Differences

This shows you the differences between two versions of the page.

--- design:ownership_resolution [2026/09/11 19:28] – Round two: four figures the first patch left behind - the 'starting a new measurement' recommendation, the inter-rater paragraph's 69.9%, the encounter-weighted bullet's 39.4%, and 93.9%. Found by a site-wide sweep. Authored by Claude karel.kubicek.claude
+++ design:ownership_resolution [2026/09/11 22:42] (current) – Site-wide sweep: the methodology bullet's second copy of '29 of the 525' hand-changed verdicts was still stale after round four fixed the first. Authored by Claude karel.kubicek.claude
@@ Line 6: / Line 6: @@
 **The short answer, dated 2026-09-11.**
-  * **Starting a new measurement:** use **Disconnect ''entities.json''** for the owner name and **DuckDuckGo Tracker Radar** for breadth, and say which file and which commit. On a stratified random sample of each list's own coverage, drawn 2026-09-05 and re-adjudicated over its residue on 2026-09-11, Disconnect names today's owner for **89.2%** of the entries that could be settled against Tracker Radar's **73.9%** — a gap that no longer clears this page's own significance threshold, so read it as a description and not as an established ordering; Tracker Radar names an owner for **17.2%** of the registrable third-party domains in the frame against Disconnect's **7.0%**. Neither dominates, so most papers should merge them: **Disconnect first for the owner name, Tracker Radar as the fallback when Disconnect has no entry** — and record which list and which key matched each domain, so the mix is visible in your data rather than buried in the pipeline. Those two headline figures are the metrics on which this recommendation looks best, and the body of the page argues that two //other// metrics matter more: weighted by how often a crawl meets the domain, the live lists are near-tied on coverage (84.3% against 80.5%) and the **frozen** list tops accuracy (93.8%). The recommendation survives that because webXray's file has not moved since 2021 and its 93.8% is measured over the fifth of its entries a 2026 crawl still meets — but you should know the comparison is not one-sided before you cite it.
+  * **Starting a new measurement:** use **Disconnect ''entities.json''** for the owner name and **DuckDuckGo Tracker Radar** for breadth, and say which file and which commit. On a stratified random sample of each list's own coverage, drawn 2026-09-05 and re-adjudicated over its residue on 2026-09-11, Disconnect names today's owner for **89.2%** of the entries that could be settled against Tracker Radar's **73.9%** — a gap that is significant if you count //granularity// as acceptable (//p// = 0.004) and is not if you require the exact legal entity (//p// = 0.083, against a Bonferroni threshold of 0.0167, and it never cleared it); Tracker Radar names an owner for **17.2%** of the registrable third-party domains in the frame against Disconnect's **7.0%**. Neither dominates, so most papers should merge them: **Disconnect first for the owner name, Tracker Radar as the fallback when Disconnect has no entry** — and record which list and which key matched each domain, so the mix is visible in your data rather than buried in the pipeline. Those two headline figures are the metrics on which this recommendation looks best, and the body of the page argues that two //other// metrics matter more: weighted by how often a crawl meets the domain, the live lists are near-tied on coverage (84.3% against 80.5%) and the **frozen** list tops accuracy (93.8%). The recommendation survives that because webXray's file has not moved since 2021 and its 93.8% is measured over the fifth of its entries a 2026 crawl still meets — but you should know the comparison is not one-sided before you cite it.
   * **webXray's ''domain_owners.json'' is historical.** It has not moved since **2021-03-04**, covers **2.1%** of the same frame, and the last corpus paper to use it was published in **2022**. It is still the only one of the three with an ownership //tree// and with per-language policy URLs. See [[Programming:Crawler:webXray]] for the file, the tool and its licence history.
   * **No list removes the manual work**, and the literature is consistent on this: {[steffens2021_blockparty]} spent about eight person-hours hand-vetting same-entity pairs //after// using the lists, and {[sanchezrola2021_journey]} merged three of them and added a WHOIS-and-graph pass on top.
