feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"generated_at" : "2026-10-29T22:18:53.099Z" ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"method_version" : "btr-0.1" ,
"dimensions" : [
{
"id" : "telemetry_egress" ,
"label" : "Telemetry and egress" ,
"weight" : 25 ,
"anchor_10" : "Published destination allowlist; cold idle produces zero unlisted packets, independently confirmed." ,
"anchor_0" : "Covert collection, or egress that cannot be enumerated."
} ,
{
"id" : "verifiability" ,
"label" : "Verifiability" ,
"weight" : 20 ,
"anchor_10" : "Reproducible build verified on the scored platform." ,
"anchor_0" : "Closed source, or no way to prove the binary matches the source."
} ,
{
"id" : "server_retention" ,
"label" : "Server-side retention" ,
"weight" : 15 ,
"anchor_10" : "Subpoena answer is two timestamps or an empty set." ,
"anchor_0" : "Content readable by the vendor."
} ,
{
"id" : "ownership_jurisdiction" ,
"label" : "Ownership, jurisdiction, business model" ,
"weight" : 12 ,
"anchor_10" : "Nonprofit or cooperative, no ad model, strong process protections." ,
"anchor_0" : "State-controlled."
} ,
{
"id" : "local_data_exposure" ,
"label" : "Local data exposure" ,
"weight" : 10 ,
"anchor_10" : "All artifacts encrypted at rest under a user-presence key." ,
"anchor_0" : "Everything plaintext on disk."
} ,
{
"id" : "dependency_surface" ,
"label" : "Dependency surface" ,
"weight" : 8 ,
"anchor_10" : "Small audited dependency tree, signed and pinned update channel." ,
"anchor_0" : "Huge unaudited tree, unsigned updates."
} ,
{
"id" : "user_control_exit" ,
"label" : "User control and exit" ,
"weight" : 5 ,
"anchor_10" : "Usable export, real deletion, no identity hostage-taking." ,
"anchor_0" : "No export, deletion that does not delete."
} ,
{
"id" : "incident_record" ,
"label" : "Incident record" ,
"weight" : 5 ,
"anchor_10" : "Flaws found, disclosed honestly, fixed fast." ,
"anchor_0" : "Unblemished only because nobody is allowed to test it."
}
] ,
"products" : [
{
"id" : "alpaca" ,
"name" : "Alpaca" ,
"platform" : "linux-flatpak" ,
"category_id" : "ai" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "chatgpt" ,
"name" : "ChatGPT" ,
"platform" : "web" ,
"category_id" : "ai" ,
"vendor_id" : "openai" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_chatgpt" ,
"monthly_cost" : 20 ,
"vendor" : "OpenAI" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "mixed" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "chatqt" ,
"name" : "ChatQT" ,
"platform" : "linux-flatpak" ,
"category_id" : "ai" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "gpt4all" ,
"name" : "GPT4ALL" ,
"platform" : "linux-flatpak" ,
"category_id" : "ai" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "gai" ,
"name" : "Gai" ,
"platform" : "linux-flatpak" ,
"category_id" : "ai" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "gemini" ,
"name" : "Google Gemini" ,
"platform" : "web" ,
"category_id" : "ai" ,
"vendor_id" : "google" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_gemini" ,
"monthly_cost" : 0 ,
"vendor" : "Google LLC" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "lm-studio" ,
"name" : "LM Studio" ,
"platform" : "linux-flatpak" ,
"category_id" : "ai" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "mindmate" ,
"name" : "MindMate" ,
"platform" : "linux-flatpak" ,
"category_id" : "ai" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "moose" ,
"name" : "Moose" ,
"platform" : "linux-flatpak" ,
"category_id" : "ai" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "reins-chat-for-ollama" ,
"name" : "Reins: Chat for Ollama" ,
"platform" : "linux-flatpak" ,
"category_id" : "ai" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "tarotcaster" ,
"name" : "TarotCaster" ,
"platform" : "linux-flatpak" ,
"category_id" : "ai" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "writing-tools" ,
"name" : "Writing Tools" ,
"platform" : "linux-flatpak" ,
"category_id" : "ai" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "chromium-web-browser" ,
"name" : "Chromium Web Browser" ,
"platform" : "linux-flatpak" ,
"category_id" : "browser" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "firedragon" ,
"name" : "FireDragon" ,
"platform" : "linux-flatpak" ,
"category_id" : "browser" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "firefox" ,
"name" : "Firefox" ,
"platform" : "linux-flatpak" ,
