| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| privacy:javascript [2026/09/03 22:13] – Generic-review fixes: repoint the cross-page anchor after the target heading was renamed, replace 'top 7%' with the corrected 20.3% resolvable-model figure, and correct 'the two lowest non-empty rows' (javascript and fingerprinting-script are zero rows, t karel.kubicek.claude | privacy:javascript [2026/10/08 20:49] (current) – Finish PII leakage collateral: back-links and provenance; Authored by Claude karel.kubicek.claude |
|---|
| **The nearest peer-reviewed work is one layer down, at the request.** TGNN {[xiong2026_tgnn]} (TheWebConf 2026) uses Qwen3 to label HTTP request/response quadruples as tracking or not, and reports an annotation F1 of **98.17%** against expert labels where filter lists reach **55.14%** on the same ground truth.((The paper reports this figure twice as **98.17%** — in §4.1.3 //LLM-based Labeling// ("𝑀𝜆 performs well (𝐹1-score of 98.17%)") and again beside Figure 5 — and once as **98.19%**, in the contributions paragraph of its Introduction. Its abstract states no F1 for the annotation component at all. The discrepancy is the paper's, not ours; the body figure is quoted here and on [[privacy:requests]], so the two pages agree. The 55.14% filter-list comparison appears only in the Introduction. Located in ''paper.cols.txt'' on 2026-09-03; note that this file contains NUL bytes, so shell ''grep'' reports nothing without ''-a''.)) It is not a script classifier — it explicitly contrasts its approach with prior methods that do "single-domain analysis-such as string matching against domain lists or scrutinizing JavaScript execution within a page" — but it is the closest thing to a citable precedent for using a model to //manufacture tracker labels//, which is this page's weakest link. [[privacy:requests]] treats it in full. Beyond it the adjacent work is not peer-reviewed and not on-point: LLM-aided **deobfuscation** feeding a graph classifier for JavaScript //malware//,((//Breaking Obfuscation: Cluster-Aware Graph with LLM-Aided Recovery for Malicious JavaScript Detection//, [[https://arxiv.org/abs/2507.22447|arXiv:2507.22447]], 2025.)) LLM screening of malicious npm packages, and ''humanify'', which uses a model only to //suggest identifier names// during de-minification.(([[https://github.com/jehna/humanify|github.com/jehna/humanify]], v3.1.1, checked 2026-08-06. The AST rewrite is done by ''oxc''; the model only proposes names.)) | **The nearest peer-reviewed work is one layer down, at the request.** TGNN {[xiong2026_tgnn]} (TheWebConf 2026) uses Qwen3 to label HTTP request/response quadruples as tracking or not, and reports an annotation F1 of **98.17%** against expert labels where filter lists reach **55.14%** on the same ground truth.((The paper reports this figure twice as **98.17%** — in §4.1.3 //LLM-based Labeling// ("𝑀𝜆 performs well (𝐹1-score of 98.17%)") and again beside Figure 5 — and once as **98.19%**, in the contributions paragraph of its Introduction. Its abstract states no F1 for the annotation component at all. The discrepancy is the paper's, not ours; the body figure is quoted here and on [[privacy:requests]], so the two pages agree. The 55.14% filter-list comparison appears only in the Introduction. Located in ''paper.cols.txt'' on 2026-09-03; note that this file contains NUL bytes, so shell ''grep'' reports nothing without ''-a''.)) It is not a script classifier — it explicitly contrasts its approach with prior methods that do "single-domain analysis-such as string matching against domain lists or scrutinizing JavaScript execution within a page" — but it is the closest thing to a citable precedent for using a model to //manufacture tracker labels//, which is this page's weakest link. [[privacy:requests]] treats it in full. Beyond it the adjacent work is not peer-reviewed and not on-point: LLM-aided **deobfuscation** feeding a graph classifier for JavaScript //malware//,((//Breaking Obfuscation: Cluster-Aware Graph with LLM-Aided Recovery for Malicious JavaScript Detection//, [[https://arxiv.org/abs/2507.22447|arXiv:2507.22447]], 2025.)) LLM screening of malicious npm packages, and ''humanify'', which uses a model only to //suggest identifier names// during de-minification.(([[https://github.com/jehna/humanify|github.com/jehna/humanify]], v3.1.1, checked 2026-08-06. The AST rewrite is done by ''oxc''; the model only proposes names.)) |
| |
