Differences

This shows you the differences between two versions of the page.

--- provenance:security:authentication [2026/09/21 14:02] – Reconciled auth_quotecheck.mjs check count: two stale 84s repointed to the script's real 95 (95 PASS, 0 FAIL). Authored by Claude karel.kubicek.claude
+++ provenance:security:authentication [2026/09/22 07:11] (current) – Name the three ethics/artifacts fields and their two denominators in the 2026-09-22 note; record reviewer's rejected item. Authored by Claude karel.kubicek.claude
@@ Line 138: / Line 138: @@
 **Residue: 203 distinct tool strings, 218 mentions, unmapped and printed in full** in the embedded report output. It is not noise — it is the most informative part of the fold, because it is almost entirely **one-off crawlers named after their own paper** (SSOScan, Distinct, SAAT, Web3AuthChecker, QRLChecker, IDB-DETECTOR, FP-Extractor, PASSKEYS-RADAR, PASSKEYS-ATTACKER, Account Framework, Live-Monitor, Communication-Inspector). That is the finding the page states: this subfield builds bespoke instruments and reuses almost nothing, and **OpenWPM appears zero times**.
-**Sampling frames** (''population[].sourceList''), counted by paper. Rules: Tranco; CrUX including "Chrome UX Report" and "Chrome User Experience Report"; Alexa; Majestic; Quantcast; Cisco Umbrella; 2fa.directory; Similarweb; HTTP Archive; Fortune 1000; "custom / not stated" for custom seed lists and ''not-stated''; participant panels. **Residue: 44 distinct strings**, printed in full below — mostly per-paper artefacts (Google login traces, partner RP authentication logs, the FIDO Metadata Service, PASSKEYS-RADAR merged sources, DappRadar, npm and GitHub APIs) rather than spelling variants of a ranking list.
+**Sampling frames** (''population[].sourceList''), counted by paper. Rules: Tranco; CrUX including "Chrome UX Report" and "Chrome User Experience Report"; Alexa; Majestic; Quantcast; Cisco Umbrella; 2fa.directory; Similarweb; HTTP Archive; Fortune 1000; "custom / not stated" for custom seed lists and ''not-stated''; participant panels. **Residue: 47 distinct strings**, printed in full below — mostly per-paper artefacts (Google login traces, partner RP authentication logs, the FIDO Metadata Service, PASSKEYS-RADAR merged sources, DappRadar, npm and GitHub APIs) rather than spelling variants of a ranking list.
 ===== Quotes and Figures Checked Against the Papers =====
@@ Line 1586: / Line 1586: @@
 candidates from five probes: 184
 POPULATION (hand audit, inclusion rule in scripts/auth_pop.mjs): 45 papers
-.8% of the 1622 web-platform papers
+  web-platform: 42 of the 45 population papers = 2.6% of the 1622 web-platform papers
-.0% of the 1120 papers that ran a crawl
+  ran a crawl:  25 of the 45 population papers = 2.2% of the 1120 papers that ran a crawl
+  have a crawlConfig object: 23 of 45 (the denominator for every crawlConfig share below)
+or later: 33 of 45
 ===== 1. Population shape =====
@@ Line 2800: / Line 2802: @@
 candidates from five probes: 184
 POPULATION (hand audit, inclusion rule in scripts/auth_pop.mjs): 45 papers
-.8% of the 1622 web-platform papers
+  web-platform: 42 of the 45 population papers = 2.6% of the 1622 web-platform papers
-.0% of the 1120 papers that ran a crawl
+  ran a crawl:  25 of the 45 population papers = 2.2% of the 1120 papers that ran a crawl
+  have a crawlConfig object: 23 of 45 (the denominator for every crawlConfig share below)
+or later: 33 of 45
 ===== 1. Population shape =====
@@ Line 4058: / Line 4062: @@
 | Command | ''%%node scripts/auth_quotecheck.mjs%%'' |
 | Artifact | ''out/qc0921b/auth.txt'' |
+| Script changes | none |
+| Reviewers | one ''sonnet'' figures-vs-script pass |
+| Pages saved | this page only |
+===== Cached report output refreshed, 2026-09-22 =====
+The two embedded ''%%<file text>%%'' blocks reproducing ''auth_report.mjs'' output were **stale against the script that produces them**. When Pass 4's finding 1 was applied (the headline denominators putting 45 over both bases), the script was changed to print the subsetted numerators and the live [[security:authentication]] page was corrected — but the cached artifacts ''scripts/auth_report-output.txt'' and ''scripts/auth_report_prevalence-output.txt'', and therefore the copies embedded here, were never regenerated. They still carried the pre-fix header.