"category_id" : "browser" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "chrome" ,
"name" : "Google Chrome" ,
"platform" : "web" ,
"category_id" : "browser" ,
"vendor_id" : "google" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_chrome" ,
"monthly_cost" : 0 ,
"vendor" : "Google LLC" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "librewolf" ,
"name" : "LibreWolf" ,
"platform" : "linux-flatpak" ,
"category_id" : "browser" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "microsoft-edge" ,
"name" : "Microsoft Edge" ,
"platform" : "linux-flatpak" ,
"category_id" : "browser" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "mullvad-browser" ,
"name" : "Mullvad Browser" ,
"platform" : "linux-flatpak" ,
"category_id" : "browser" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "waterfox" ,
"name" : "Waterfox" ,
"platform" : "linux-flatpak" ,
"category_id" : "browser" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "web" ,
"name" : "Web" ,
"platform" : "linux-flatpak" ,
"category_id" : "browser" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "web-apps" ,
"name" : "Web Apps" ,
"platform" : "linux-flatpak" ,
"category_id" : "browser" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "yandex-browser" ,
"name" : "Yandex Browser" ,
"platform" : "linux-flatpak" ,
"category_id" : "browser" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "google-calendar" ,
"name" : "Google Calendar" ,
"platform" : "web" ,
"category_id" : "calendar" ,
"vendor_id" : "google" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_google_calendar" ,
"monthly_cost" : 0 ,
"vendor" : "Google LLC" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
{
"id" : "nextcloud-calendar" ,
"name" : "Nextcloud Calendar" ,
"platform" : "web" ,
"category_id" : "calendar" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "nextcloud-contacts" ,
"name" : "Nextcloud Contacts" ,
"platform" : "web" ,
"category_id" : "calendar" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
"id" : "salesforce" ,
"name" : "Salesforce" ,
"platform" : "web" ,
"category_id" : "crm" ,
"vendor_id" : "salesforce" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_salesforce" ,
"monthly_cost" : 25 ,
"vendor" : "Salesforce, Inc." ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "github" ,
"name" : "GitHub" ,
"platform" : "web" ,
"category_id" : "dev" ,
"vendor_id" : "microsoft" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_github" ,
"monthly_cost" : 0 ,
"vendor" : "Microsoft Corporation" ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "mixed" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "vercel" ,
"name" : "Vercel" ,
"platform" : "web" ,
"category_id" : "dev" ,
"vendor_id" : "vercel" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_vercel" ,
"monthly_cost" : 20 ,
"vendor" : "Vercel Inc." ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "aerion" ,
"name" : "Aerion" ,
"platform" : "linux-flatpak" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "betterbird" ,
"name" : "Betterbird" ,
"platform" : "linux-flatpak" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "convey" ,
"name" : "Convey" ,
"platform" : "linux-flatpak" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "geary" ,
"name" : "Geary" ,
"platform" : "linux-flatpak" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "gmail" ,
"name" : "Gmail" ,
"platform" : "web" ,
"category_id" : "email" ,
"vendor_id" : "google" ,
"sovereign" : 0 ,
"boss" : 1 ,
"art_slot" : "outlaw_gmail" ,
"monthly_cost" : 0 ,
"vendor" : "Google LLC" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "kanmail" ,
"name" : "Kanmail" ,
"platform" : "source" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "mail" ,
"name" : "Mail" ,
"platform" : "source" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "mailspring" ,
"name" : "Mailspring" ,
"platform" : "linux-flatpak" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "meli" ,
"name" : "Meli" ,
"platform" : "source" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "meron" ,
"name" : "Meron" ,
"platform" : "linux-flatpak" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
{
"id" : "nextcloud-mail" ,
"name" : "Nextcloud Mail" ,
"platform" : "web" ,
"category_id" : "email" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
"id" : "outlook" ,
"name" : "Outlook" ,
"platform" : "web" ,
"category_id" : "email" ,
