feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
|
|
|
{
|
feat: the hook prober, and the list becomes the front door
Christian: 'drop any URL and say tell me where Big Tech has its hooks... we're
not just rating software, we're rating software as a service.'
db/hooks/probe.mjs answers that from public records only: DNS, MX, SPF, ASN via
Team Cymru, HTTP headers, and the third-party hosts named in the page's own HTML.
Nothing is scanned. If a site tells the world it sends mail through Google, this
reads it.
Verified live, 2026-10-29:
parler.com -> AS16509 AMAZON, plus Microsoft email, plus Vercel
netflix.com -> AS40027 NETFLIX (their own Open Connect edge), NOT AWS
signal.org -> Cloudflare CDN, Google touchpoints
bigtech.sucks-> AS16509 AMAZON (GoDaddy parking sits on AWS)
That netflix result is the important one. The front door is Netflix's own network;
the catalog and user data are in AWS. Edge ASN is not backend custody, and the tool
says so in its own header comment rather than pretending otherwise.
Also:
- The list is now the front door (public/index.html, generated from the DB).
The game moved to /game.html and keeps working, ready for its own subdomain.
- suggestion table + v_requested view: anyone can ask for a product to be rated,
no account, no email. Optional contact. Addresses are salted-hashed, never stored.
- POST /api/suggest on the existing server package, with a graceful fallback on the
static page to a Forgejo issue so requests are never lost when the server is down.
2026-10-29 17:23:11 -05:00
|
|
|
"digest": "26267b38b11900741b6933e21ae8a604a6545f754198f80cc74ccf54a478148a",
|
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
|
|
|
"algorithm": "sha256",
|
|
|
|
|
"file": "catalog.json",
|
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
|
|
|
"byte_length": 91034,
|
feat: the hook prober, and the list becomes the front door
Christian: 'drop any URL and say tell me where Big Tech has its hooks... we're
not just rating software, we're rating software as a service.'
db/hooks/probe.mjs answers that from public records only: DNS, MX, SPF, ASN via
Team Cymru, HTTP headers, and the third-party hosts named in the page's own HTML.
Nothing is scanned. If a site tells the world it sends mail through Google, this
reads it.
Verified live, 2026-10-29:
parler.com -> AS16509 AMAZON, plus Microsoft email, plus Vercel
netflix.com -> AS40027 NETFLIX (their own Open Connect edge), NOT AWS
signal.org -> Cloudflare CDN, Google touchpoints
bigtech.sucks-> AS16509 AMAZON (GoDaddy parking sits on AWS)
That netflix result is the important one. The front door is Netflix's own network;
the catalog and user data are in AWS. Edge ASN is not backend custody, and the tool
says so in its own header comment rather than pretending otherwise.
Also:
- The list is now the front door (public/index.html, generated from the DB).
The game moved to /game.html and keeps working, ready for its own subdomain.
- suggestion table + v_requested view: anyone can ask for a product to be rated,
no account, no email. Optional contact. Addresses are salted-hashed, never stored.
- POST /api/suggest on the existing server package, with a graceful fallback on the
static page to a Forgejo issue so requests are never lost when the server is down.
2026-10-29 17:23:11 -05:00
|
|
|
"rebuilt_at": "2026-10-29T22:21:27.417Z",
|
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
|
|
|
"method_version": "btr-0.1",
|
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
|
|
|
"products": 137,
|
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
|
|
|
"assessed": 1
|
|
|
|
|
}
|