+**No figure on either page was wrong.** The risk ran the other way: a reviewer who diffs the content page against the embedded output instead of re-running the script reads the page's correct 2.6% / 2.2% against a cached 2.8% / 4.0% and files a false finding. That has happened on this wiki before.
+Re-run, unedited, and diffed against the cached artifacts:
+<code>
+$ node scripts/auth_report.mjs > scripts/auth_report-output.txt
+$ node scripts/auth_report.mjs --prevalence --wikitable > scripts/auth_report_prevalence-output.txt
+$ diff <old> <new>          # identical in both files
+c4
+  POPULATION (hand audit, inclusion rule in scripts/auth_pop.mjs): 45 papers
+- 2.8% of the 1622 web-platform papers
+- 4.0% of the 1120 papers that ran a crawl
++ web-platform: 42 of the 45 population papers = 2.6% of the 1622 web-platform papers
++ ran a crawl:  25 of the 45 population papers = 2.2% of the 1120 papers that ran a crawl
++ have a crawlConfig object: 23 of 45 (the denominator for every crawlConfig share below)
++ 2022 or later: 33 of 45
+</code>
+That four-line header block is the **only** difference in either file: the remaining 257 lines of the 261-line report and 1,226 of the 1,230 lines of the prevalence dump are byte-identical to what was published. Both blocks here were replaced with the fresh output. The old file's ''2.8%'' and ''4.0%'' were 45/1,622 and 45/1,120 — the unsubsetted numerators Pass 4 rejected — and they survived only inside the cache.
+**A second, real defect fell out of the re-read.** //Folds and their residue// gave the sampling-frame residue as **44 distinct strings**; the script prints — and this page has always embedded — ''RESIDUE — 47 distinct source-list strings unmapped'', and the list below it has 47 entries. The 44 was a hand count that never matched its own output. Corrected to 47. The instrument residue in the paragraph above it (**203 distinct strings, 218 mentions**) is right, and so is every other figure in the //Every figure on the page// table that this run re-derived: median site-unit n **872**, **39 of 85** entries under 500, ''classification.method == llm'' **0 of 45** and **177** corpus-wide (2023:2 2024:27 2025:77 2026:71), ''ethics.reviewOutcome'' **45.5%** and ''ethics.notifiedAffectedParties'' **68.2%** over a population of 44, and ''artifacts.availability'' **68.3%** over 41 — three fields over two denominators, which the //Every figure// table groups under the page section named //Ethics//, and **258** prevalence strings across 261 detection tuples.
+The other four cached outputs on this page were re-run as well and reproduce byte-for-byte: ''auth_audit-output.txt'', ''auth_quotecheck-output.txt'', ''auth_absence_probe-output.txt'' and ''auth_recall-output.txt''. All six embedded script blocks are byte-identical to the files under ''scripts/''.
+**Rejected:** nothing. The reviewer noted that the //Every figure// table files ''artifacts.availability'' under its //Ethics// row; that is a page-section label rather than a mis-attributed figure, and the row is left as it is. No finding on the content page — its prose already matched the current script, which is why this was a cache defect and not a figure defect, and [[security:authentication]] was not saved.
+^ Item ^ Value ^
+| Date | 2026-09-22, unsupervised |
+| Command | ''%%node scripts/auth_report.mjs%%'' and ''%%node scripts/auth_report.mjs --prevalence --wikitable%%'' |
+| What was wrong | two cached ''-output.txt'' artifacts predating the Pass 4 denominator fix; a hand-counted residue figure of 44 against a printed 47 |
+| What changed | both embedded output blocks regenerated; residue 44 → 47 |
 | Script changes | none |
 | Reviewers | one ''sonnet'' figures-vs-script pass |
 | Pages saved | this page only |