"vendor_id" : "microsoft" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_outlook" ,
"monthly_cost" : 0 ,
"vendor" : "Microsoft Corporation" ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "mixed" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "protonmail" ,
"name" : "Proton Mail" ,
"platform" : "web" ,
"category_id" : "email" ,
"vendor_id" : "proton" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_protonmail" ,
"monthly_cost" : 5 ,
"vendor" : "Proton AG" ,
"entity_type" : "private" ,
"jurisdiction" : "CH" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "thunderbird" ,
"name" : "Thunderbird" ,
"platform" : "linux-flatpak" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "thunderbird-esr" ,
"name" : "Thunderbird ESR" ,
"platform" : "linux-flatpak" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "tuta-experimental" ,
"name" : "Tuta (Experimental)" ,
"platform" : "linux-flatpak" ,
"category_id" : "email" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "dropbox" ,
"name" : "Dropbox" ,
"platform" : "web" ,
"category_id" : "files" ,
"vendor_id" : "dropbox" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_dropbox" ,
"monthly_cost" : 12 ,
"vendor" : "Dropbox, Inc." ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "google-drive" ,
"name" : "Google Drive" ,
"platform" : "web" ,
"category_id" : "files" ,
"vendor_id" : "google" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_google_drive" ,
"monthly_cost" : 3 ,
"vendor" : "Google LLC" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "lazyrsync" ,
"name" : "Lazyrsync" ,
"platform" : "source" ,
"category_id" : "files" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "nextcloud" ,
"name" : "Nextcloud (self-hosted)" ,
"platform" : "web" ,
"category_id" : "files" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : "ally_nextcloud" ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
{
"id" : "nextcloud-migrate-dropbox" ,
"name" : "Nextcloud Dropbox Migration" ,
"platform" : "web" ,
"category_id" : "files" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "nextcloud-files" ,
"name" : "Nextcloud Files" ,
"platform" : "web" ,
"category_id" : "files" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "nextcloud-migrate-gdrive" ,
"name" : "Nextcloud Google Drive Migration" ,
"platform" : "web" ,
"category_id" : "files" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "nextcloud-server" ,
"name" : "Nextcloud Server" ,
"platform" : "server" ,
"category_id" : "files" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
"id" : "ocis" ,
"name" : "Ocis" ,
"platform" : "source" ,
"category_id" : "files" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "onedrive" ,
"name" : "OneDrive" ,
"platform" : "web" ,
"category_id" : "files" ,
"vendor_id" : "microsoft" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_onedrive" ,
"monthly_cost" : 7 ,
"vendor" : "Microsoft Corporation" ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "mixed" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "oxicloud" ,
"name" : "OxiCloud" ,
"platform" : "source" ,
"category_id" : "files" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "seafile" ,
"name" : "Seafile" ,
"platform" : "source" ,
"category_id" : "files" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "syncthing-macos" ,
"name" : "Syncthing Macos" ,
"platform" : "source" ,
"category_id" : "files" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "twentythreeandme" ,
"name" : "23andMe" ,
"platform" : "web" ,
"category_id" : "health" ,
"vendor_id" : "23andme" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_23andme" ,
"monthly_cost" : 0 ,
"vendor" : "23andMe Holding Co." ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "mixed" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "fitbit" ,
"name" : "Fitbit" ,
"platform" : "web" ,
"category_id" : "health" ,
"vendor_id" : "google" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_fitbit" ,
"monthly_cost" : 10 ,
"vendor" : "Google LLC" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "bitchat" ,
"name" : "Bitchat" ,
"platform" : "source" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "chat" ,
"name" : "Chat" ,
"platform" : "source" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "discord" ,
"name" : "Discord" ,
"platform" : "web" ,
"category_id" : "messaging" ,
"vendor_id" : "discord" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_discord" ,
