bunkhouse/bigtech-sucks
7
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
bigtech-sucks/packages/web/public/catalog.json

2947 lines
78 KiB
JSON
Raw Normal View History

feat: self-authoring ingest, relevance gate, and the Ranch Oath The roster writes itself. The scores do not. - db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by stars (usage); Flathub is a curated store of end-user Linux apps, so relevance is free there and has to be earned on GitHub. - db/ingest/run.mjs: discovers into the roster as unassessed products, never as scores. Every discovery leaves a receipt (source, url, usage metric, timestamp) so a reader can see where a product came from and why it ranks. - LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top because brokers are highly starred and are not things people install. - build.mjs no longer wipes the database. The DB authors itself, so a rebuild would have thrown the roster away. --fresh is now explicit. - v_backlog view: what to assess next, ordered by measured usage. - packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest, bound to a SHA-256 of catalog.json. The page recomputes the digest in the browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration. Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
"generated_at": "2026-10-29T18:23:54.071Z",
"method_version": "btr-0.1",
"dimensions": [
{
"id": "telemetry_egress",
"label": "Telemetry and egress",
"weight": 25,
"anchor_10": "Published destination allowlist; cold idle produces zero unlisted packets, independently confirmed.",
"anchor_0": "Covert collection, or egress that cannot be enumerated."
},
{
"id": "verifiability",
"label": "Verifiability",
"weight": 20,
"anchor_10": "Reproducible build verified on the scored platform.",
"anchor_0": "Closed source, or no way to prove the binary matches the source."
},
{
"id": "server_retention",
"label": "Server-side retention",
"weight": 15,
"anchor_10": "Subpoena answer is two timestamps or an empty set.",
"anchor_0": "Content readable by the vendor."
},
{
"id": "ownership_jurisdiction",
"label": "Ownership, jurisdiction, business model",
"weight": 12,
"anchor_10": "Nonprofit or cooperative, no ad model, strong process protections.",
"anchor_0": "State-controlled."
},
{
"id": "local_data_exposure",
"label": "Local data exposure",
"weight": 10,
"anchor_10": "All artifacts encrypted at rest under a user-presence key.",
"anchor_0": "Everything plaintext on disk."
},
{
"id": "dependency_surface",
"label": "Dependency surface",
"weight": 8,
"anchor_10": "Small audited dependency tree, signed and pinned update channel.",
"anchor_0": "Huge unaudited tree, unsigned updates."
},
{
"id": "user_control_exit",
"label": "User control and exit",
"weight": 5,
"anchor_10": "Usable export, real deletion, no identity hostage-taking.",
"anchor_0": "No export, deletion that does not delete."
},
{
"id": "incident_record",
"label": "Incident record",
"weight": 5,
"anchor_10": "Flaws found, disclosed honestly, fixed fast.",
"anchor_0": "Unblemished only because nobody is allowed to test it."