| <WRAP todo>Treat this as an opportunity, not a settled answer. If you are planning an LLM-based script classifier, you are not late — but you also have no baseline to cite, so budget for building one, and for the reviewer question about cost, reproducibility and prompt/version drift that this page cannot yet answer for you. Two things you can borrow rather than invent: TGNN's annotation-versus-filter-list comparison {[xiong2026_tgnn]} is the experimental design a reviewer will expect, and the model-reporting figures on [[design:website_classification#And almost nobody names a model you could resolve]] show that only **20.3%** of the 177 corpus papers using an LLM name a model resolvable to an actual artefact — so naming yours to the checkpoint is cheap novelty.</WRAP> | <WRAP todo>Treat this as an opportunity, not a settled answer. If you are planning an LLM-based script classifier, you are not late — but you also have no baseline to cite, so budget for building one, and for the reviewer question about cost, reproducibility and prompt/version drift that this page cannot yet answer for you. Two things you can borrow rather than invent: TGNN's annotation-versus-filter-list comparison {[xiong2026_tgnn]} is the experimental design a reviewer will expect, and the model-reporting figures on [[design:website_classification#And almost nobody names a model you could resolve]] show that only **19.4%** of the 175 corpus papers that actually use an LLM name a model resolvable to an actual artefact — so naming yours to the checkpoint is cheap novelty.</WRAP> |
| |
| ==== Two 2025 results that change how you design a crawl ==== | ==== Two 2025 results that change how you design a crawl ==== |
| | Esprima | 21 | 10.2% | | | Esprima | 21 | 10.2% | |
| | OpenWPM | 19 | 9.2% | | | OpenWPM | 19 | 9.2% | |
| | | Project Foxhound (taint tracking)((**9, not the 8 published here until 2026-09-21.** The column counts ''tools[]'' tuples marked ''used'' or ''produced'', and Khodayari et al.'s NDSS 2025 open-redirection paper was extracted as ''compared'' — it ran Foxhound as one of six baseline detectors over 42,288 pages, which is running it. The per-paper role audit on [[Programming:Crawler:Foxhound]] reads all 13 full-text matches in the corpus and that verdict now feeds this row; it is the only hand verdict in this table, and it cannot add a paper to the 206, which this one was already in on its detection and classification signals.)) | 9 | 4.4% | |
| | PageGraph | 8 | 3.9% | | | PageGraph | 8 | 3.9% | |
| | Project Foxhound (taint tracking) | 8 | 3.9% | | |
| | VisibleV8 | 8 | 3.9% | | | VisibleV8 | 8 | 3.9% | |
| | js-beautify | 7 | 3.4% | | | js-beautify | 7 | 3.4% | |
| | Acorn, AdGraph, Emscripten, JSgraph, JSNice, Khaleesi, Rhino, SpiderMonkey, TAJS, UglifyJS, unnamed deobfuscator | 1 each | 0.5% | | | Acorn, AdGraph, Emscripten, JSgraph, JSNice, Khaleesi, Rhino, SpiderMonkey, TAJS, UglifyJS, unnamed deobfuscator | 1 each | 0.5% | |
| |
| Two rows moved enough to matter. **Esprima has overtaken OpenWPM** as the most-named tool, and **Project Foxhound went from 2 papers to 8 and PageGraph from 4 to 8** — the taint-tracking and page-graph instruments the //Methods// table above calls current are the ones the 2025–2026 papers actually picked up. That is the rare case where the corpus confirms a currency judgement instead of only dating it. | Two rows moved enough to matter. **Esprima has overtaken OpenWPM** as the most-named tool, and **Project Foxhound went from 2 papers to 9 and PageGraph from 4 to 8** — the taint-tracking and page-graph instruments the //Methods// table above calls current are the ones the 2025–2026 papers actually picked up. That is the rare case where the corpus confirms a currency judgement instead of only dating it. |
| |
| **120 of 206 papers (58.3%) name no JavaScript-analysis tool at all** — they wrote their own parser, regexes or instrumentation and did not name it. That is the field's reproducibility problem in one number. | **119 of 206 papers (57.8%) name no JavaScript-analysis tool at all** — they wrote their own parser, regexes or instrumentation and did not name it. That is the field's reproducibility problem in one number. |
| |
| ==== Maintenance status, because half of these are frozen ==== | ==== Maintenance status, because half of these are frozen ==== |
| // The population itself, with the reasons recorded. | // The population itself, with the reasons recorded. |
| // --------------------------------------------------------------------------- | // --------------------------------------------------------------------------- |
| | // `usedOrMentioned == "compared"` is not always "did not run it". A paper that |
