Differences

This shows you the differences between two versions of the page.

--- design:platforms [2026/09/22 01:21] – Audit the 145 crawlConfig.authentication='none' platform papers: 6 contradicted, 12 affirmed, 8 ambiguous, 119 silent (scripts/auth145_audit.mjs --verdicts). Authored by Claude karel.kubicek.claude
+++ design:platforms [2026/09/27 12:02] (current) – Add the messaging-groups route: route-table row, currency row, a paragraph in the per-company section and a Related Pages entry pointing to the new child page Design:Platforms:Messaging channels. Authored by Claude. karel.kubicek.claude
@@ Line 57: / Line 57: @@
 | **Regulator route (DSA Art. 40 vetted researcher)** | **current** | in principle non-public data from a designated VLOP | effectively **zero** papers; see the audit below |
 | **Transparency / ad archive** | **current** | only what the archive covers — usually ads that actually ran | **11** hand-audited papers; own page: [[Design:Platforms:Ad archives]] |
+| **Joining public groups, channels or servers** (Telegram, WhatsApp, Discord) | **current, contested** | the groups your seed could find, from your joining date or back-filled, as a member sees them | **26** hand-audited papers, 21 of them on Telegram; own page: [[Design:Platforms:Messaging channels]] |
 | **Third-party archive of platform data** | **historical** | someone else's crawl, with their gaps — the dumps circulate, the live service does not | **35** papers name Pushshift |
 | **Reuse of a published platform dataset** | **current** | a frozen snapshot you did not design | **383 of 897** name an existing dataset; **208** name one //and no primary collection// |
@@ Line 113: / Line 114: @@
   * **A reused dataset freezes a platform that has since changed.** **383 of the 897** platform-subject papers name an existing dataset (''temporal.mode'' is multi-valued, so 175 of those also collected something themselves; **208** collected nothing). If that is you, date the snapshot and say what changed on the platform since — the four false positives in our Twitter/X audit were all papers using Twitter-derived benchmark corpora with no relationship to the platform at collection time.
   * **A cross-platform study has one denominator per platform, and they are not comparable.** {[acharya2024_imitation]} looked for brand-impersonation accounts targeting the top 10K Tranco brands on X, Instagram, Telegram and YouTube at once; {[beluri2025_exploration]} tracked accounts advertised for sale across five platforms and found blocking efficacy ranging from **5.02%** (YouTube) up to **48%** — its own summary is that "//TikTok and Instagram demonstrated the highest detection efficacy at 48%, whereas YouTube and Facebook showed the lowest efficacy at just 5%//". A cross-platform rate is only meaningful if you say what you could see on each platform, because the routes in differ and so does the visible surface. A gap between two platforms may be a gap between two access routes.
-  * **The logged-out surface is not the platform either — and the label that says so is mostly an inference.** Of the **260** platform-subject papers that report a crawl configuration, **145 (55.8%)** are labelled as using **no authentication at all**, **22** as registering an account, **4** as logging in manually, and **none** as using automated login or SSO. **Those 145 have now been audited** (2026-09-22), by reading each paper's own text rather than its evidence quote — ''%%crawlConfig%%'' carries **one evidence quote for the whole object**, so the ''%%authentication%%'' label cannot be checked against it ([[Programming:Registration]]). Of the 145: **12 (8.3%)** state in the paper that the collection was unauthenticated; **6 (4.1%)** are **contradicted by the paper's own text**; **8 (5.5%)** are ambiguous, where the study registered or used accounts but the specific crawl the evidence quote describes plausibly did not; and **119 (82.1%)** are **silent** — the paper never states its authentication posture either way, and ''%%not-stated%%'' was equally available in the schema. So read the 55.8% as an inference, not a measurement: **at most 12 of the 145 papers say what their label says**. Two of the contradicted six: {[kumar2022_investigation]} set up //"ten Google Pixel 2 phones ... with one Google account per country"// and an apk scraper that //"requires the device's ID and Google account credentials"//, while its ''%%crawlConfig%%'' quote describes only the unauthenticated Selenium privacy-policy sub-crawl; {[yan2025_sign]} //"registered around 300 accounts in total throughout the study"//. The starkest case is //Experimental Analyses of the Physical Surveillance Risks in Client-Side Content Scanning// (NDSS 2024), whose ''%%crawlConfig%%'' evidence quote **itself** reads //"we scrape user photographs from Instagram using an alias account"// under a ''%%none%%'' label. All six, and the 12 affirmed and 8 ambiguous, are listed with their deciding sentence on [[provenance:design:platforms]]. The sibling field ''%%consentAction%%'' was audited the same way and found **279 of 313 no-interaction labels unsupported (89.1%)**, alongside **7 of 36 (19.4%)** false positives among labels claiming interaction ([[Privacy:consent]]); that result is not evidence about authentication, and was not used as any.
