Measure The Web

User Tools

Site Tools

Trace:
privacy:javascript

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
privacy:javascript [2026/09/03 22:34] – Re-review fix: the resolvable-model figure moved to 19.4% of 175 after the buckets were restricted to papers that used an LLM rather than compared against one. Authored by Claude karel.kubicek.claudeprivacy:javascript [2026/10/08 20:49] (current) – Finish PII leakage collateral: back-links and provenance; Authored by Claude karel.kubicek.claude
Line 235: Line 235:
 | Esprima | 21 | 10.2% | | Esprima | 21 | 10.2% |
 | OpenWPM | 19 | 9.2% | | OpenWPM | 19 | 9.2% |
 +| Project Foxhound (taint tracking)((**9, not the 8 published here until 2026-09-21.** The column counts ''tools[]'' tuples marked ''used'' or ''produced'', and Khodayari et al.'s NDSS 2025 open-redirection paper was extracted as ''compared'' — it ran Foxhound as one of six baseline detectors over 42,288 pages, which is running it. The per-paper role audit on [[Programming:Crawler:Foxhound]] reads all 13 full-text matches in the corpus and that verdict now feeds this row; it is the only hand verdict in this table, and it cannot add a paper to the 206, which this one was already in on its detection and classification signals.)) | 9 | 4.4% |
 | PageGraph | 8 | 3.9% | | PageGraph | 8 | 3.9% |
-| Project Foxhound (taint tracking) | 8 | 3.9% | 
 | VisibleV8 | 8 | 3.9% | | VisibleV8 | 8 | 3.9% |
 | js-beautify | 7 | 3.4% | | js-beautify | 7 | 3.4% |
Line 246: Line 246:
 | Acorn, AdGraph, Emscripten, JSgraph, JSNice, Khaleesi, Rhino, SpiderMonkey, TAJS, UglifyJS, unnamed deobfuscator | 1 each | 0.5% | | Acorn, AdGraph, Emscripten, JSgraph, JSNice, Khaleesi, Rhino, SpiderMonkey, TAJS, UglifyJS, unnamed deobfuscator | 1 each | 0.5% |
  
-Two rows moved enough to matter. **Esprima has overtaken OpenWPM** as the most-named tool, and **Project Foxhound went from 2 papers to 8 and PageGraph from 4 to 8** — the taint-tracking and page-graph instruments the //Methods// table above calls current are the ones the 2025–2026 papers actually picked up. That is the rare case where the corpus confirms a currency judgement instead of only dating it.+Two rows moved enough to matter. **Esprima has overtaken OpenWPM** as the most-named tool, and **Project Foxhound went from 2 papers to 9 and PageGraph from 4 to 8** — the taint-tracking and page-graph instruments the //Methods// table above calls current are the ones the 2025–2026 papers actually picked up. That is the rare case where the corpus confirms a currency judgement instead of only dating it.
  
-**120 of 206 papers (58.3%) name no JavaScript-analysis tool at all** — they wrote their own parser, regexes or instrumentation and did not name it. That is the field's reproducibility problem in one number.+**119 of 206 papers (57.8%) name no JavaScript-analysis tool at all** — they wrote their own parser, regexes or instrumentation and did not name it. That is the field's reproducibility problem in one number.
  