"monthly_cost" : 0 ,
"vendor" : "Discord Inc." ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "flare" ,
"name" : "Flare" ,
"platform" : "linux-flatpak" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "fluxer" ,
"name" : "Fluxer" ,
"platform" : "linux-flatpak" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "gnunet-messenger" ,
"name" : "GNUnet Messenger" ,
"platform" : "linux-flatpak" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "gajim" ,
"name" : "Gajim" ,
"platform" : "linux-flatpak" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "kaidan" ,
"name" : "Kaidan" ,
"platform" : "linux-flatpak" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "karere" ,
"name" : "Karere" ,
"platform" : "linux-flatpak" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "lightning" ,
"name" : "Lightning" ,
"platform" : "linux-flatpak" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "mumble" ,
"name" : "Mumble" ,
"platform" : "linux-flatpak" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
{
"id" : "nextcloud-spreed-signaling" ,
"name" : "Nextcloud Spreed Signaling (HPB)" ,
"platform" : "server" ,
"category_id" : "messaging" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "nextcloud-talk" ,
"name" : "Nextcloud Talk" ,
"platform" : "web" ,
"category_id" : "messaging" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
"id" : "parla" ,
"name" : "Parla" ,
"platform" : "linux-flatpak" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "signal-desktop" ,
"name" : "Signal Desktop" ,
"platform" : "linux-x86_64" ,
"category_id" : "messaging" ,
"vendor_id" : "signal-foundation" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_signal" ,
"monthly_cost" : 0 ,
"vendor" : "Signal" ,
"entity_type" : "nonprofit" ,
"jurisdiction" : "US" ,
"business_model" : "none" ,
feat: the Signal rumor ledger, and the half point it earned
Christian: 'If we can give it a higher rating or if we can dispel rumors, then we
need to make that part of our first post.'
Discipline first: debunking a rumor must not buy score, or the instrument
becomes a PR department with a database attached.
What the rumors actually did was correct one under-informed dimension.
- incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented
phishing campaign. FBI/CISA PSA260626 says plainly that the app and its
encryption were not compromised, Signal published a precise correction within
days and shipped linkage confirmations by 2026-05-13. Fast, accurate,
independently corroborated.
- Total 75.9 -> 76.4. Half a point. That is the correct size.
- Everything else was already priced in: the OTF funding was already docked under
ownership, the phone number already docked under user control.
Evidence rows added for the FBI advisory, Signal's statement, the itemised
,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments.
The recompute gate verified 76.4 from the weights and scores, not from trust.
2026-10-29 15:30:00 -05:00
"weighted_total" : 76.4 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"grade" : "B" ,
"policy" : 85 ,
"infra" : 58 ,
"weakest_dimension" : "local_data_exposure" ,
"headline" : "The strongest transport on the internet, sitting behind the weakest desktop client we have scored." ,
"assessed_on" : "2026-10-29"
} ,
{
"id" : "simplex-chat" ,
"name" : "Simplex Chat" ,
"platform" : "source" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "slack" ,
"name" : "Slack" ,
"platform" : "web" ,
"category_id" : "messaging" ,
"vendor_id" : "salesforce" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_slack" ,
"monthly_cost" : 8 ,
"vendor" : "Salesforce, Inc." ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "whatsie" ,
"name" : "Whatsie" ,
"platform" : "linux-flatpak" ,
"category_id" : "messaging" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "mint" ,
"name" : "Mint (Intuit)" ,
"platform" : "web" ,
"category_id" : "money" ,
"vendor_id" : "intuit" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_mint" ,
"monthly_cost" : 0 ,
"vendor" : "Intuit Inc." ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "plaid" ,
"name" : "Plaid" ,
"platform" : "web" ,
"category_id" : "money" ,
"vendor_id" : "plaid" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_plaid" ,
"monthly_cost" : 0 ,
"vendor" : "Plaid Inc." ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "mixed" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "beaver-notes" ,
