Measure The Web

User Tools

Site Tools

Trace: • tracker_radar_collector • tls_certificates • study_preregistration • email_authentication • blocking_and_geodifference • notifying_websites • browser_extensions • server_side_tracking
provenance:security:email_authentication

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
provenance:security:email_authentication [2026/09/09 11:50] – Add section 12f (the figures pass re-run after its findings were applied, five more findings, one rejected as stale) and refresh the embedded script and output. Authored by Claude karel.kubicek.claudeprovenance:security:email_authentication [2026/09/17 07:24] (current) – Markup rendering sweep: wrap escapes, CLI flag typography, and heading quotes. Authored by Claude. karel.kubicek.claude
Line 137: Line 137:
 Two free-text fields were folded. Both residues are printed by the script and are reproduced here, because a residue that exists only in a local script output is a residue nobody will ever look at. Two free-text fields were folded. Both residues are printed by the script and are reproduced here, because a residue that exists only in a local script output is a residue nobody will ever look at.
  
-==== 6a. ''population[].sourceList'' → sampling frame ====+==== 6a. population[].sourceList → sampling frame ====
  
 Rule (report section D): Rule (report section D):
Line 161: Line 161:
 One is a **pointer rather than a source** and would be wrong to fold into anything: ''"based on [56]"'', ''"previous work [44]"'' and ''"prior research [40]"'' (all ''USENIX/2025/email-spoofing-with-smtp-smuggling''). The extractor recorded the citation instead of the list. That is an extraction limitation, not a study one. One is a **pointer rather than a source** and would be wrong to fold into anything: ''"based on [56]"'', ''"previous work [44]"'' and ''"prior research [40]"'' (all ''USENIX/2025/email-spoofing-with-smtp-smuggling''). The extractor recorded the citation instead of the list. That is an extraction limitation, not a study one.
  
-==== 6b. ''tools[].name'' (''usedOrMentioned === "used"'') → tool family ====+==== 6b. tools[].name (usedOrMentioned === "used") → tool family ====
  
 Denominator: the 26 of the 31 papers that name at least one tool as used. The fold merges implementations of the same thing (''libspf2''/''pyspf''/''Mail::SPF''/''policyd-spf''/''spfmilter''/''python-postfix-policyd-spf'' → "an SPF validator library"; ''GnuPG''/''gpg''/''GPGME''/''Enigmail''/''GPG Suite''/''OpenKeychain''/''OpenPGP.js'' → "a PGP implementation"). The unmapped residue is large — roughly a hundred distinct strings across the 31 papers — and is printed in full in report section I. It is dominated by single-use infrastructure (''QEMU'', ''GNU Parallel'', ''mitmproxy'', ''Qualtrics'', ''jc'', ''hashcat'', ''Google Translate'') and by named commercial services (''Netstar URL Categorization'', ''Coremail spam filter'', ''GoDaddy Domains API'', ''HaveIBeenPwned''). Denominator: the 26 of the 31 papers that name at least one tool as used. The fold merges implementations of the same thing (''libspf2''/''pyspf''/''Mail::SPF''/''policyd-spf''/''spfmilter''/''python-postfix-policyd-spf'' → "an SPF validator library"; ''GnuPG''/''gpg''/''GPGME''/''Enigmail''/''GPG Suite''/''OpenKeychain''/''OpenPGP.js'' → "a PGP implementation"). The unmapped residue is large — roughly a hundred distinct strings across the 31 papers — and is printed in full in report section I. It is dominated by single-use infrastructure (''QEMU'', ''GNU Parallel'', ''mitmproxy'', ''Qualtrics'', ''jc'', ''hashcat'', ''Google Translate'') and by named commercial services (''Netstar URL Categorization'', ''Coremail spam filter'', ''GoDaddy Domains API'', ''HaveIBeenPwned'').
Line 2309: Line 2309:
 Four reviewers, all told explicitly that the main run's context may not be exhaustive, and all handed the page text, the report script, its output and these notes. The three focused passes ran in parallel first; the generic pass ran after their findings were applied. Four reviewers, all told explicitly that the main run's context may not be exhaustive, and all handed the page text, the report script, its output and these notes. The three focused passes ran in parallel first; the generic pass ran after their findings were applied.
  
-==== 12a. Figures against the script (''sonnet'') ====+==== 12a. Figures against the script (sonnet) ====
  
 Brief: re-run the script, diff against the committed output, check every number on the page against it, look for figures whose stated population differs from the one the script computes, and **mutate the script** rather than reading it. Verdict on the re-run: **byte-identical to the committed output, no diff.** Brief: re-run the script, diff against the committed output, check every number on the page against it, look for figures whose stated population differs from the one the script computes, and **mutate the script** rather than reading it. Verdict on the re-run: **byte-identical to the committed output, no diff.**
Line 2326: Line 2326:
 Nothing else in the denominators table, the mechanism table, the instrument fold, the sampling-frame fold, the period breakdowns, the venue counts, the artifact counts or the quote-location split was found to differ from the script. Nothing else in the denominators table, the mechanism table, the instrument fold, the sampling-frame fold, the period breakdowns, the venue counts, the artifact counts or the quote-location split was found to differ from the script.
  