}
],
"products": [
{
"id": "alpaca",
"name": "Alpaca",
"platform": "linux-flatpak",
"category_id": "ai",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "chatgpt",
"name": "ChatGPT",
"platform": "web",
"category_id": "ai",
"vendor_id": "openai",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_chatgpt",
"monthly_cost": 20,
"vendor": "OpenAI",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "mixed",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "chatqt",
"name": "ChatQT",
"platform": "linux-flatpak",
"category_id": "ai",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "gpt4all",
"name": "GPT4ALL",
"platform": "linux-flatpak",
"category_id": "ai",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "gai",
"name": "Gai",
"platform": "linux-flatpak",
"category_id": "ai",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "gemini",
"name": "Google Gemini",
"platform": "web",
"category_id": "ai",
"vendor_id": "google",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_gemini",
"monthly_cost": 0,
"vendor": "Google LLC",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "lm-studio",
"name": "LM Studio",
"platform": "linux-flatpak",
"category_id": "ai",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "mindmate",
"name": "MindMate",
"platform": "linux-flatpak",
"category_id": "ai",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "moose",
"name": "Moose",
"platform": "linux-flatpak",
"category_id": "ai",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "reins-chat-for-ollama",
"name": "Reins: Chat for Ollama",
"platform": "linux-flatpak",
"category_id": "ai",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "tarotcaster",
"name": "TarotCaster",
"platform": "linux-flatpak",
"category_id": "ai",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "writing-tools",
"name": "Writing Tools",
"platform": "linux-flatpak",
"category_id": "ai",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "chromium-web-browser",
"name": "Chromium Web Browser",
"platform": "linux-flatpak",
"category_id": "browser",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "firedragon",
"name": "FireDragon",
"platform": "linux-flatpak",
"category_id": "browser",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "firefox",
"name": "Firefox",
"platform": "linux-flatpak",
"category_id": "browser",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "chrome",
"name": "Google Chrome",
"platform": "web",
"category_id": "browser",
"vendor_id": "google",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_chrome",
"monthly_cost": 0,
"vendor": "Google LLC",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "librewolf",
"name": "LibreWolf",
"platform": "linux-flatpak",
"category_id": "browser",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "microsoft-edge",
"name": "Microsoft Edge",
"platform": "linux-flatpak",
"category_id": "browser",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "mullvad-browser",
"name": "Mullvad Browser",
"platform": "linux-flatpak",
"category_id": "browser",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "waterfox",
"name": "Waterfox",
"platform": "linux-flatpak",
"category_id": "browser",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "web",
"name": "Web",
"platform": "linux-flatpak",
"category_id": "browser",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "web-apps",
"name": "Web Apps",
"platform": "linux-flatpak",
"category_id": "browser",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "yandex-browser",
"name": "Yandex Browser",
"platform": "linux-flatpak",
"category_id": "browser",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "google-calendar",
"name": "Google Calendar",
"platform": "web",
"category_id": "calendar",
"vendor_id": "google",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_google_calendar",
"monthly_cost": 0,
"vendor": "Google LLC",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "salesforce",
"name": "Salesforce",
"platform": "web",
"category_id": "crm",
"vendor_id": "salesforce",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_salesforce",
"monthly_cost": 25,
"vendor": "Salesforce, Inc.",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "github",
"name": "GitHub",
"platform": "web",
"category_id": "dev",
"vendor_id": "microsoft",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_github",
"monthly_cost": 0,
"vendor": "Microsoft Corporation",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "mixed",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "vercel",
"name": "Vercel",
"platform": "web",
"category_id": "dev",
"vendor_id": "vercel",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_vercel",
"monthly_cost": 20,
"vendor": "Vercel Inc.",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "aerion",
"name": "Aerion",
"platform": "linux-flatpak",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "betterbird",
"name": "Betterbird",
"platform": "linux-flatpak",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "convey",
"name": "Convey",
"platform": "linux-flatpak",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "geary",
"name": "Geary",
"platform": "linux-flatpak",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "gmail",
"name": "Gmail",