"name" : "Beaver Notes" ,
"platform" : "linux-flatpak" ,
"category_id" : "notes" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "evernote" ,
"name" : "Evernote" ,
"platform" : "web" ,
"category_id" : "notes" ,
"vendor_id" : "evernote" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_evernote" ,
"monthly_cost" : 8 ,
"vendor" : "Evernote" ,
"entity_type" : "private" ,
"jurisdiction" : "IT" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
{
"id" : "nextcloud-notes" ,
"name" : "Nextcloud Notes" ,
"platform" : "web" ,
"category_id" : "notes" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
"id" : "notes" ,
"name" : "Notes" ,
"platform" : "linux-flatpak" ,
"category_id" : "notes" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "notesnook" ,
"name" : "Notesnook" ,
"platform" : "linux-flatpak" ,
"category_id" : "notes" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "notion" ,
"name" : "Notion" ,
"platform" : "web" ,
"category_id" : "notes" ,
"vendor_id" : "notion" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_notion" ,
"monthly_cost" : 10 ,
"vendor" : "Notion Labs" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "obsidian-sync" ,
"name" : "Obsidian Sync" ,
"platform" : "web" ,
"category_id" : "notes" ,
"vendor_id" : "obsidian" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_obsidian_sync" ,
"monthly_cost" : 5 ,
"vendor" : "Dynalist Inc." ,
"entity_type" : "private" ,
"jurisdiction" : "CA" ,
"business_model" : "license" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "scrivano-for-handwritten-notes" ,
"name" : "Scrivano for Handwritten Notes" ,
"platform" : "linux-flatpak" ,
"category_id" : "notes" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "standard-notes" ,
"name" : "Standard Notes" ,
"platform" : "linux-flatpak" ,
"category_id" : "notes" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "sticky-notes" ,
"name" : "Sticky Notes" ,
"platform" : "linux-flatpak" ,
"category_id" : "notes" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "swifty-notes" ,
"name" : "Swifty Notes" ,
"platform" : "linux-flatpak" ,
"category_id" : "notes" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "trilium-notes" ,
"name" : "Trilium Notes" ,
"platform" : "linux-flatpak" ,
"category_id" : "notes" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "android" ,
"name" : "Google Android" ,
"platform" : "web" ,
"category_id" : "os" ,
"vendor_id" : "google" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_android" ,
"monthly_cost" : 0 ,
"vendor" : "Google LLC" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "windows" ,
"name" : "Windows 11" ,
"platform" : "web" ,
"category_id" : "os" ,
"vendor_id" : "microsoft" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_windows" ,
"monthly_cost" : 0 ,
"vendor" : "Microsoft Corporation" ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "mixed" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "onepassword" ,
"name" : "1Password" ,
"platform" : "web" ,
"category_id" : "passwords" ,
"vendor_id" : "1password" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_1password" ,
"monthly_cost" : 3 ,
"vendor" : "AgileBits Inc." ,
"entity_type" : "private" ,
"jurisdiction" : "CA" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "key-rack" ,
"name" : "Key Rack" ,
"platform" : "linux-flatpak" ,
"category_id" : "passwords" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "lastpass" ,
"name" : "LastPass" ,
"platform" : "web" ,
"category_id" : "passwords" ,
"vendor_id" : "lastpass" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_lastpass" ,
"monthly_cost" : 3 ,
"vendor" : "LastPass" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "nextcloud-password-client" ,
"name" : "Nextcloud Password Client" ,
"platform" : "linux-flatpak" ,
"category_id" : "passwords" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
{
"id" : "nextcloud-passwords" ,
"name" : "Nextcloud Passwords" ,
"platform" : "web" ,
"category_id" : "passwords" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
"id" : "nitrokey-app2" ,
"name" : "Nitrokey App2" ,
"platform" : "linux-flatpak" ,
"category_id" : "passwords" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "onekeepass" ,
"name" : "OneKeePass" ,
"platform" : "linux-flatpak" ,
"category_id" : "passwords" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "password" ,
"name" : "Password" ,
"platform" : "linux-flatpak" ,
