaproxy'' licence Apache-2.0, nuclei not archived. |
-Generic pass (no checklist) runs after this log is on the provenance page.
+Generic pass (no checklist) ran after the focused log was on this page. Content was not edited while it ran.
+^ Pass ^ Model ^ Finding ^ Disposition ^
+| 4. Generic | GPT 5.6 Luna medium | 1. Wild 30 mixes live and archived; no live-only count. | **Accepted.** Hand-split **2** archive-surface / **28** then-live; named in WRAP and the role table. Not a regex. |
+| 4. Generic | GPT 5.6 Luna medium | 2. Method distribution is for the 99, not the 30. | **Accepted.** Report now prints H2 on the 30: dynamic-analysis **14 (46.7%)**, heuristic-rules **12 (40.0%)**, manual-labelling **8 (26.7%)**. Page leads with that; 99 kept as the flipped conjunction summary. |
+| 4. Generic | GPT 5.6 Luna medium | 3. "2024–2026 specialised browsers still do" overgroups Foxhound / PanoptiChrome / Sabino. | **Accepted.** Scoped: Foxhound is the pipeline; PanoptiChrome is the same family; Sabino adds interaction fuzzing on top of a taint pass. |
+| 4. Generic | GPT 5.6 Luna medium | 4. Provenance ''No DISCUSSION token'' rendered as broken italics. | **Accepted.** Reworded without nesting the discussion token. |
+| 4. Generic (re-run) | GPT 5.6 Luna medium | Called the 28 a count of sites, not papers. | **Accepted.** "28 papers" / "2 papers" in WRAP and the role table. |
+| 4. Generic (re-run) | GPT 5.6 Luna medium | Report H2 labelled "live-measurement" while including the 2 archive-surface papers. | **Accepted.** Relabelled "wild-role method distribution". |
+No GENERIC_REVIEW placeholder.
 ===== Report output (unedited) =====
@@ Line 417: / Line 430: @@
 PUBLISHED_WILD_SUBPAGES_STATED 10
 shallow (landing-page-only + single-target-page) among wild: 7 / 30 = 23.3%
+PUBLISHED_WILD_ARCHIVE_SURFACE 2
+PUBLISHED_WILD_THEN_LIVE 28
+  archive-surface CCS/2017/rewriting-history-changing-the-archived-web-from-the-present Rewriting History: Changing the Archived Web from the Present.
+  archive-surface USENIX/2017/how-the-web-tangled-itself-uncovering-the-history-of-client-side-web-in-security How the Web Tangled Itself: Uncovering the History of Client-Side Web (In)Security
 ==========================================================================
-H. CLASSIFICATION METHOD among the 99 (vuln tuples, sentinels skipped)
+H. CLASSIFICATION METHOD (vuln tuples, sentinels skipped)
 ==========================================================================
+── H1. conjunction of 99 ──
 method               Papers of 99  Share
 -------------------  ------------  -----
@@ Line 434: / Line 453: @@
 other                1             1.0%
 blocklist            1             1.0%
+── H2. wild only (the wild-role method distribution; includes the 2 archive-surface papers) ──
+method              Papers of 30 wild  Share
+------------------  -----------------  -----
+dynamic-analysis    14                 46.7%
+heuristic-rules     12                 40.0%
+manual-labelling    8                  26.7%
+static-analysis     4                  13.3%
+graph-analysis      2                  6.7%
+supervised-ml       1                  3.3%
+regex-or-signature  1                  3.3%
 ==========================================================================
@@ Line 849: / Line 879: @@
 </file>
+===== Markup sweep, 2026-09-17 =====
+Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.
+===== Link-hygiene sweep, 2026-09-17 =====
+The fresh rendered-DOM sweep found four bare ''security'' links resolving to ''provenance:security:security''. They are now root-anchored; the post-save DOM was re-checked for red links. No figures or citations changed.