bunkhouse/bigtech-sucks
7
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
bigtech-sucks/packages/web/public/oath.json

10 lines
268 B
JSON
Raw Normal View History

feat: self-authoring ingest, relevance gate, and the Ranch Oath The roster writes itself. The scores do not. - db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by stars (usage); Flathub is a curated store of end-user Linux apps, so relevance is free there and has to be earned on GitHub. - db/ingest/run.mjs: discovers into the roster as unassessed products, never as scores. Every discovery leaves a receipt (source, url, usage metric, timestamp) so a reader can see where a product came from and why it ranks. - LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top because brokers are highly starred and are not things people install. - build.mjs no longer wipes the database. The DB authors itself, so a rebuild would have thrown the roster away. --fresh is now explicit. - v_backlog view: what to assess next, ordered by measured usage. - packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest, bound to a SHA-256 of catalog.json. The page recomputes the digest in the browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration. Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
feat: the closed-source ladder, and why self-attestation is a declaration Christian: 'The goal is not to hamstring closed source developers. It's just to validate clean code.' Right. So the cap is a rung, not a wall, and it now says so. L0 unattested -> 3 nothing but your word L1 declared -> 5 SBOM + signed hash + published destination allowlist L2 observed -> 7 someone other than you watched this exact binary L3 reproducible -> 9 anyone can rebuild it and get the same bytes L4 contested -> 10 someone tried to break it and published the attempt A court filing lifts the ceiling entirely, because it needs no vendor cooperation. db/attest/validate.mjs computes the level from which artifacts exist. A vendor cannot claim one. The load-bearing rule is the attestor column: a vendor running our harness produces a DECLARATION, not an OBSERVATION. Verified against three cases. A vendor claiming L2 with their own capture report is downgraded to L1 and fails validation. The same artifacts with us as attestor grant L2. A broken rebuild claim never reaches L3. Levels 3 and 4 survive a self-run on purpose: a public rebuild recipe and a published adversarial review can be re-executed or re-read by anyone, so who pressed the button stops mattering. Honest limit, written into the module: this cannot prove the absence of a backdoor. Rice's theorem makes that undecidable, and a backdoor triggered by remote config or message content is invisible to static inspection. An attestation raises the cost and shortens the shelf life. It is not a proof.
2026-10-29 16:07:55 -05:00
"digest": "0dc5a4129eef262900a70dbdc743d99aa7fb50bbd778cf7ab58ebbbe4ac2308a",
feat: self-authoring ingest, relevance gate, and the Ranch Oath The roster writes itself. The scores do not. - db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by stars (usage); Flathub is a curated store of end-user Linux apps, so relevance is free there and has to be earned on GitHub. - db/ingest/run.mjs: discovers into the roster as unassessed products, never as scores. Every discovery leaves a receipt (source, url, usage metric, timestamp) so a reader can see where a product came from and why it ranks. - LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top because brokers are highly starred and are not things people install. - build.mjs no longer wipes the database. The DB authors itself, so a rebuild would have thrown the roster away. --fresh is now explicit. - v_backlog view: what to assess next, ordered by measured usage. - packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest, bound to a SHA-256 of catalog.json. The page recomputes the digest in the browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration. Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"algorithm": "sha256",
"file": "catalog.json",
feat: the Signal rumor ledger, and the half point it earned Christian: 'If we can give it a higher rating or if we can dispel rumors, then we need to make that part of our first post.' Discipline first: debunking a rumor must not buy score, or the instrument becomes a PR department with a database attached. What the rumors actually did was correct one under-informed dimension. - incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented phishing campaign. FBI/CISA PSA260626 says plainly that the app and its encryption were not compromised, Signal published a precise correction within days and shipped linkage confirmations by 2026-05-13. Fast, accurate, independently corroborated. - Total 75.9 -> 76.4. Half a point. That is the correct size. - Everything else was already priced in: the OTF funding was already docked under ownership, the phone number already docked under user control. Evidence rows added for the FBI advisory, Signal's statement, the itemised ,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments. The recompute gate verified 76.4 from the weights and scores, not from trust.