"category_id" : "passwords" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "password-generator" ,
"name" : "Password Generator" ,
"platform" : "linux-flatpak" ,
"category_id" : "passwords" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "password-safe" ,
"name" : "Password Safe" ,
"platform" : "linux-flatpak" ,
"category_id" : "passwords" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "password-secure" ,
"name" : "Password Secure" ,
"platform" : "linux-flatpak" ,
"category_id" : "passwords" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "passwords-and-keys" ,
"name" : "Passwords and Keys" ,
"platform" : "linux-flatpak" ,
"category_id" : "passwords" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "proton-pass" ,
"name" : "Proton Pass" ,
"platform" : "linux-flatpak" ,
"category_id" : "passwords" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "a-photo-tool-libre" ,
"name" : "A Photo Tool (Libre)" ,
"platform" : "linux-flatpak" ,
"category_id" : "photos" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "camera" ,
"name" : "Camera" ,
"platform" : "linux-flatpak" ,
"category_id" : "photos" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "ente-photos" ,
"name" : "Ente Photos" ,
"platform" : "linux-flatpak" ,
"category_id" : "photos" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "gnu-image-manipulation-program" ,
"name" : "GNU Image Manipulation Program" ,
"platform" : "linux-flatpak" ,
"category_id" : "photos" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "google-photos" ,
"name" : "Google Photos" ,
"platform" : "web" ,
"category_id" : "photos" ,
"vendor_id" : "google" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_google_photos" ,
"monthly_cost" : 3 ,
"vendor" : "Google LLC" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
{
"id" : "nextcloud-photos" ,
"name" : "Nextcloud Photos" ,
"platform" : "web" ,
"category_id" : "photos" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
"id" : "photocollage" ,
"name" : "PhotoCollage" ,
"platform" : "linux-flatpak" ,
"category_id" : "photos" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "photoqt" ,
"name" : "PhotoQt" ,
"platform" : "linux-flatpak" ,
"category_id" : "photos" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "photobooth" ,
"name" : "Photobooth" ,
"platform" : "linux-flatpak" ,
"category_id" : "photos" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "photoflare" ,
"name" : "Photoflare" ,
"platform" : "linux-flatpak" ,
"category_id" : "photos" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "photometry" ,
"name" : "Photometry" ,
"platform" : "linux-flatpak" ,
"category_id" : "photos" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "photos" ,
"name" : "Photos" ,
"platform" : "linux-flatpak" ,
"category_id" : "photos" ,
"vendor_id" : "unknown" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Unknown vendor" ,
"entity_type" : "unknown" ,
"jurisdiction" : "unknown" ,
"business_model" : "unknown" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "icloud-photos" ,
"name" : "iCloud Photos" ,
"platform" : "web" ,
"category_id" : "photos" ,
"vendor_id" : "apple" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_icloud_photos" ,
"monthly_cost" : 3 ,
"vendor" : "Apple Inc." ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "hardware" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "google-workspace" ,
"name" : "Google Workspace" ,
"platform" : "web" ,
"category_id" : "productivity" ,
"vendor_id" : "google" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_google_workspace" ,
"monthly_cost" : 14 ,
"vendor" : "Google LLC" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "microsoft-365" ,
"name" : "Microsoft 365" ,
"platform" : "web" ,
"category_id" : "productivity" ,
"vendor_id" : "microsoft" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_microsoft_365" ,
"monthly_cost" : 13 ,
"vendor" : "Microsoft Corporation" ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "mixed" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
{
"id" : "nextcloud-office" ,
"name" : "Nextcloud Office" ,
"platform" : "web" ,
"category_id" : "productivity" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
"id" : "asana" ,
"name" : "Asana" ,
"platform" : "web" ,
"category_id" : "project" ,
"vendor_id" : "asana" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_asana" ,
"monthly_cost" : 11 ,