"platform": "web",
"category_id": "email",
"vendor_id": "google",
"sovereign": 0,
"boss": 1,
"art_slot": "outlaw_gmail",
"monthly_cost": 0,
"vendor": "Google LLC",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "kanmail",
"name": "Kanmail",
"platform": "source",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "mail",
"name": "Mail",
"platform": "source",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "mailspring",
"name": "Mailspring",
"platform": "linux-flatpak",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "meli",
"name": "Meli",
"platform": "source",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "meron",
"name": "Meron",
"platform": "linux-flatpak",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "outlook",
"name": "Outlook",
"platform": "web",
"category_id": "email",
"vendor_id": "microsoft",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_outlook",
"monthly_cost": 0,
"vendor": "Microsoft Corporation",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "mixed",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "protonmail",
"name": "Proton Mail",
"platform": "web",
"category_id": "email",
"vendor_id": "proton",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_protonmail",
"monthly_cost": 5,
"vendor": "Proton AG",
"entity_type": "private",
"jurisdiction": "CH",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "thunderbird",
"name": "Thunderbird",
"platform": "linux-flatpak",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "thunderbird-esr",
"name": "Thunderbird ESR",
"platform": "linux-flatpak",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "tuta-experimental",
"name": "Tuta (Experimental)",
"platform": "linux-flatpak",
"category_id": "email",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "dropbox",
"name": "Dropbox",
"platform": "web",
"category_id": "files",
"vendor_id": "dropbox",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_dropbox",
"monthly_cost": 12,
"vendor": "Dropbox, Inc.",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "google-drive",
"name": "Google Drive",
"platform": "web",
"category_id": "files",
"vendor_id": "google",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_google_drive",
"monthly_cost": 3,
"vendor": "Google LLC",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "lazyrsync",
"name": "Lazyrsync",
"platform": "source",
"category_id": "files",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "nextcloud",
"name": "Nextcloud (self-hosted)",
"platform": "web",
"category_id": "files",
"vendor_id": "nextcloud-gmbh",
"sovereign": 1,
"boss": 0,
"art_slot": "ally_nextcloud",
"monthly_cost": 0,
"vendor": "Nextcloud GmbH",
"entity_type": "private",
"jurisdiction": "DE",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "ocis",
"name": "Ocis",
"platform": "source",
"category_id": "files",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "onedrive",
"name": "OneDrive",
"platform": "web",
"category_id": "files",
"vendor_id": "microsoft",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_onedrive",
"monthly_cost": 7,
"vendor": "Microsoft Corporation",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "mixed",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "oxicloud",
"name": "OxiCloud",
"platform": "source",
"category_id": "files",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "seafile",
"name": "Seafile",
"platform": "source",
"category_id": "files",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "syncthing-macos",
"name": "Syncthing Macos",
"platform": "source",
"category_id": "files",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "twentythreeandme",
"name": "23andMe",
"platform": "web",
"category_id": "health",
"vendor_id": "23andme",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_23andme",
"monthly_cost": 0,
"vendor": "23andMe Holding Co.",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "mixed",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "fitbit",
"name": "Fitbit",
"platform": "web",
"category_id": "health",
"vendor_id": "google",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_fitbit",
"monthly_cost": 10,
"vendor": "Google LLC",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "bitchat",
"name": "Bitchat",
"platform": "source",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "chat",
"name": "Chat",
"platform": "source",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "discord",
"name": "Discord",
"platform": "web",
"category_id": "messaging",
"vendor_id": "discord",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_discord",
"monthly_cost": 0,
"vendor": "Discord Inc.",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "flare",
"name": "Flare",
"platform": "linux-flatpak",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "fluxer",
"name": "Fluxer",
"platform": "linux-flatpak",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "gnunet-messenger",
"name": "GNUnet Messenger",
"platform": "linux-flatpak",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "gajim",
"name": "Gajim",
"platform": "linux-flatpak",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "kaidan",
"name": "Kaidan",
"platform": "linux-flatpak",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "karere",
