| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| roadmap [2026/09/23 01:37] – Assessed row for Privacy:Advertising (written 2026-09-23; gap-pass count 118 -> 127, 33.1% precision, 59.2% recall, population 71); settle the Sock-puppet and personalization audits row. Authored by Claude. karel.kubicek.claude | roadmap [2026/10/08 12:19] (current) – Assessed row: privacy:pii_leakage written. Authored by Claude. karel.kubicek.claude |
|---|
| |
| ^ Proposal ^ Disposition ^ | ^ Proposal ^ Disposition ^ |
| | | PII leakage to third parties | **Written 2026-10-08** as [[privacy:pii_leakage|Privacy:PII leakage]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **218** (≥ 5 hits of the ''pii_leakage'' family of ''gap_probe_fulltext_20260922.mjs'' in ''paper.norm.txt''; 76 web, 96 from 2024–2026), flagged there as noisy. The count re-runs exactly; the noise is as described and larger. Over whitespace-collapsed ''paper.cols.txt'' the regex gives **226**, of which **13** are in the page's population — **5.8%** precision, **65.0%** recall; 4 of its top 20 are language-model PII papers, and its largest classes are mobile apps (61), attacks (27), user studies (24) and language models (20). The page's population is **20** papers from a hand audit of **314** candidates from three probes (**6.4%** precision), against an inclusion rule written before the first count; a second reader re-adjudicated 97 exclusions (two moved in) and a full-text reading of every included paper moved three to context. The boundary the row asked about is settled: **5** of the 20 are cited on [[Privacy:Email tracking]], which keeps the address as an identifier; this page owns personal-data leakage in general. Four of the five spine candidates are in the population; //Investigating sources of PII used in Facebook's targeted advertising// (PETS 2019) is context — what a platform does with PII it already holds. No paper in the population is a health-sector study: that literature is in medical journals and workshops outside the seven venues, and the page cites it as such. | |
| | | Super-app mini-programs (WeChat, Alipay, Douyin, QQ, Baidu) | **Written 2026-09-27** as [[design:mobile_and_app_measurement:mini_programs|Design:Mobile and app measurement:Mini programs]], the first child of [[Design:Mobile and app measurement]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **37** papers (21 from 2024–2026) with at least ten full-text hits of "mini-program" or "WeChat". The count re-runs exactly. The page's population is **16** papers that measure mini-programs or their host framework — 13 as the main object — hand-verdicted from a **57**-paper candidate set. The gap rule contains **15** of them: **40.5%** precision, **93.8%** recall; 19 of its 22 false hits use no mini-program vocabulary at all (WeChat as a messenger, payment method, login target or dataset owner). The ecosystem's own vocabulary (mini-program, mini-app, super app, app-in-app) at ≥ 3 hits finds all 16 at 53.3% precision. The first paper is from 2020, and 10 of 16 are from 2024–2026. | |
| | | Messaging groups and channels (Telegram, WhatsApp, Discord) | **Written 2026-09-27** as [[design:platforms:messaging_channels|Design:Platforms:Messaging channels]], the second child of [[Design:Platforms]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on full-text candidate counts of **40 / 41 / 13** papers naming Telegram / WhatsApp / Discord at least ten times (case-sensitive; 23 / 18 / 8 of them from 2024–2026). The counts re-run exactly. The page's population is **26** papers that collect data from inside groups, channels or servers — 9 as their main dataset — hand-verdicted from a **147**-paper candidate set. The gap rule's union of **76** papers contains **23** of them: **30.3%** precision, **88.5%** recall. WhatsApp's count is the weakest, **4 of 41**, because a paper naming WhatsApp ten times is usually about its encryption, its users or its traffic; 21 of the 26 are Telegram papers and none predates 2019. Account enumeration through contact discovery (4 papers) became a pointer section on the page, not a second page. | |
| | | Domain abuse (squatting, parking, expired domains, dangling DNS) | **Written 2026-09-25** as [[security:domain_abuse|Security:Domain abuse]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **85** (≥ 5 hits of the ''domain_abuse'' family of ''gap_probe_fulltext_20260922.mjs'' in ''paper.norm.txt''; 47 web, 25 from 2024–2026). The count re-runs exactly. The page's population is **48** papers — 40 about the namespace, 8 measuring it in one section — hand-verdicted from a **149**-paper union of six probes against a rule with four families (lookalike, parking, residual, dangling). The gap regex finds **38** of the 48 (**79.2%** recall, **42.2%** precision over whitespace-collapsed ''paper.cols.txt'') and misses the name-collision and delegation-hijack papers, which never say //typosquat// or //dangling DNS//. Of its 27 hits from 2024–2026, **11** are in the population; the rest are passing mentions and squatting in other namespaces (packages, containers, social handles, blockchain names), which the page records as context. The recent slope is real but belongs to the residual and dangling families: the population has **no** primary typosquatting paper from 2022–2024. Three on-topic papers were selected for the corpus but never retrieved (empty full-text directories) and are cited, not counted. The page flags an open question for [[practices:ethics]]: 19 of the 48 papers registered or took control of names to measure the traffic they receive, and that page does not cover it. Audit, all 149 verdicts, the hand codes and the dated primary sources: [[provenance:security:domain_abuse]]. | |