@@ Line 38: / Line 38: @@
 | Extra per-owner data | purpose, country, trade bodies, per-language policy URLs | ''displayName'', ''aliases''; prevalence, categories, fingerprinting and cookie behaviour in sibling files | ''properties'' vs ''resources'' split; category in ''services.json'' |
 | How ownership is decided | hand curation. Libert's own paper calls the database "the product of years of detective work" {[libert2018_automated]} | "automatically generated" by Tracker Radar Detector; "new development and bug fixes, other than broken sites, are handled internally"((''docs/DATA_MODEL.md'' in ''duckduckgo/tracker-radar'', checked 2026-08-17.)) | Disconnect's own process page describes step 4 as "Connect every tracker to its parent entity through DNS, WHOIS, and behavioral evidence"((''https://disconnect.me/trackerprotection'', checked 2026-08-17.)) |
-| Update cadence | **none** — frozen; last public commit 2021-03-04 | monthly regeneration; last commit on ''main'' 2026-08-28, releases tagged ''2026.08.28'', ''2026.07.27'', … | continuous; last commit 2026-09-05 |
+| Update cadence | **none** — frozen; last public commit 2021-03-04 | monthly regeneration; last commit on ''main'' 2026-08-28, releases tagged ''2026.08.28'', ''2026.07.27'', … | the **repository** commits continuously (HEAD 2026-09-05), but ''entities.json'' itself last changed **2026-08-07** — read the file's history, not the repo's |
 | Licence | PolyForm Strict 1.0.0 (no redistribution) on the most-mirrored snapshot; the project ended MIT, the 2018 standalone list copy is GPL-3.0 — see [[Programming:Crawler:webXray]] | **CC BY-NC-SA 4.0** | **CC BY-NC-SA 4.0** (GPL-3.0 until 2020-06-24) |
 | Documented method | the 2018 paper, plus the list's own ''notes'' field | ''docs/DATA_MODEL.md'', ''docs/FAQ.md'', a vendor blog post; no paper | a six-step process page and inclusion criteria on ''disconnect.me''; ''entities.json'''s own schema is undocumented |
@@ Line 183: / Line 183: @@
 ===== How often is each list right? A random sample =====
-The table above is what you see when you look **where the lists disagree**. It is not an accuracy rate. This section is the measurement that was missing until 2026-09-05: **60 registrable domains drawn at random from each list's own coverage**, stratified by prevalence quartile, each adjudicated against a primary source. **The adjudicators were language models** — Sonnet sub-agents working to a published brief, one rater per domain, with a second model re-rating a random fifth so the agreement could be measured rather than assumed (below). No human expert adjudicated these rows. 180 draws over **175 distinct domains** (five were drawn for more than one list); each domain was adjudicated **once** and scored against all three lists, giving 525 verdicts. Only a list's own draws enter that list's rate, and of each list's 60 the ones that could be settled //and// make an ownership claim are **56, 56 and 54** — 166 rows carry every accuracy figure below. Those counts are **after a second pass on 2026-09-11** that re-adjudicated the 40 domains the first pass could not settle, using sourcing the first pass did not attempt: national company registers searched by //company number// rather than by name, the registrar's own port-43 WHOIS rather than RDAP, and archived captures of the domains' own legal pages. It settled **28 of the 40**, and it changed the answers below more than it changed the rows — see [[#What the second pass over the residue changed|the section on it]].
+The table above is what you see when you look **where the lists disagree**. It is not an accuracy rate. This section is the measurement that was missing until 2026-09-05: **60 registrable domains drawn at random from each list's own coverage**, stratified by prevalence quartile, each adjudicated against a primary source. **The adjudicators were language models** — Sonnet sub-agents working to a published brief, one rater per domain, with a second model re-rating a random fifth so the agreement could be measured rather than assumed (below). No human expert adjudicated these rows. 180 draws over **175 distinct domains** (five were drawn for more than one list); each domain was adjudicated **once** and scored against all three lists, giving 525 verdicts. Only a list's own draws enter that list's rate, and of each list's 60 the ones that could be settled //and// make an ownership claim are **56, 56 and 54** — 166 rows carry every accuracy figure below. Those counts are **after a second pass on 2026-09-11** that re-adjudicated the 40 domains the first pass could not settle, using sourcing the first pass did not attempt: national company registers searched by //company number// rather than by name, the registrar's own port-43 WHOIS rather than RDAP, and archived captures of the domains' own legal pages. It settled **28 of the 40**, cutting the unadjudicable share from 23% of the draws to 7.8% — see [[#What the second pass over the residue changed|the section on it]] for what that did to each rate.
 Two numbers per verdict, because there are two different questions:
@@ Line 196: / Line 196: @@
 <WRAP important>
-**29 of the 525 verdicts were changed after the adjudicators returned them, and the direction is overwhelmingly favourable to the lists.** Of the 28 re-scores, 14 landed on ''current'', 2 on ''granularity'', 1 on ''stale'' and 9 on ''unknown'' (which removes the row from every rate). Most of that is retiring a verdict the brief should never have offered, but the net effect is to move rates **up**, and every figure in the table above should be discounted accordingly. The full list with reasons is on the provenance pages.