"name": "Karere",
"platform": "linux-flatpak",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "lightning",
"name": "Lightning",
"platform": "linux-flatpak",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "mumble",
"name": "Mumble",
"platform": "linux-flatpak",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "parla",
"name": "Parla",
"platform": "linux-flatpak",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "signal-desktop",
"name": "Signal Desktop",
"platform": "linux-x86_64",
"category_id": "messaging",
"vendor_id": "signal-foundation",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_signal",
"monthly_cost": 0,
"vendor": "Signal",
"entity_type": "nonprofit",
"jurisdiction": "US",
"business_model": "none",
"weighted_total": 75.9,
"grade": "B",
"policy": 85,
"infra": 58,
"weakest_dimension": "local_data_exposure",
"headline": "The strongest transport on the internet, sitting behind the weakest desktop client we have scored.",
"assessed_on": "2026-10-29"
},
{
"id": "simplex-chat",
"name": "Simplex Chat",
"platform": "source",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "slack",
"name": "Slack",
"platform": "web",
"category_id": "messaging",
"vendor_id": "salesforce",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_slack",
"monthly_cost": 8,
"vendor": "Salesforce, Inc.",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "whatsie",
"name": "Whatsie",
"platform": "linux-flatpak",
"category_id": "messaging",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "mint",
"name": "Mint (Intuit)",
"platform": "web",
"category_id": "money",
"vendor_id": "intuit",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_mint",
"monthly_cost": 0,
"vendor": "Intuit Inc.",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "plaid",
"name": "Plaid",
"platform": "web",
"category_id": "money",
"vendor_id": "plaid",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_plaid",
"monthly_cost": 0,
"vendor": "Plaid Inc.",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "mixed",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "beaver-notes",
"name": "Beaver Notes",
"platform": "linux-flatpak",
"category_id": "notes",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "evernote",
"name": "Evernote",
"platform": "web",
"category_id": "notes",
"vendor_id": "evernote",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_evernote",
"monthly_cost": 8,
"vendor": "Evernote",
"entity_type": "private",
"jurisdiction": "IT",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "notes",
"name": "Notes",
"platform": "linux-flatpak",
"category_id": "notes",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "notesnook",
"name": "Notesnook",
"platform": "linux-flatpak",
"category_id": "notes",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "notion",
"name": "Notion",
"platform": "web",
"category_id": "notes",
"vendor_id": "notion",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_notion",
"monthly_cost": 10,
"vendor": "Notion Labs",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "obsidian-sync",
"name": "Obsidian Sync",
"platform": "web",
"category_id": "notes",
"vendor_id": "obsidian",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_obsidian_sync",
"monthly_cost": 5,
"vendor": "Dynalist Inc.",
"entity_type": "private",
"jurisdiction": "CA",
"business_model": "license",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "scrivano-for-handwritten-notes",
"name": "Scrivano for Handwritten Notes",
"platform": "linux-flatpak",
"category_id": "notes",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "standard-notes",
"name": "Standard Notes",
"platform": "linux-flatpak",
"category_id": "notes",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "sticky-notes",
"name": "Sticky Notes",
"platform": "linux-flatpak",
"category_id": "notes",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "swifty-notes",
"name": "Swifty Notes",
"platform": "linux-flatpak",
"category_id": "notes",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "trilium-notes",
"name": "Trilium Notes",
"platform": "linux-flatpak",
"category_id": "notes",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "android",
"name": "Google Android",
"platform": "web",
"category_id": "os",
"vendor_id": "google",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_android",
"monthly_cost": 0,
"vendor": "Google LLC",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "windows",
"name": "Windows 11",
"platform": "web",
"category_id": "os",
"vendor_id": "microsoft",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_windows",
"monthly_cost": 0,
"vendor": "Microsoft Corporation",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "mixed",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "onepassword",
"name": "1Password",
"platform": "web",
"category_id": "passwords",
"vendor_id": "1password",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_1password",
"monthly_cost": 3,
"vendor": "AgileBits Inc.",
"entity_type": "private",
"jurisdiction": "CA",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "key-rack",
"name": "Key Rack",
"platform": "linux-flatpak",
"category_id": "passwords",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "lastpass",
"name": "LastPass",
