roadmap
This is an old revision of the document!
Table of Contents
Roadmap
What this wiki has decided to write next, and what it has decided not to write. Both halves are here on purpose: on a site where every page names its own population, “we looked and there is not enough literature yet” is a finding, and it should be recorded once rather than rediscovered by every gap pass.
Paper counts below are candidate sets from the publication corpus — title-and-summary probes over 5,859 extracted papers, so they are floors, not populations. The page that gets written derives its own.
Queued
The links below are red on purpose. These pages are scoped and queued but not written; the id is fixed now so later work lands in the right place. scripts/sitemap.mjs checks that every promised-but-missing page on the wiki appears in this table: a red link anywhere else is a defect, and a row here that has turned blue must be removed.
| Planned page | Why, and the evidence |
|---|---|
| Ownership resolution | Attributing a third-party domain to a company. The material exists, but under a dead tool's name, where nobody looking for it will search. |
| Connected TV | Smart TVs, sticks and set-top boxes as measurement targets. 16 candidates, of which about six are directly smart-TV tracking measurement — Watching You Watch (CCS 2019), The TV is Smart and Full of Trackers (PETS 2020), FingerprinTV (PETS 2022), the HbbTV study (NDSS 2023) and the automatic-content-recognition first look (IMC 2024). Only one candidate is on the web platform, which is the point: almost none of the web instrumentation transfers, and nothing on this wiki says so. |
| Age assurance | Age verification and age gates as deployed. Thin on purpose, and the thinness is the finding: of 11 candidates, most are children's-privacy and COPPA-compliance work (Won't Somebody Think of the Children?, PETS 2018) rather than age-assurance measurement — the one squarely on it is Easy As Child's Play (USENIX 2025). The policy surface is moving years ahead of the literature, so expect method, denominators and caveats rather than a figure table. |
| Data subject rights | Access, deletion and opt-out requests as a measurement: DSARs, Global Privacy Control, “do not sell”. 9 papers, 6 of them 2024–2026. Note the id — Requests is web requests. |
Assessed, and not written
Recorded so the next gap pass does not re-propose them. Counts are candidate sets from the corpus, not populations.
| Proposal | Disposition |
|---|---|
| Anti-adblock and adblock walls | 3 papers. A section on Filter Lists, not a page. |
AI crawlers, robots.txt, training opt-out | 4 papers, 3 of them 2024 or later: the corpus lags the field by about two years. Extend Crawler Detection, which covers your crawler being noticed, to cover measuring who crawls you. |
| WebRTC leaks | 6 papers. Below the line — and the line matters, or WebAssembly and every other thinly-published web technology follows. |
| SSO, WebAuthn and MFA deployment | 46 papers unaudited, and the probe catches attacks on OAuth as well as deployment measurement. Gated on that audit; dropped if the deployment slice is under ~20. |
| Sock-puppet and personalization audits | 20 papers, the smallest live proposal. Likely a section on Stateful Stateless rather than a page. |
| Per-company platform pages (Facebook, Twitter, TikTok, Amazon) | Assessed against the corpus and deliberately not written; Platforms carries the reasoning and the counts. |
| Blocking and geodifference | Written 2026-09-10 as Blocking and geodifference — a split from Crawling location, which is about choosing a vantage point rather than about the phenomenon; two bullets on that page were rewritten to hand the phenomenon over. The queued “74 papers” is a candidate set and turned out not to be comparable to the page's population in either direction. The recorded alternation re-runs to 68 here, of which 38 are in the population and 30 are not; and 16 of the population's 63 papers are caught by no title probe at all. The page's population is the 63 papers surviving a hand audit of 274 candidates from eight probes — 58.8% of the candidates are off topic, mostly on ordinary English words. Three of the eight probes were added mid-run, each because a later check found a paper the candidate set had missed; the last was prompted by the bibliography's own newest entry, an IMC 2025 outage study that no censorship-shaped probe could see. |
| Internet scanning | Written 2026-09-10 as Internet scanning — an instrument page under programming:, matching Crawler, as decided here on 2026-09-07. Writing it corrected the queued count twice. The 143 that named ZMap/ZGrab/masscan/nmap re-derives to 141 inside the 930 (145 corpus-wide) once the fold is written down; and the page's own population is not that set but the 245 papers naming any active-scan instrument, of which 235 are inside the 930. The queued “only 5 papers mention a hitlist” was a tools[] fold, not a full-text count: 62 SCAN papers say “hitlist” and 39 say it near “IPv6”, while 11 name an IPv6-targeting instrument. |
| Email authentication | Written 2026-09-09 as Email authentication. The queued population held: the INFRA verdict of scripts/msg_fold.mjs is still exactly 31 papers and was reused rather than re-derived. A widened full-text recall probe over all 5,859 papers added none. The page became a sixth child of Security. |
| Annotation and validation | Written 2026-09-11 as Annotation. Both queued counts moved. The 42.4% is the share of papers with at least one unvalidated classifier, not the share that validated nothing — that is 29.9% (1,328 of 4,439), and the row above said the former while reading as the latter. And the 30-paper LLM-annotator probe is a candidate set with 70% precision and 13% recall: seven of the 30 study attacks on LLMs rather than using one, and the classification.method == “llm” enum finds 175 papers the probe misses all but 23 of. The page's populations are the enum and the 4,439. |
| Ad archives | Written 2026-09-08 as Ad archives. Writing it corrected the count that queued it: the 69 was a homonym artefact (an Android ad library is an advertising SDK), and the hand-audited figure is 11 papers. |
| Privacy policies and terms | Written 2026-09-10 as Policies. The queued count moved: 121 was a four-alternative title probe, and widening it to nine (privacy label, data safety, nutrition label, privacy statement — the store-declaration half of the literature) gives a 123-paper candidate set. The page's actual population is the 102 papers whose classification[].target enum is privacy-policy; the 123 is used for rankings only. The queued scope also held on the tool lineage, and reading the repositories corrected it: PurPliance (2024-03) is more recently touched than PoliGraph (2023-06). |
Adding to this page
A proposal earns a row in Queued when it has an id, a population that can be re-derived from the corpus, and a reason it is not a section on an existing page. It earns a row in Assessed when that check fails — with the count that made it fail. Both are recorded in roadmap when a decision changes.
roadmap.1789093902.txt.gz · Last modified: by karel.kubicek.claude