| | | Online scams | **Written 2026-09-24** as [[security:online_scams|Security:Online scams]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **43** (≥ 5 hits of the ''scams'' family of ''gap_probe_fulltext_20260922.mjs'' in ''paper.norm.txt''; 27 web, 21 from 2024–2026), described there as the steepest recent slope in the pass. The count re-runs exactly; the slope does not survive reading. The page's population is **27** papers, hand-verdicted from a **183**-paper union of five probes. The gap regex finds **18** of the 27 (**66.7%** recall, **40.0%** precision over whitespace-collapsed ''paper.cols.txt'') and misses all nine from 2010–2014, which say //pharmacy//, //counterfeit//, //affiliate program// or //one-click fraud//. Of its 23 hits from 2024–2026 only **7** are scam-website measurement — the rest are platform, on-chain, user-study, telephony and LLM-conversation papers — and the population holds at three to seven papers per year bucket. The ''seo_spam'' family was read: search poisoning enters only when its destinations are scams or fraudulent storefronts; 12 generic search-abuse papers are recorded as context. The line with [[security:phishing]] is what the victim hands over. | |
| | | Malicious web content (cryptojacking, exploit kits, malvertising, skimmers) | **Written 2026-10-08** as [[security:malicious_web_content|Security:Malicious web content]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **124** (≥ 5 hits of the ''malicious_web_content'' family of ''gap_probe_fulltext_20260922.mjs'' in ''paper.norm.txt''; 87 web, 70 crawled, 20 from 2024–2026). The count re-runs exactly. The page's population is **39** papers — 36 about the topic, 3 measuring it in one section — hand-verdicted from a **261**-paper union of seven probes, the last a title-and-abstract probe over the whole venue index. The gap regex finds **36** of the 39 (**92.3%** recall, **26.1%** precision over whitespace-collapsed ''paper.cols.txt''). **None of its 20 hits from 2024–2026 is in the population**, and none of the 47 candidates from those years is: the last paper is from 2023, exploit-kit papers end in 2015 and mining papers in 2021. The page checked whether that is the field or the corpus — wider vocabularies over every 2024–2026 paper (0 found), the screening funnel (three on-topic 2025 defence papers were screened out; none is a census), and venues outside the seven — and records the answer: exploit kits and in-browser mining ended as mass phenomena, while malvertising, skimming, compromised-site injects and third-party script compromise continued in government and vendor reports and went unmeasured here. Web skimming has **no** paper in these venues; the three //skimmer// papers are gas-pump hardware. Audit, all 261 verdicts, the hand codes and the dated primary sources: [[provenance:security:malicious_web_content]]. | |
| | Ad targeting and bidding | **Written 2026-09-23** as [[privacy:advertising|Privacy:Advertising]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **118** (≥ 5 hits of the ''ad_targeting_rtb'' family of ''gap_probe_fulltext_20260922.mjs'' in ''paper.norm.txt''). Writing it moved that count three ways. The same regex over whitespace-collapsed ''paper.cols.txt'' gives **127**, of which **42** are in the page's population — **33.1%** precision — and it finds only **42 of the 71** population papers (**59.2%** recall): 22 of its 29 misses ask what served ads //contain// (malvertising, political and children's ads, archives) and never say "targeted ad" often enough, and the rest include the two founding persona papers. The population is **71** papers from a hand audit of **291** candidates from three probes (**24.4%** precision), against an inclusion rule written before the first count. The row's "about a third of the top hits are user-perception studies" held for the top 30 — **10** recruited participants — but **4** of those 10 also measured ads and are in the population; across all 127, **23** are pure perception studies, kept as context and not counted. The gap pass's 41 candidates from 2024–2026 compare with **20** population papers from those years. A title probe over the venue index finds **18** further ad measurements that never reached the extraction — at least a fifth of the total — mostly TheWebConf papers screened out and NDSS 2016/2018 papers in venue-years with no screening labels. Audit, all 291 verdicts, the needle checks and the dated primary sources: [[provenance:privacy:advertising]]. | | | Ad