+**30 of the 525 verdicts were changed after the adjudicators returned them, and the direction is overwhelmingly favourable to the lists.** 29 on 2026-09-05: 14 landed on ''current'', 2 on ''granularity'', 1 on ''stale'' and 9 on ''unknown'' (which removes the row from every rate); one more on 2026-09-11, ''i.ua'' from ''error'' to ''current'', which also favours a list. Most of that is retiring a verdict the brief should never have offered, but the net effect is to move rates **up**, and every figure in the table above should be discounted accordingly. The full list with reasons is on the provenance pages.
 </WRAP>
@@ Line 209: / Line 209: @@
 Four readings, each of which needs the random sample and could not come from the disagreement table:
-  * **//error// — a name that was never the owner — is uncommon, and it is no longer absent from two of the three lists.** Zero of webXray's 56 settled entries, and the rule-of-three bound on that zero is below **5.4%** at 95% confidence. Tracker Radar has **3 of 56**: ''elfsight.com'' attributed to "Vladimir Fedotov", Elfsight's co-founder rather than the owning entity (''elfsight.com/terms-of-service/'' names **Elfsight, SL**); ''cnevids.com'' attributed to the law firm "Sabin, Bermant & Gould LLP", which appears in the record as the registrant's counsel and never operated the domain (''player.cnevids.com'' is Condé Nast Entertainment's own player); and ''cedscdn.it'' attributed to "The Trustico Group Ltd", a UK certificate reseller, where the ''.it'' registry names **CED DIGITAL & SERVIZI Srl**. Disconnect has **1 of 54**: ''km0trk.com'', whose entry is the bare domain string, where Good On You Pty Ltd's own privacy policy names ''www.km0trk.com'' as its own. **All four were found by the 2026-09-11 second pass and none of them was visible in the first**, because an unsettled row is scored against nobody. Staleness is still the dominant failure, but "error is rare" was partly an artefact of what could not be checked.
+  * **//error// — a name that was never the owner — is uncommon, and it is no longer absent from two of the three lists.** Zero of webXray's 56 settled entries, and the rule-of-three bound on that zero is below **5.4%** at 95% confidence. Tracker Radar has **3 of 56**: ''elfsight.com'' attributed to "Vladimir Fedotov", Elfsight's co-founder rather than the owning entity (''elfsight.com/terms-of-service/'' names **Elfsight, SL**); ''cnevids.com'' attributed to the law firm "Sabin, Bermant & Gould LLP", which appears in the record as the registrant's counsel and never operated the domain (''player.cnevids.com'' is Condé Nast Entertainment's own player); and ''cedscdn.it'' attributed to "The Trustico Group Ltd", a UK certificate reseller, where the ''.it'' registry names **CED DIGITAL & SERVIZI Srl**. Disconnect has **1 of 54**: ''km0trk.com'', whose entry is the bare domain string, where Good On You Pty Ltd's own privacy policy names ''www.km0trk.com'' as its own. That one is a **scoring decision, not an attribution blunder like the other three**, and the rule separating it from ''i.ua'' — where Disconnect's bare-looking "I.UA" was scored //current// — is whether the label is a brand the operator's own documents use for the property. "I.UA" is (the user agreement says "порталу I.UA"); "km0trk.com" is not. Reasonable people would score these the other way, and the entry-shape census below counts the whole class without needing a verdict at all. **Three of the four are new**: ''elfsight.com'' was already there, and ''cnevids.com'', ''cedscdn.it'' and ''km0trk.com'' came out of the 2026-09-11 second pass, because an unsettled row is scored against nobody. Staleness is still the dominant failure, but "error is rare" was partly an artefact of what could not be checked.
   * **Tracker Radar's encounter-weighted accuracy (74.3%) is the lowest of the three, despite its being the broadest — and partly because the three rates are not strictly on one axis.** A brand name survives an acquisition and a legal-entity name does not: for ''crwdcntrl.net'', "Lotame" scores current and "Lotame Solutions, Inc." scores stale, on one fact about one company. A list that carries legal names is therefore penalised by this measure for being more precise. Tracker Radar regenerates monthly but carries legal-entity names, and legal names lag renames: ''zoominfo.com'' is still "Zoom Information, Inc.", ''mountain.com'' "Mountain Digital, Inc." for MNTN, ''20min.ch'' "Tamedia AG" where the group renamed to TX Group, ''tvtime.com'' "Whipclip".