2026-10-29 15:30:00 -05:00
"byte_length": 82952,
feat: the closed-source ladder, and why self-attestation is a declaration Christian: 'The goal is not to hamstring closed source developers. It's just to validate clean code.' Right. So the cap is a rung, not a wall, and it now says so. L0 unattested -> 3 nothing but your word L1 declared -> 5 SBOM + signed hash + published destination allowlist L2 observed -> 7 someone other than you watched this exact binary L3 reproducible -> 9 anyone can rebuild it and get the same bytes L4 contested -> 10 someone tried to break it and published the attempt A court filing lifts the ceiling entirely, because it needs no vendor cooperation. db/attest/validate.mjs computes the level from which artifacts exist. A vendor cannot claim one. The load-bearing rule is the attestor column: a vendor running our harness produces a DECLARATION, not an OBSERVATION. Verified against three cases. A vendor claiming L2 with their own capture report is downgraded to L1 and fails validation. The same artifacts with us as attestor grant L2. A broken rebuild claim never reaches L3. Levels 3 and 4 survive a self-run on purpose: a public rebuild recipe and a published adversarial review can be re-executed or re-read by anyone, so who pressed the button stops mattering. Honest limit, written into the module: this cannot prove the absence of a backdoor. Rice's theorem makes that undecidable, and a backdoor triggered by remote config or message content is invisible to static inspection. An attestation raises the cost and shortens the shelf life. It is not a proof.
2026-10-29 16:07:55 -05:00
"rebuilt_at": "2026-10-29T21:07:55.485Z",
feat: self-authoring ingest, relevance gate, and the Ranch Oath The roster writes itself. The scores do not. - db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by stars (usage); Flathub is a curated store of end-user Linux apps, so relevance is free there and has to be earned on GitHub. - db/ingest/run.mjs: discovers into the roster as unassessed products, never as scores. Every discovery leaves a receipt (source, url, usage metric, timestamp) so a reader can see where a product came from and why it ranks. - LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top because brokers are highly starred and are not things people install. - build.mjs no longer wipes the database. The DB authors itself, so a rebuild would have thrown the roster away. --fresh is now explicit. - v_backlog view: what to assess next, ordered by measured usage. - packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest, bound to a SHA-256 of catalog.json. The page recomputes the digest in the browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration. Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"method_version": "btr-0.1",
feat: the closed-source rule, and the board Christian, 2026-10-29: 'Closed source software, you have no idea. And then all we have is reputation. So you kind of start with one arm or two arms tied behind your back.' That is now arithmetic instead of an opinion. - assessment.source_available: 1 = we can read the code, 0 = we cannot. - Closed source cannot exceed 5 on ANY dimension without tier-1 or tier-2 evidence of kind 'capture' or 'filing'. Reputation is tier 3, and tier 3 is not a measurement. The build fails if a closed-source score breaks the rule. - Verifiability still caps at 3 with no reproducible build. Practical ceiling for closed source: 86/100 in theory, if every dimension is backed by a capture or a court filing. In practice it is a fight for a C. - product.priority puts a human's ask ahead of a crawler's discovery. - v_backlog orders by priority, then measured usage. - migrate(): the database authors itself, so it must survive its own schema changes. Add columns, drop views, let schema.sql recreate them. Never drop and rebuild, which would destroy the self-authored roster. On the board: Slack (closed, capped) and Kino (closed, capped, founders call 2026-10-30 17:00). Neither is scored. Neither gets a number until it has evidence.
2026-10-29 15:23:31 -05:00
"products": 123,
feat: self-authoring ingest, relevance gate, and the Ranch Oath The roster writes itself. The scores do not. - db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by stars (usage); Flathub is a curated store of end-user Linux apps, so relevance is free there and has to be earned on GitHub. - db/ingest/run.mjs: discovers into the roster as unassessed products, never as scores. Every discovery leaves a receipt (source, url, usage metric, timestamp) so a reader can see where a product came from and why it ranks. - LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top because brokers are highly starred and are not things people install. - build.mjs no longer wipes the database. The DB authors itself, so a rebuild would have thrown the roster away. --fresh is now explicit. - v_backlog view: what to assess next, ordered by measured usage. - packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest, bound to a SHA-256 of catalog.json. The page recomputes the digest in the browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration. Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessed": 1
}
Reference in a new issue Copy permalink