-==== 12b. Citations and quotes (''sonnet'') ====+==== 12b. Citations and quotes (sonnet) ====
  
 Brief: every ''%%{[key]}%%'' resolves, no duplicates or same-paper collisions, every new BibTeX entry checked **against the PDF cover page** rather than the venue listing, every quoted string verbatim, ten named load-bearing claims checked against the paper, and the web claims held to a primary source. Brief: every ''%%{[key]}%%'' resolves, no duplicates or same-paper collisions, every new BibTeX entry checked **against the PDF cover page** rather than the venue listing, every quoted string verbatim, ten named load-bearing claims checked against the paper, and the web claims held to a primary source.
Line 2340: Line 2340:
 Confirmed with no change: all 37 page citekeys resolve in the 885-entry bibliography; ''bib_dedup_scan.py'' finds no definite duplicate pair including the new entries; 24 of the 25 entries then present have author lists matching the PDF cover page position by position, including the four flagged for diacritics and splicing; the RFC 9989 quotations, the Google November-2025 quotation and the libspf2 commit message are verbatim; nine of the ten named load-bearing claims are correct against the paper and its stated population, the tenth being finding 3. Confirmed with no change: all 37 page citekeys resolve in the 885-entry bibliography; ''bib_dedup_scan.py'' finds no definite duplicate pair including the new entries; 24 of the 25 entries then present have author lists matching the PDF cover page position by position, including the four flagged for diacritics and splicing; the RFC 9989 quotations, the Google November-2025 quotation and the libspf2 commit message are verbatim; nine of the ten named load-bearing claims are correct against the paper and its stated population, the tenth being finding 3.
  
-==== 12c. External currency (''sonnet'', fan-out) ====+==== 12c. External currency (sonnet, fan-out) ====
  
 Brief: fetch, do not recall; check every standard, every mandate, every tool row, every link, every sampling frame and every external statistic as of 2026-09-09; and try to falsify the page's "nobody has measured this" claims. This pass fanned out into six parallel checks. Brief: fetch, do not recall; check every standard, every mandate, every tool row, every link, every sampling frame and every external statistic as of 2026-09-09; and try to falsify the page's "nobody has measured this" claims. This pass fanned out into six parallel checks.
Line 2355: Line 2355:
 | 9 | SIDN Labs and Forum Standaardisatie figures verified exactly, including the 26.57% → 37.24% jump and the absence of any explanation on the site | **Confirmed**, no change | | 9 | SIDN Labs and Forum Standaardisatie figures verified exactly, including the 26.57% → 37.24% jump and the absence of any explanation on the site | **Confirmed**, no change |
  
-==== 12d. Generic (''fable'') ====+==== 12d. Generic (fable) ====
  
 Brief: no checklist. Whatever the three focused passes were not looking for — overstatement, structure, whether the page answers its own question, and the provenance page itself. Brief: no checklist. Whatever the three focused passes were not looking for — overstatement, structure, whether the page answers its own question, and the provenance page itself.
Line 2378: Line 2378:
 | 17 | Ethics figures repeated in three places; the instrument table appears twice | **Partly accepted.** The duplication of the instrument table is deliberate (narrative first, period split in the query section) and the second now says so. The ethics repetition was left: the //Ethics// section and //Where these papers go quiet// serve different readers, and the numbers agree | | 17 | Ethics figures repeated in three places; the instrument table appears twice | **Partly accepted.** The duplication of the instrument table is deliberate (narrative first, period split in the query section) and the second now says so. The ethics repetition was left: the //Ethics// section and //Where these papers go quiet// serve different readers, and the numbers agree |
  
-==== 12f. Figures, re-run after the fixes (''sonnet'') ====+==== 12f. Figures, re-run after the fixes (sonnet) ====
  
 The figures pass was re-run because its findings had been acted on and the script had grown by about 100 lines since. Its own opening note is the useful part: **the files changed under it mid-review**, twice, and it re-fetched and re-ran rather than reporting against a stale snapshot. That is a hazard this run created by editing a live page while four reviewers read it, and the next run should either freeze the files or say plainly that they are moving. The figures pass was re-run because its findings had been acted on and the script had grown by about 100 lines since. Its own opening note is the useful part: **the files changed under it mid-review**, twice, and it re-fetched and re-ran rather than reporting against a stale snapshot. That is a hazard this run created by editing a live page while four reviewers read it, and the next run should either freeze the files or say plainly that they are moving.
Line 2402: Line 2402:
  
 <bibtex bibliography></bibtex> <bibtex bibliography></bibtex>
 +
 +===== Markup sweep, 2026-09-17 =====
 +
 +Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.
  
provenance/security/email_authentication.1788954641.txt.gz · Last modified: by karel.kubicek.claude