   * **The encounter-weighted column is concentrated enough that one domain moves it.** ''gstatic.com'' alone carries **38.8%** of webXray's encounter-weighted estimate, and webXray's top three drawn domains carry 52.2%; had ''gstatic.com'' been stale, webXray's 93.8% would read 55.0%. The equivalent heaviest rows are ''omtrdc.net'' for Tracker Radar (20.0%, and 74.3% would read 54.3%) and ''id5-sync.com'' for Disconnect (16.6%, 82.8% → 66.2%). That is not a defect in the estimator — it is what "weighted by how often you meet the domain" means when prevalence spans five orders of magnitude — but it is why the encounter-weighted column supports **neither a number nor an ordering**: all three intervals overlap every other, and no pairwise test is run on them. It is here because it is the quantity a paper's attribution error actually depends on, not because this sample can pin it down.
@@ Line 217: / Line 217: @@
 **Only one of the three pairwise differences survives a correction for having tested all three.** Fisher's exact on the eligible raw counts, two-sided:
-^ Pair ^ Eligible rows ^ //p// ^ //p// before the second pass ^ Survives Bonferroni at 0.0167? ^
+^ Pair ^ Counting ''current'' only ^ ^ ^ Counting ''current+granularity'' ^ ^ ^
-| Disconnect vs webXray | 48 of 54 against 40 of 56 | 0.031 | **0.014** | no |
+^ ^ Eligible rows ^ //p// ^ //p// before ^ Eligible rows ^ //p// ^ //p// before ^
-| Disconnect vs Tracker Radar | 48 of 54 against 42 of 56 | 0.083 | 0.025 | no |
+| Disconnect vs webXray | 48 of 54 against 40 of 56 | 0.031 | **0.014** | 52 of 54 against 44 of 56 | **0.008** | **0.010** |
-| Tracker Radar vs webXray | 42 of 56 against 40 of 56 | 0.83 | 0.82 | no |
+| Disconnect vs Tracker Radar | 48 of 54 against 42 of 56 | 0.083 | 0.025 | 52 of 54 against 43 of 56 | **0.004** | **0.004** |
+| Tracker Radar vs webXray | 42 of 56 against 40 of 56 | 0.83 | 0.82 | 43 of 56 against 44 of 56 | 1.00 | 0.81 |
-Three tests on one sample, so the threshold is 0.0167 rather than 0.05. **No pairwise difference survives it.** Disconnect is still the highest of the three and by the widest margin, but on 54 and 56 adjudicated rows that ordering is not established at this page's own threshold, and it should be described rather than asserted. Quote the p-values rather than pointing at the gap between the intervals: a percentile bootstrap on 54 rows undercovers at the top, which is why one endpoint reads 100.0.
+Three tests on one sample, so the threshold is 0.0167 rather than 0.05. **Which comparisons survive it depends entirely on whether //granularity// counts as right**, and that is a choice about your unit of analysis, not about the data:
-**This is the one claim on the page the second pass overturned, and the direction is worth naming.** Before 2026-09-11, Disconnect-versus-webXray was the single comparison that cleared the corrected threshold, at //p// = 0.014. Settling 28 of the 40 previously unadjudicable rows added 14 rows to webXray, 15 to Tracker Radar and 12 to Disconnect — and **9 of Disconnect's 12 were //current// while 3 were not**, against 41 of its previous 42. Its point estimate fell from 94.4% to 89.2%, the gap narrowed, and the //p// crossed the bar. An earlier version of this page asserted that the Disconnect-versus-Tracker-Radar difference could not be established **without having computed it**; it was 0.025 then and 0.083 now, and the correction is recorded on the provenance page.
+  * **If you care which //legal entity// owns the domain** (''current'' only), **none of the three survives**. Disconnect is still the highest and by the widest margin, but on 54 and 56 adjudicated rows that ordering is not established at this threshold and should be described rather than asserted.
+  * **If you care which //company// owns it** — the unit most papers use, and the one this page recommends two paragraphs above — **Disconnect beats both of the others**, at //p// = 0.008 and //p// = 0.004, and it did before the second pass too.
+Quote the p-values rather than pointing at the gap between the intervals: a percentile bootstrap on 54 rows undercovers at the top, which is why one endpoint reads 100.0.