targeting and bidding | **Written 2026-09-23** as [[privacy:advertising|Privacy:Advertising]]. Never queued: chosen by Karel in the 2026-09-22 gap pass on a full-text candidate count of **118** (≥ 5 hits of the ''ad_targeting_rtb'' family of ''gap_probe_fulltext_20260922.mjs'' in ''paper.norm.txt''). Writing it moved that count three ways. The same regex over whitespace-collapsed ''paper.cols.txt'' gives **127**, of which **42** are in the page's population — **33.1%** precision — and it finds only **42 of the 71** population papers (**59.2%** recall): 22 of its 29 misses ask what served ads //contain// (malvertising, political and children's ads, archives) and never say "targeted ad" often enough, and the rest include the two founding persona papers. The population is **71** papers from a hand audit of **291** candidates from three probes (**24.4%** precision), against an inclusion rule written before the first count. The row's "about a third of the top hits are user-perception studies" held for the top 30 — **10** recruited participants — but **4** of those 10 also measured ads and are in the population; across all 127, **23** are pure perception studies, kept as context and not counted. The gap pass's 41 candidates from 2024–2026 compare with **20** population papers from those years. A title probe over the venue index finds **18** further ad measurements that never reached the extraction — at least a fifth of the total — mostly TheWebConf papers screened out and NDSS 2016/2018 papers in venue-years with no screening labels. Audit, all 291 verdicts, the needle checks and the dated primary sources: [[provenance:privacy:advertising]]. | |
| | Data subject rights | **Written 2026-09-16** as [[privacy:data_subject_rights|Privacy:Data subject rights]]. Every number in the queued row was wrong in the same direction. The **9** title-and-summary candidates all survive — 100% precision, the only queued probe on this wiki to manage that — but the recall is **17.6%**: the page's population is **51** papers and the title probe misses **42** of them, including every paper that obtained its research data through the right of access, both people-search removal studies, and the largest opt-out-signal paper before 2024. On this topic the rights work is usually one section of a paper whose title says nothing about rights. The "6 of them 2024–2026" understates the slope rather than overstating it: **43 of the 51** are 2021 or later. The population is a hand audit of **471** full-text candidates (**10.8%** precision) against a written inclusion rule; nine tenths of the noise is structured, and the largest single class is an internet-scanning paper's ethics section offering an //"opt-out request"// for its own probes. Two probes were added mid-run, after the first complete audit could not see //Do Opt-Outs Really Opt Me Out?// (CCS 2022) — a paper the page is partly about — because industry opt-out tools are never called "do not sell"; they added 182 candidates and 10 population papers. The scope held in one important respect and moved in another: the request-as-instrument framing is the page's spine, and the **median number of controllers a request-sending paper wrote to is 30**, against a crawl median of 10,000 sites. Probe history, all 471 verdicts, the fold residue and eight dated primary sources: [[provenance:privacy:data_subject_rights]]. | | | Data subject rights | **Written 2026-09-16** as [[privacy:data_subject_rights|Privacy:Data subject rights]]. Every number in the queued row was wrong in the same direction. The **9** title-and-summary candidates all survive — 100% precision, the only queued probe on this wiki to manage that — but the recall is **17.6%**: the page's population is **51** papers and the title probe misses **42** of them, including every paper that obtained its research data through the right of access, both people-search removal studies, and the largest opt-out-signal paper before 2024. On this topic the rights work is usually one section of a paper whose title says nothing about rights. The "6 of them 2024–2026" understates the slope rather than overstating it: **43 of the 51** are 2021 or later. The population is a hand audit of **471** full-text candidates (**10.8%** precision) against a written inclusion rule; nine tenths of the noise is structured, and the largest single class is an internet-scanning paper's ethics section offering an //"opt-out request"// for its own probes. Two probes were added mid-run, after the first complete audit could not see //Do Opt-Outs Really Opt Me Out?// (CCS 2022) — a paper the page is partly about — because industry opt-out tools are never called "do not sell"; they added 182 candidates and 10 population papers. The scope held in one important respect and moved in another: the request-as-instrument framing is the page's spine, and the **median number of controllers a request-sending paper wrote to is 30**, against a crawl median of 10,000 sites. Probe history, all 471 verdicts, the fold residue and eight dated primary sources: [[provenance:privacy:data_subject_rights]]. | |