"platform": "web",
"category_id": "passwords",
"vendor_id": "lastpass",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_lastpass",
"monthly_cost": 3,
"vendor": "LastPass",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "nextcloud-password-client",
"name": "Nextcloud Password Client",
"platform": "linux-flatpak",
"category_id": "passwords",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "nitrokey-app2",
"name": "Nitrokey App2",
"platform": "linux-flatpak",
"category_id": "passwords",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "onekeepass",
"name": "OneKeePass",
"platform": "linux-flatpak",
"category_id": "passwords",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "password",
"name": "Password",
"platform": "linux-flatpak",
"category_id": "passwords",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "password-generator",
"name": "Password Generator",
"platform": "linux-flatpak",
"category_id": "passwords",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "password-safe",
"name": "Password Safe",
"platform": "linux-flatpak",
"category_id": "passwords",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "password-secure",
"name": "Password Secure",
"platform": "linux-flatpak",
"category_id": "passwords",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "passwords-and-keys",
"name": "Passwords and Keys",
"platform": "linux-flatpak",
"category_id": "passwords",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "proton-pass",
"name": "Proton Pass",
"platform": "linux-flatpak",
"category_id": "passwords",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "a-photo-tool-libre",
"name": "A Photo Tool (Libre)",
"platform": "linux-flatpak",
"category_id": "photos",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "camera",
"name": "Camera",
"platform": "linux-flatpak",
"category_id": "photos",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "ente-photos",
"name": "Ente Photos",
"platform": "linux-flatpak",
"category_id": "photos",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "gnu-image-manipulation-program",
"name": "GNU Image Manipulation Program",
"platform": "linux-flatpak",
"category_id": "photos",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "google-photos",
"name": "Google Photos",
"platform": "web",
"category_id": "photos",
"vendor_id": "google",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_google_photos",
"monthly_cost": 3,
"vendor": "Google LLC",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "photocollage",
"name": "PhotoCollage",
"platform": "linux-flatpak",
"category_id": "photos",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "photoqt",
"name": "PhotoQt",
"platform": "linux-flatpak",
"category_id": "photos",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "photobooth",
"name": "Photobooth",
"platform": "linux-flatpak",
"category_id": "photos",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "photoflare",
"name": "Photoflare",
"platform": "linux-flatpak",
"category_id": "photos",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "photometry",
"name": "Photometry",
"platform": "linux-flatpak",
"category_id": "photos",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "photos",
"name": "Photos",
"platform": "linux-flatpak",
"category_id": "photos",
"vendor_id": "unknown",
"sovereign": 0,
"boss": 0,
"art_slot": null,
"monthly_cost": null,
"vendor": "Unknown vendor",
"entity_type": "unknown",
"jurisdiction": "unknown",
"business_model": "unknown",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "icloud-photos",
"name": "iCloud Photos",
"platform": "web",
"category_id": "photos",
"vendor_id": "apple",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_icloud_photos",
"monthly_cost": 3,
"vendor": "Apple Inc.",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "hardware",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "google-workspace",
"name": "Google Workspace",
"platform": "web",
"category_id": "productivity",
"vendor_id": "google",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_google_workspace",
"monthly_cost": 14,
"vendor": "Google LLC",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "microsoft-365",
"name": "Microsoft 365",
"platform": "web",
"category_id": "productivity",
"vendor_id": "microsoft",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_microsoft_365",
"monthly_cost": 13,
"vendor": "Microsoft Corporation",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "mixed",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "asana",
"name": "Asana",
"platform": "web",
"category_id": "project",
"vendor_id": "asana",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_asana",
"monthly_cost": 11,
"vendor": "Asana, Inc.",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "trello",
"name": "Trello",
"platform": "web",
"category_id": "project",
"vendor_id": "atlassian",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_trello",
"monthly_cost": 0,
"vendor": "Atlassian Corporation",
"entity_type": "public",
"jurisdiction": "AU",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "nest",
"name": "Google Nest",
"platform": "web",
"category_id": "smarthome",
"vendor_id": "google",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_nest",