+**What the second pass actually overturned is narrower than it first looks, and the narrowing matters.** Before 2026-09-11, Disconnect-versus-webXray cleared the corrected threshold on the ''current''-only metric at //p// = 0.014; it is now 0.031 and does not. **On ''current+granularity'' nothing changed**: Disconnect cleared the bar against both lists before (0.010, 0.004) and clears it after (0.008, 0.004). So the second pass cost Disconnect a //legal-entity-level// lead over a list this page calls historical, and cost it nothing at the company level. Settling 28 of the 40 previously unadjudicable rows added **7** eligible rows to webXray, **9** to Tracker Radar and **12** to Disconnect — and on the ''current''-only count, **9 of Disconnect's 12 were //current//**, against **39 of its previous 42**; its point estimate fell from 94.4% to 89.2% there, and from 98.8% to 96.8% on the looser metric. An earlier version of this page asserted that the Disconnect-versus-Tracker-Radar difference could not be established **without having computed it**; on ''current'' only it was 0.025 then and 0.083 now, and the correction is recorded on the provenance page.
 Two further limits on the 69.2%, both of which cut against reading it as a rehabilitation of webXray. First, those 56 settled entries come from the **664** webXray domains that are still in a 2026 crawl frame at all — **a fifth of its 3,215 domain→owner pairs**. A domain still requested in 2026 is a survivor, and survivors are where "current" concentrates, so the rate is over the surviving fifth and not over the file. Second, seven domains were adjudicated in both the 2026-08-17 and the 2026-09-05 sittings against a **bit-identical** copy of the file; of the five settled in both, webXray's verdict differs in **four**, every one towards //current//, and the difference is a change of scoring convention (which level of the tree, and whether the acquiring group or the operating subsidiary is "the owner") rather than a change of sample.
@@ Line 235: / Line 241: @@
 ==== What the second pass over the residue changed ====
-The 2026-09-05 sample left **40 of its 175 domains unadjudicable**, and every rate it produced was conditional on that. Because the share rose toward the prevalence tail and was worst for the list this page recommends, the obvious worry was that the unsettled rows were systematically worse and all three rates were flattered — which nothing inside that sample could test. On **2026-09-11** those 40 rows, and only those 40, were re-adjudicated against harder sourcing: **national company registers searched by company number**, the **registrar's own port-43 WHOIS** rather than RDAP (which returns a thin registry record with no registrant for ''.com'' and ''.net''), and **archived captures of each domain's own legal pages**. 28 of the 40 settled.
+The 2026-09-05 sample left **40 of its 175 domains unadjudicable**, and every rate it produced was conditional on that. Because the share rose toward the prevalence tail and was worst for the list this page recommends, the obvious worry was that the unsettled rows were systematically worse and all three rates were flattered — which nothing inside that sample could test. On **2026-09-11** those 40 rows, and only those 40, were re-adjudicated — again **by Sonnet sub-agents working to a published brief, one rater per domain, with no inter-rater agreement measured for this pass** — against harder sourcing: **national company registers searched by company number**, the **registrar's own port-43 WHOIS** rather than RDAP (which returns a thin registry record with no registrant for ''.com'' and ''.net''), and **archived captures of each domain's own legal pages**. 28 of the 40 settled.
 ^ ^ Before ^ After ^
@@ Line 244: / Line 250: @@
 | Tracker Radar, domain-level //current// | 73.7% | 73.9% |
 | webXray, domain-level //current// | 69.9% | 69.2% |
+| Tracker Radar, encounter-weighted //current// | 68.6% | **74.3%** |
 | ''error'' verdicts found | 1 (Tracker Radar) | **4** (3 Tracker Radar, 1 Disconnect) |
 | Pairwise comparisons surviving Bonferroni | 1 of 3 | **0 of 3** |
-**The formal test does not confirm the worry, and the point estimates do not refute it.** Comparing the recovered rows against the rows already in each rate — ''current''+''granularity'' against ''stale''+''error'', Fisher's exact two-sided — gives //p// = 0.64 for webXray (5 of 7 recovered good, against 39 of 49), //p// = 1.00 for Tracker Radar (7 of 9, against 36 of 47) and //p// = 0.40 for Disconnect (11 of 12, against 41 of 42). None is close to significant. But 7, 9 and 12 rows have almost no power to detect anything, and Disconnect's estimate still fell 5.2 points, which is the direction the worry predicted for the list the worry named. The honest summary is that the tail was **somewhat** worse for Disconnect and indistinguishable for the other two, and that settling it cost Disconnect its only statistically established lead.
+The **largest single movement of the pass is not in the domain-level column at all**: Tracker Radar's encounter-weighted rate rose 68.6% → 74.3%, almost all of it one recovered row, ''spot.im'' at prevalence 0.011. That is the column the page calls "the number a paper's attribution error depends on", and it moved five times as far as any domain-level rate.