 ==== Maintenance status, because half of these are frozen ==== ==== Maintenance status, because half of these are frozen ====
Line 467: Line 467:
 // The population itself, with the reasons recorded. // The population itself, with the reasons recorded.
 // --------------------------------------------------------------------------- // ---------------------------------------------------------------------------
 +// `usedOrMentioned == "compared"` is not always "did not run it". A paper that
 +// benchmarks its own detector against a prior tool normally RUNS that tool, and
 +// the extraction files that as `compared`, which drops it out of a "papers
 +// using this instrument" count. Deciding that in general needs a per-paper read,
 +// so it is NOT done in general: this map holds only the papers where a
 +// published audit has read the sentence and recorded the verdict, and it names
 +// the audit. Currently one entry, from the Foxhound role audit behind
 +// [[programming:crawler:foxhound]] (scripts/fh_fold.mjs ROLE, 2026-08-17), whose
 +// `baseline` role means "ran it as a comparison point".
 +//
 +// It adds to `tools` ONLY — not to `strictTools`, and so not to `reasons` and
 +// not to the page's population rule. A hand entry must not be able to pull a
 +// paper into the 206; this paper is already in it on its detection and
 +// classification signals.
 +export const TOOL_ROLE_OVERRIDE = new Map([
 +  [
 +    'NDSS/2025/do-not-follow-the-white-rabbit-challenging-the-myth-of-harmless-open-redirection',
 +    {
 +      tool: 'Foxhound',
 +      audit: 'programming:crawler:foxhound — fh_fold.mjs ROLE, role "baseline"',
 +      quote:
 +        'We considered the following state-of-the-art detectors as baselines: dynamic taint-tracking [24, 36, 45] using Foxhound [44, 45]',
 +      what: 'ran Foxhound as one of six baseline detectors over 42,288 pages',
 +    },
 +  ],
 +]);
 +
 export function jsSignals(p) { export function jsSignals(p) {
   const reasons = [];   const reasons = [];
Line 479: Line 506:
     const strict = foldJsToolStrict(t.name);     const strict = foldJsToolStrict(t.name);
     if (strict) strictTools.add(strict);     if (strict) strictTools.add(strict);
 +  }
 +  const override = TOOL_ROLE_OVERRIDE.get(paperKey(p));
 +  if (override) {
 +    // Fail loudly if the tuple the override is about has disappeared or has
 +    // been re-extracted as used/produced: a hand entry that fires on nothing is
 +    // a hand entry that hides a change in the data.
 +    const t = p.tools.find((x) => foldJsTool(x.name) === foldJsTool(override.tool));
 +    if (!t)
 +      throw new Error(
 +        `TOOL_ROLE_OVERRIDE for ${paperKey(p)} names ${override.tool}, which this paper's tools[] no longer contains`
 +      );
 +    if (t.usedOrMentioned === 'used' || t.usedOrMentioned === 'produced')
 +      throw new Error(
 +        `TOOL_ROLE_OVERRIDE for ${paperKey(p)} is now redundant: ${override.tool} is extracted as "${t.usedOrMentioned}". Remove the entry.`
 +      );
 +    tools.add(foldJsTool(override.tool));
   }   }
   if (strictTools.size) reasons.push('tool');   if (strictTools.size) reasons.push('tool');
Line 623: Line 666:
  
   * [[Privacy:Requests]] — classifying at the request/URL layer, where filter lists live, and why they cap this page's ground truth.   * [[Privacy:Requests]] — classifying at the request/URL layer, where filter lists live, and why they cap this page's ground truth.
 +  * [[Privacy:PII leakage]] — what scripts that read form fields and the DOM are found sending: session replay, pixels' advanced matching, configuration versus transmission.
   * [[Privacy:Cookies]] — what the scripts write; the provenance argument (a cookie set by a blocked resource) is the same idea one layer down.   * [[Privacy:Cookies]] — what the scripts write; the provenance argument (a cookie set by a blocked resource) is the same idea one layer down.
   * [[Privacy:Fingerprinting]] — 39.8% of browser-fingerprinting papers are really detecting //scripts//, so that page and this one share a method.   * [[Privacy:Fingerprinting]] — 39.8% of browser-fingerprinting papers are really detecting //scripts//, so that page and this one share a method.
Line 629: Line 673:
   * [[Design:Website classification]] — where script classification sits in the wider taxonomy.   * [[Design:Website classification]] — where script classification sits in the wider taxonomy.
   * [[Design:Crawling location]] — the vantage-point half of the "the site served you different code" problem.   * [[Design:Crawling location]] — the vantage-point half of the "the site served you different code" problem.
 +  * [[Security:Malicious web content]] — when the script is malicious: miners, exploit pages, skimmers and compromised third-party scripts, and why lists miss them.
   * [[Practices:Ethics]] — forced execution, deobfuscation and stealth crawling all override a site operator's expressed preferences.   * [[Practices:Ethics]] — forced execution, deobfuscation and stealth crawling all override a site operator's expressed preferences.
  
privacy/javascript.1788474845.txt.gz · Last modified: by karel.kubicek.claude