"monthly_cost": 0,
"vendor": "Google LLC",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "ring",
"name": "Ring (Amazon)",
"platform": "web",
"category_id": "smarthome",
"vendor_id": "amazon",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_ring",
"monthly_cost": 0,
"vendor": "Amazon.com, Inc.",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "mixed",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "facebook",
"name": "Facebook",
"platform": "web",
"category_id": "social",
"vendor_id": "meta",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_facebook",
"monthly_cost": 0,
"vendor": "Meta Platforms",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "twitter",
"name": "X (Twitter)",
"platform": "web",
"category_id": "social",
"vendor_id": "x-corp",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_twitter",
"monthly_cost": 0,
"vendor": "X Corp.",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "advertising",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "netflix",
"name": "Netflix",
"platform": "web",
"category_id": "streaming",
"vendor_id": "netflix",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_netflix",
"monthly_cost": 16,
"vendor": "Netflix, Inc.",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "teams",
"name": "Microsoft Teams",
"platform": "web",
"category_id": "video",
"vendor_id": "microsoft",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_teams",
"monthly_cost": 0,
"vendor": "Microsoft Corporation",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "mixed",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "otter",
"name": "Otter.ai",
"platform": "web",
"category_id": "video",
"vendor_id": "otter",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_otter",
"monthly_cost": 17,
"vendor": "Otter.ai",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "zoom",
"name": "Zoom",
"platform": "web",
"category_id": "video",
"vendor_id": "zoom",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_zoom",
"monthly_cost": 16,
"vendor": "Zoom Communications",
"entity_type": "public",
"jurisdiction": "US",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "whisper-api",
"name": "OpenAI Whisper API",
"platform": "web",
"category_id": "voice",
"vendor_id": "openai",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_whisper_api",
"monthly_cost": 0,
"vendor": "OpenAI",
"entity_type": "private",
"jurisdiction": "US",
"business_model": "mixed",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
},
{
"id": "nordvpn",
"name": "NordVPN",
"platform": "web",
"category_id": "vpn",
"vendor_id": "nord-security",
"sovereign": 0,
"boss": 0,
"art_slot": "outlaw_nordvpn",
"monthly_cost": 4,
"vendor": "Nord Security",
"entity_type": "private",
"jurisdiction": "PA",
"business_model": "subscription",
"weighted_total": null,
"grade": null,
"policy": null,
"infra": null,
"weakest_dimension": null,
"headline": null,
"assessed_on": null
}
],
"assessments": [
{
"id": "A-2026-10-29-SIGNAL-DESKTOP",
"product_id": "signal-desktop",
"version": "8.36.0-alpha.1",
"source_commit": "5dad34ad5ea1a5b6229412e5c8ac0a696ff7532d",
"assessed_on": "2026-10-29",
"method_version": "btr-0.1",
"reproducible_build": 1,
"weighted_total": 75.9,
"grade": "B",
"weakest_dimension": "local_data_exposure",
"headline": "The strongest transport on the internet, sitting behind the weakest desktop client we have scored.",
"not_tested": "No live account was used. No packet capture was run (D1 to D4 not executed, this is a source audit only). Android and iOS clients not assessed. No attempt to verify the shipped .deb against a local rebuild."
}
],
"scores": [
{
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "telemetry_egress",
"value": 9,
"rationale": "Zero analytics packages across 224 dependencies. Crash reporter started with uploadToServer:false. Only signal.org, support.signal.org, updates*.signal.org and sfu.voip.signal.org appear in source. Docked one point for update checks on launch and the megaphone channel, neither of which is telemetry but both of which are vendor-initiated contact.",
"label": "Telemetry and egress",
"weight": 25
},
{
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "verifiability",
"value": 6,
"rationale": "Fully open source. Reproducible builds exist for Linux only, via Docker, and Signal labels them experimental and possibly non-functioning on public releases. macOS and Windows have none. Capped at 6 by the instrument rule.",
"label": "Verifiability",
"weight": 20
},
{
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "server_retention",
"value": 10,
"rationale": "The published answer to a 2021 federal grand jury subpoena was registration date and last connection date. No messages, contacts, groups, profile or avatar exist server-side to hand over.",
"label": "Server-side retention",
"weight": 15
},
{
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "ownership_jurisdiction",
"value": 8,
"rationale": "501(c)(3) nonprofit, EIN 82-4506840, no advertising and no data sale, so the incentive to surveil is absent rather than merely restrained. Docked for US jurisdiction and for early Open Technology Fund grant funding.",
"label": "Ownership, jurisdiction, business model",
"weight": 12
},
{