+**The formal test does not confirm the worry, and the point estimates do not refute it.** Comparing the recovered rows against the rows already in each rate — ''current''+''granularity'' against ''stale''+''error'', Fisher's exact two-sided — gives //p// = 0.64 for webXray (5 of 7 recovered good, against 39 of 49), //p// = 1.00 for Tracker Radar (7 of 9, against 36 of 47) and //p// = 0.40 for Disconnect (11 of 12, against 41 of 42). None is close to significant. But 7, 9 and 12 rows have almost no power to detect anything, and Disconnect's estimate still fell 5.2 points, which is the direction the worry predicted for the list the worry named. And the answer depends on the metric: counting ''granularity'' as acceptable, Disconnect's recovered rows are 11 of 12 against 41 of 42 and its estimate falls 2.0 points rather than 5.2. **The honest summary is that nothing here establishes that the tail was worse for any list**, that Disconnect's point estimate moved in the direction the worry predicted on the stricter metric and barely at all on the looser one, and that none of the three tests has the power to tell those apart.
 <WRAP important>
@@ Line 253: / Line 262: @@
 ''domain-register'' is genuinely weaker: the field is asserted by the registrant and validated by nobody. This pass produced its own counter-example. ''i.ua'''s registry record names **Digital Ventures LLC**; the portal's own user agreement names a **different** company as its administration, ТОВ «КЕПРЕЙТ ПАРТНЕРС», register code 33500955. **On that domain the registrant of record is not the operator**, and the row was re-sourced to the legal document. Dropping every remaining recovered row that rests on an //uncorroborated// registrant organisation — ''cratecamera.com'' and ''sa-as.com'' — moves nothing: webXray +0.0, Tracker Radar −0.6, Disconnect +0.0 percentage points.
+**The comparison that actually answers the objection is the same-bar one**, and it is the one to quote if you distrust the new sources: drop **all 11** rows resting on a source kind the first pass would not have accepted, so that what is left is only what the 2026-09-05 bar could itself have reached. The rates barely move — webXray 69.2% (+0.0), Tracker Radar 72.1% (−1.8), Disconnect 89.0% (−0.2) — and the ordering, the significance verdicts and the residue conclusion are all unchanged. **So the second pass's result does not depend on the bar it widened.** Under the //other// reading of ''i.ua'' — that "I.UA" names no company and the row is an ''error'' rather than ''current'', the reading this pass argued against — Disconnect is 88.6% rather than 89.2%. All three runs are in section E3 of the report script's output.
 </WRAP>
-**What is left is a different kind of hard.** The 12 domains still unresolved — ''1rx.io'', ''agkn.com'', ''cdnbasket.net'', ''collective-media.net'', ''contentabc.com'', ''hqseek.com'', ''htplayground.com'', ''mapixl.com'', ''marphezis.com'', ''mmstat.com'', ''stat-track.com'', ''stripst.com'' — are not domains where the register was not tried. They are domains with a privacy-proxied registrant, no live site, no archived legal page, and in several cases nothing in the Archive but tracking endpoints, so there is no document to read at any date. Two have a further obstacle worth naming for anyone attempting this: ''mmstat.com'' would be settled by China's ICP registry, which serves a JavaScript challenge no fetch here could pass, and ''agkn.com'' by TransUnion's own pages, which return 403 to everything that is not a browser session. **The remaining residue is a lower bound on what harder sourcing can reach, not a claim that these domains have no owner.** Every attempted route per row is printed on [[provenance:design:ownership_resolution]].
+**What is left is a different kind of hard.** The 12 domains still unresolved — ''1rx.io'', ''agkn.com'', ''cdnbasket.net'', ''collective-media.net'', ''contentabc.com'', ''hqseek.com'', ''htplayground.com'', ''mapixl.com'', ''marphezis.com'', ''mmstat.com'', ''stat-track.com'', ''stripst.com'' — are not domains where the register was not tried. **Ten of the twelve** are domains with a privacy-proxied registrant, no live site, no archived legal page, and in several cases nothing in the Archive but tracking endpoints, so there is no document to read at any date. Two have a further obstacle worth naming for anyone attempting this: ''mmstat.com'' would be settled by China's ICP registry, which serves a JavaScript challenge no fetch here could pass, and ''agkn.com'' by TransUnion's own pages, which return 403 to everything that is not a browser session.