+  * **The logged-out surface is not the platform either — and the label that says so is mostly an inference.** Of the **260** platform-subject papers that report a crawl configuration, **145 (55.8%)** are labelled as using **no authentication at all**, **22** as registering an account, **4** as logging in manually, and **none** as using automated login or SSO. **Those 145 have now been audited** (2026-09-22), by reading each paper's own text rather than its evidence quote — ''%%crawlConfig%%'' carries **one evidence quote for the whole object**, so the ''%%authentication%%'' label cannot be checked against it ([[Programming:Registration]]). Of the 145: **12 (8.3%)** state in the paper that the collection was unauthenticated; **6 (4.1%)** are **contradicted by the paper's own text**; **8 (5.5%)** are ambiguous, where the study registered or used accounts but the specific crawl the evidence quote describes plausibly did not; and **119 (82.1%)** are **silent** — the paper never states its authentication posture either way, and ''%%not-stated%%'' was equally available in the schema. So read the 55.8% as an inference, not a measurement: **at most 12 of the 145 papers say what their label says**. Two of the contradicted six: {[kumar2022_investigation]} set up ten Android phones, //"one Google account per country"//, and an apk scraper that //"requires the device's ID and Google account credentials"//, while its ''%%crawlConfig%%'' quote describes only the unauthenticated Selenium privacy-policy sub-crawl; {[yan2025_sign]} //"registered around 300 accounts in total throughout the study"//. The starkest case is //Experimental Analyses of the Physical Surveillance Risks in Client-Side Content Scanning// (NDSS 2024), whose ''%%crawlConfig%%'' evidence quote **itself** reads //"we scrape user photographs from Instagram using an alias account"// under a ''%%none%%'' label. All six, and the 12 affirmed and 8 ambiguous, are listed with their deciding sentence on [[provenance:design:platforms]]. The sibling field ''%%consentAction%%'' was audited the same way and found **279 of 313 no-interaction labels unsupported (89.1%)**, alongside **7 of 36 (19.4%)** false positives among labels claiming interaction ([[Privacy:consent]]); that result is not evidence about authentication, and was not used as any.
 ===== Rate Limits, Quotas, Bans and the Login Wall =====
@@ Line 303: / Line 304: @@
 | Platform research programmes (Meta Content Library via CASD, TikTok Research Tools, YouTube Researcher Program) | **current, but you will be first** | 1, 0 and 2 papers respectively in 5,855 |
 | DSA Art. 40 vetted-researcher route | **current, newly operational, untested here** | Delegated Reg. (EU) 2025/2050; 1 on-point mention in 5,855 papers |
+| Joining public messaging groups and channels | **current; terms forbid most of it; almost all Telegram since 2022** | **26** hand-audited papers, none before 2019; own page: [[Design:Platforms:Messaging channels]] |
 | Ad-transparency archives | **current and productive** | **11** hand-audited papers; {[bouchaud2024_beyond]}, {[benzaamia2026_year]}, {[capozzi2023_thin]}. Own page: [[Design:Platforms:Ad archives]] |
 | Data donation | **current and rising** | 25 papers, 11 of them 2025; {[mccrosky2026_does]}, {[benzaamia2026_year]} |
@@ Line 338: / Line 340: @@
 A per-company page is the wrong axis anyway. What a platform study reuses across companies is the **route in** and the **denominator that route implies**; what does not transfer is the company's current API surface, which is precisely the part that goes stale fastest. This page is organised by route for that reason.
+A second route page followed on 2026-09-27: **[[Design:Platforms:Messaging channels]]**, on joining Telegram, WhatsApp and Discord groups and channels — a route none of the rows above covers, organised by the route rather than by the three companies. Its hand audit found **26** papers in these venues that collect from inside groups, against **76** that name one of the three messengers ten or more times.
 The one page that the evidence //does// support was not on the promised list, and it has now been written: **[[Design:Platforms:Ad archives]]** — ad-transparency archives as a measurement instrument, with a live regulatory driver, real double-sided error characteristics {[bouchaud2024_beyond]}, and a 2026 cross-platform comparison {[benzaamia2026_year]}.
@@ Line 371: / Line 375: @@
   * **[[:Artifacts]]** — depositing data from a channel that may not outlive the paper.
   * **[[Statistics:Biases]]** — donation panels, follower thresholds, and convenience samples.
-  * **[[Design:Platforms:Ad archives]]** — the one access route on this page with its own instrument page: what each of the thirteen DSA ad repositories covers, what an archive structurally cannot contain, and the two-sided error problem.
+  * **[[Design:Platforms:Messaging channels]]** — joining public groups, channels and servers: how they are found, what joining shows you, the denominator, client tooling and terms, and the ethics of recording groups whose members did not join a study.
+  * **[[Design:Platforms:Ad archives]]** — an access route on this page with its own instrument page: what each of the thirteen DSA ad repositories covers, what an archive structurally cannot contain, and the two-sided error problem.
+  * **[[Security:Online scams]]** — scam campaigns followed off the platform to the scam website or wallet. Scam accounts, comments and posts as the object stay on this page.
   * **[[provenance:design:platforms]]** — every query, fold, audit and external check behind this page.