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "local_data_exposure",
"value": 5,
"rationale": "Received attachments are stored unencrypted at ~/.config/Signal/attachments.noindex (CVE-2023-24069). The SQLCipher key lives in gnome-keyring, so anything running as the user can read db.sqlite. On this operator machine that means every agent process.",
"label": "Local data exposure",
"weight": 10
},
{
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "dependency_surface",
"value": 6,
"rationale": "224 dependencies, Electron 45.0.0 pinned. Electron has produced CVEs enabling persistent backdoors in exactly this class of app. Update channel is a signed apt repo, which is the good part.",
"label": "Dependency surface",
"weight": 8
},
{
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "user_control_exit",
"value": 7,
"rationale": "Registration still requires a phone number, though usernames and phone-number privacy now reduce the exposure. No practical encrypted export of message history in a portable format.",
"label": "User control and exit",
"weight": 5
},
{
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "incident_record",
"value": 7,
"rationale": "Roughly 15 CVEs under the signal vendor entry. The 2023 local-storage flaws were acknowledged and fixed in 6.2.0. Signal is under continuous scrutiny, which is a better position than an untested clean record.",
"label": "Incident record",
"weight": 5
}
],
"evidence": [
{
"id": 8,
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "local_data_exposure",
"claim": "Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.",
"tier": 1,
"kind": "source",
"artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/01-capture-sites.txt",
"sha256": null,
"observed_at": "2026-10-29T13:13:56-05:00"
},
{
"id": 9,
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "telemetry_egress",
"claim": "Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.",
"tier": 1,
"kind": "source",
"artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/02-permissions.txt",
"sha256": "0a64f213f3c241c1211dec56c0018d9220651c2550a7cf44609d586e74369cf2",
"observed_at": "2026-10-29T13:13:56-05:00"
},
{
"id": 10,
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "telemetry_egress",
"claim": "Zero analytics, tracker or crash-upload dependencies across 224 packages.",
"tier": 1,
"kind": "source",
"artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/05-dependencies.txt",
"sha256": null,
"observed_at": "2026-10-29T13:13:56-05:00"
},
{
"id": 11,
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "telemetry_egress",
"claim": "Only two audio capture call sites exist and both are reachable only from an explicit UI action.",
"tier": 1,
"kind": "source",
"artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/03-call-path.txt",
"sha256": null,
"observed_at": "2026-10-29T13:13:56-05:00"
},
{
"id": 12,
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "verifiability",
"claim": "Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.",
"tier": 2,
"kind": "record",
"artifact": "https://github.com/signalapp/Signal-Desktop/blob/main/reproducible-builds/README.md",
"sha256": null,
"observed_at": "2026-10-29T13:13:56-05:00"
},
{
"id": 13,
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "server_retention",
"claim": "Grand jury subpoena response returned two timestamps and nothing else.",
"tier": 2,
"kind": "filing",
"artifact": "https://signal.org/bigbrother/cd-california-grand-jury/",
"sha256": null,
"observed_at": "2026-10-29T13:13:56-05:00"
},
{
"id": 14,
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"dimension_id": "ownership_jurisdiction",
"claim": "Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.",
"tier": 2,
"kind": "record",
"artifact": "https://projects.propublica.org/nonprofits/organizations/824506840",
"sha256": null,
"observed_at": "2026-10-29T13:13:56-05:00"
}
],
"findings": [
{
"id": 5,
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"severity": "high",
"title": "Received attachments are stored unencrypted on disk",
"detail": "Every image and file received is readable by any process running as the user. On a machine running agent software under the same account, this is the most likely real-world exposure.",
"status": "by_design",
"cve": "CVE-2023-24069"
},
{
"id": 6,
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"severity": "medium",
"title": "No verified reproducible build for the Linux package",
"detail": "The source is auditable; the shipped binary is not yet provably the same artifact. Until this closes, a source audit is evidence about the repository, not about the running process.",
"status": "open",
"cve": null
},
{
"id": 7,
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"severity": "medium",
"title": "Local database key is held in the OS keyring",
"detail": "Any process running in the unlocked session can decrypt db.sqlite. There is no user-presence gate.",
"status": "accepted",
"cve": null
},
{
"id": 8,
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
"severity": "low",
"title": "Registration requires a phone number",
"detail": "Mitigated by usernames and phone-number privacy, but the account root remains a phone number.",
"status": "accepted",
"cve": null
}
]
}
Reference in a new issue Copy permalink