+**The other two are limits of this pass rather than of the evidence, and a person could still close them.** ''hqseek.com'' redirects to a live adult site and the adjudicator declined to follow it on content policy — so the row is unresolved because a rater stopped, not because nothing is there; its note also records that Tracker Radar's claim, a personal name, matches nothing the domain's own pages ever surfaced, which would be an ''error'' rather than an ''unknown'' if it were run down. ''stripst.com'''s operator pages returned HTTP 406 to every non-browser fetch — a transport failure, not an absence. Both would be worth a browser session; neither was given one here.
+**The residue is also not a random slice of the sample, and the way it is skewed matters for the bound below.** Three of Disconnect's six remaining rows are entries where Disconnect's own value carries no company name a register could be searched for — ''cdnbasket.net'' and ''htplayground.com'' are the bare domain string, and ''stat-track.com'''s "StackTrack" is not a findable company. That is the same class as ''km0trk.com'', the one entry Disconnect was scored ''error'' on, so the worst case is more likely to bind on Disconnect than the even split of the residue across the three lists would suggest. **The remaining residue is a lower bound on what harder sourcing can reach, not a claim that these domains have no owner.** Every attempted route per row is printed on [[provenance:design:ownership_resolution]].
 ==== Inter-rater agreement, measured rather than assumed ====
@@ Line 272: / Line 287: @@
 ^ Source ^ Status — repository state re-checked **2026-09-11**, accuracy figures drawn 2026-09-05 and re-adjudicated over the residue **2026-09-11** ^ Use it when ^
-| **Disconnect ''entities.json''** | **current**; last commit 2026-09-05; CC BY-NC-SA 4.0; feeds Firefox's tracking protection via Mozilla's ''shavar-prod-lists''((''mozilla-services/shavar-prod-lists'' README, checked 2026-08-17: "Firefox's Enhanced Tracking Protection features rely on lists of trackers maintained by Disconnect… Mozilla does not maintain these lists", and ''disconnect-blacklist.json'' is "a version controlled copy of Disconnect's list of trackers".)) and, per Disconnect, Microsoft Edge as well | you want the **most current** owner name, and you can live with a sparser list and no hierarchy. Note that ''properties'' (5,843 domains) and ''resources'' (4,148) are different claims and 2,007 domains appear only in the second; the schema is not documented, so state which key you read. Do not quote Disconnect's own headline "14,332 verified domains and entity mappings" as the size of ''entities.json'' — that file holds 7,850 domains; count the file you read.((''https://disconnect.me/trackerprotection'', checked 2026-08-17, states "14,332 Verified domains and entity mappings" and that the lists "power Microsoft Edge, Mozilla Firefox, other partners". The 7,850 figure is measured from ''entities.json'' by ''owner_dbs.py''.)) |
+| **Disconnect ''entities.json''** | **current**, but less current than the repository looks: the repo's HEAD is 2026-09-05 and ''entities.json'' has not changed since **2026-08-07**, five weeks earlier — the 2026-09-05 commit touched ''services.json''. The file is byte-identical (412,191 bytes) at 2026-08-07, at 2026-09-05 and on ''master'' today.((''api.github.com/repos/disconnectme/disconnect-tracking-protection/commits?path=entities.json'' → ''ab6ff5a3a8'', 2026-08-07T17:07:16Z, "Latest list updates."; the repo's HEAD ''4b592c288a'', 2026-09-05T20:21:14Z, "Recent list updates.", does not touch it. The three raw files fetched and hashed, 2026-09-11. **Query the path, not the repo** — a repository that commits every few days can carry a file that has not moved in over a month.)) CC BY-NC-SA 4.0; feeds Firefox's tracking protection via Mozilla's ''shavar-prod-lists''((''mozilla-services/shavar-prod-lists'' README, checked 2026-08-17: "Firefox's Enhanced Tracking Protection features rely on lists of trackers maintained by Disconnect… Mozilla does not maintain these lists", and ''disconnect-blacklist.json'' is "a version controlled copy of Disconnect's list of trackers".)) and, per Disconnect, Microsoft Edge as well | you want the **most current** owner name, and you can live with a sparser list and no hierarchy. Note that ''properties'' (5,843 domains) and ''resources'' (4,148) are different claims and 2,007 domains appear only in the second; the schema is not documented, so state which key you read. Do not quote Disconnect's own headline "14,332 verified domains and entity mappings" as the size of ''entities.json'' — that file holds 7,850 domains; count the file you read.((''https://disconnect.me/trackerprotection'', checked 2026-08-17, states "14,332 Verified domains and entity mappings" and that the lists "power Microsoft Edge, Mozilla Firefox, other partners". The 7,850 figure is measured from ''entities.json'' by ''owner_dbs.py''.)) |
 | **DuckDuckGo Tracker Radar** ''entity_map.json'' / ''domain_map.json'' | **current**; regenerated monthly, last commit on ''main'' 2026-08-28 — the commit the newest release tag ''2026.08.28'' points at. The repository's ''pushed_at'' field reads later than that (2026-09-02 on 2026-09-11) because unmerged automation branches count towards it, so read the branch, not the field; CC BY-NC-SA 4.0 | you want the **broadest** coverage, prevalence weights, or per-domain categories and fingerprinting scores in the same dataset. Expect legal-entity names, and expect renames to lag. |
 | **Ghostery ''trackerdb''** / WhoTracks.me | **current**; ''trackerdb'' last commit 2026-09-01, **CC BY-NC-SA 4.0** (its ''package.json'' says so explicitly; GitHub reports no SPDX id, so do not trust the API field); WhoTracks.me data repo last commit 2026-09-02 ("August update"); the site now redirects to ''ghostery.com/whotracksme'' | you want an ''organizations'' + ''patterns'' model where one company can carry several independently categorised behaviours (Google Analytics separate from Google Tag Manager), or the {[karaj2018whotracksme]} longitudinal data |
@@ Line 395: / Line 410: @@
   * Nothing on this wiki or in this corpus measures **Ghostery ''trackerdb''** against the other three. It is live, it is the fourth real option, and it is the one gap in the comparison above.