| | // benchmarks its own detector against a prior tool normally RUNS that tool, and |
| | // the extraction files that as `compared`, which drops it out of a "papers |
| | // using this instrument" count. Deciding that in general needs a per-paper read, |
| | // so it is NOT done in general: this map holds only the papers where a |
| | // published audit has read the sentence and recorded the verdict, and it names |
| | // the audit. Currently one entry, from the Foxhound role audit behind |
| | // [[programming:crawler:foxhound]] (scripts/fh_fold.mjs ROLE, 2026-08-17), whose |
| | // `baseline` role means "ran it as a comparison point". |
| | // |
| | // It adds to `tools` ONLY — not to `strictTools`, and so not to `reasons` and |
| | // not to the page's population rule. A hand entry must not be able to pull a |
| | // paper into the 206; this paper is already in it on its detection and |
| | // classification signals. |
| | export const TOOL_ROLE_OVERRIDE = new Map([ |
| | [ |
| | 'NDSS/2025/do-not-follow-the-white-rabbit-challenging-the-myth-of-harmless-open-redirection', |
| | { |
| | tool: 'Foxhound', |
| | audit: 'programming:crawler:foxhound — fh_fold.mjs ROLE, role "baseline"', |
| | quote: |
| | 'We considered the following state-of-the-art detectors as baselines: dynamic taint-tracking [24, 36, 45] using Foxhound [44, 45]', |
| | what: 'ran Foxhound as one of six baseline detectors over 42,288 pages', |
| | }, |
| | ], |
| | ]); |
| | |
| export function jsSignals(p) { | export function jsSignals(p) { |
| const reasons = []; | const reasons = []; |
| const strict = foldJsToolStrict(t.name); | const strict = foldJsToolStrict(t.name); |
| if (strict) strictTools.add(strict); | if (strict) strictTools.add(strict); |
| | } |
| | const override = TOOL_ROLE_OVERRIDE.get(paperKey(p)); |
| | if (override) { |
| | // Fail loudly if the tuple the override is about has disappeared or has |
| | // been re-extracted as used/produced: a hand entry that fires on nothing is |
| | // a hand entry that hides a change in the data. |
| | const t = p.tools.find((x) => foldJsTool(x.name) === foldJsTool(override.tool)); |
| | if (!t) |
| | throw new Error( |
| | `TOOL_ROLE_OVERRIDE for ${paperKey(p)} names ${override.tool}, which this paper's tools[] no longer contains` |
| | ); |
| | if (t.usedOrMentioned === 'used' || t.usedOrMentioned === 'produced') |
| | throw new Error( |
| | `TOOL_ROLE_OVERRIDE for ${paperKey(p)} is now redundant: ${override.tool} is extracted as "${t.usedOrMentioned}". Remove the entry.` |
| | ); |
| | tools.add(foldJsTool(override.tool)); |
| } | } |
| if (strictTools.size) reasons.push('tool'); | if (strictTools.size) reasons.push('tool'); |
| |
| * [[Privacy:Requests]] — classifying at the request/URL layer, where filter lists live, and why they cap this page's ground truth. | * [[Privacy:Requests]] — classifying at the request/URL layer, where filter lists live, and why they cap this page's ground truth. |
| | * [[Privacy:PII leakage]] — what scripts that read form fields and the DOM are found sending: session replay, pixels' advanced matching, configuration versus transmission. |
| * [[Privacy:Cookies]] — what the scripts write; the provenance argument (a cookie set by a blocked resource) is the same idea one layer down. | * [[Privacy:Cookies]] — what the scripts write; the provenance argument (a cookie set by a blocked resource) is the same idea one layer down. |
| * [[Privacy:Fingerprinting]] — 39.8% of browser-fingerprinting papers are really detecting //scripts//, so that page and this one share a method. | * [[Privacy:Fingerprinting]] — 39.8% of browser-fingerprinting papers are really detecting //scripts//, so that page and this one share a method. |
| * [[Design:Website classification]] — where script classification sits in the wider taxonomy. | * [[Design:Website classification]] — where script classification sits in the wider taxonomy. |
| * [[Design:Crawling location]] — the vantage-point half of the "the site served you different code" problem. | * [[Design:Crawling location]] — the vantage-point half of the "the site served you different code" problem. |
| | * [[Security:Malicious web content]] — when the script is malicious: miners, exploit pages, skimmers and compromised third-party scripts, and why lists miss them. |
| * [[Practices:Ethics]] — forced execution, deobfuscation and stealth crawling all override a site operator's expressed preferences. | * [[Practices:Ethics]] — forced execution, deobfuscation and stealth crawling all override a site operator's expressed preferences. |
| |