   * webXray's ''parent_id'' tree is the only hierarchy any of these files carries. Whether a hierarchy //built from a current list// — Tracker Radar's entities plus a corporate-structure source — would beat both flat lookup and webXray's frozen tree is unmeasured.
-  * The accuracy rates here are conditional on a domain being adjudicable, and 18–30% of each list's draws were not. What those domains are, and whether they differ systematically between lists, would need a different instrument than a random sample.
+  * The accuracy rates here are conditional on a domain being adjudicable. That was 18–30% of each list's draws until 2026-09-11, when a second pass with harder sourcing settled 28 of the 40 and brought it to **6.7% / 6.7% / 10.0%**; it is not zero and the 12 domains still unresolved cannot be bounded from inside the sample. Whether //those// differ systematically between lists still needs a different instrument.
 </WRAP>
@@ Line 405: / Line 420: @@
   * The coverage denominator is **Tracker Radar's own crawl output**. There is no neutral census of third-party domains, so this favours Tracker Radar; the page says so wherever a coverage figure appears rather than pretending otherwise.
   * The 28 adjudicated rows are the highest-prevalence **disagreements**, deliberately not a random sample, so they characterise the shape of disagreement and not any list's accuracy.
-  * The **random sample** is 60 domains per list from that list's own coverage, stratified into prevalence quartiles with allocation 24/12/12/12, seed 20260905. Its limits, in the order they matter: every rate is conditional on the entry being adjudicable, and after the 2026-09-11 second pass 4–6 of each 60 still are not (11–18 before it); the frame is Tracker Radar's ''domain_summary.json'', so no list is scored on domains that crawl never saw; and the encounter-weighted column is a ratio estimator concentrated in a handful of head domains, which is why its intervals reach 68 percentage points wide. **29 of the 525 verdicts were changed after the adjudicators returned them**, and **the direction is overwhelmingly favourable to the lists** — discount accordingly. Every change is listed with its reason on the provenance pages.
+  * The **random sample** is 60 domains per list from that list's own coverage, stratified into prevalence quartiles with allocation 24/12/12/12, seed 20260905. Its limits, in the order they matter: every rate is conditional on the entry being adjudicable, and after the 2026-09-11 second pass 4–6 of each 60 still are not (11–18 before it); the frame is Tracker Radar's ''domain_summary.json'', so no list is scored on domains that crawl never saw; and the encounter-weighted column is a ratio estimator concentrated in a handful of head domains, which is why its intervals reach 68 percentage points wide. **30 of the 525 verdicts were changed after the adjudicators returned them**, and **the direction is overwhelmingly favourable to the lists** — discount accordingly. Every change is listed with its reason on the provenance pages.
   * The corpus is seven venues and omits EuroS&P, ACSAC, RAID, AsiaCCS, CHI and SOUPS, so "136 papers" is a statement about those seven. Ownership resolution is also published outside them: webXray's own author placed most of his results in The BMJ, JAMA, //Communications of the ACM// and //New Media and Society//, none of which this corpus can see.
   * Full-text counts are **paper** counts over ''paper.cols.txt'' with whitespace collapsed, so a term broken across a PDF column boundary still matches. They are mentions, not verified uses, except where the table says hand-verified.