"vendor" : "Asana, Inc." ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
{
"id" : "nextcloud-deck" ,
"name" : "Nextcloud Deck" ,
"platform" : "web" ,
"category_id" : "project" ,
"vendor_id" : "nextcloud-gmbh" ,
"sovereign" : 1 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : 0 ,
"vendor" : "Nextcloud GmbH" ,
"entity_type" : "private" ,
"jurisdiction" : "DE" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
"id" : "trello" ,
"name" : "Trello" ,
"platform" : "web" ,
"category_id" : "project" ,
"vendor_id" : "atlassian" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_trello" ,
"monthly_cost" : 0 ,
"vendor" : "Atlassian Corporation" ,
"entity_type" : "public" ,
"jurisdiction" : "AU" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "nest" ,
"name" : "Google Nest" ,
"platform" : "web" ,
"category_id" : "smarthome" ,
"vendor_id" : "google" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_nest" ,
"monthly_cost" : 0 ,
"vendor" : "Google LLC" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "ring" ,
"name" : "Ring (Amazon)" ,
"platform" : "web" ,
"category_id" : "smarthome" ,
"vendor_id" : "amazon" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_ring" ,
"monthly_cost" : 0 ,
"vendor" : "Amazon.com, Inc." ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "mixed" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "facebook" ,
"name" : "Facebook" ,
"platform" : "web" ,
"category_id" : "social" ,
"vendor_id" : "meta" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_facebook" ,
"monthly_cost" : 0 ,
"vendor" : "Meta Platforms" ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "twitter" ,
"name" : "X (Twitter)" ,
"platform" : "web" ,
"category_id" : "social" ,
"vendor_id" : "x-corp" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_twitter" ,
"monthly_cost" : 0 ,
"vendor" : "X Corp." ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "advertising" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "netflix" ,
"name" : "Netflix" ,
"platform" : "web" ,
"category_id" : "streaming" ,
"vendor_id" : "netflix" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_netflix" ,
"monthly_cost" : 16 ,
"vendor" : "Netflix, Inc." ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: the closed-source rule, and the board
Christian, 2026-10-29: 'Closed source software, you have no idea. And then all
we have is reputation. So you kind of start with one arm or two arms tied
behind your back.'
That is now arithmetic instead of an opinion.
- assessment.source_available: 1 = we can read the code, 0 = we cannot.
- Closed source cannot exceed 5 on ANY dimension without tier-1 or tier-2
evidence of kind 'capture' or 'filing'. Reputation is tier 3, and tier 3 is
not a measurement. The build fails if a closed-source score breaks the rule.
- Verifiability still caps at 3 with no reproducible build.
Practical ceiling for closed source: 86/100 in theory, if every dimension is
backed by a capture or a court filing. In practice it is a fight for a C.
- product.priority puts a human's ask ahead of a crawler's discovery.
- v_backlog orders by priority, then measured usage.
- migrate(): the database authors itself, so it must survive its own schema
changes. Add columns, drop views, let schema.sql recreate them. Never drop
and rebuild, which would destroy the self-authored roster.
On the board: Slack (closed, capped) and Kino (closed, capped, founders call
2026-10-30 17:00). Neither is scored. Neither gets a number until it has
evidence.
2026-10-29 15:23:31 -05:00
{
"id" : "kino-ai" ,
"name" : "Kino" ,
"platform" : "web" ,
"category_id" : "video" ,
"vendor_id" : "kino-ai" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : null ,
"monthly_cost" : null ,
"vendor" : "Kino AI" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
{
"id" : "teams" ,
"name" : "Microsoft Teams" ,
"platform" : "web" ,
"category_id" : "video" ,
"vendor_id" : "microsoft" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_teams" ,
"monthly_cost" : 0 ,
"vendor" : "Microsoft Corporation" ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "mixed" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "otter" ,
"name" : "Otter.ai" ,
"platform" : "web" ,
"category_id" : "video" ,
"vendor_id" : "otter" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_otter" ,
"monthly_cost" : 17 ,
"vendor" : "Otter.ai" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "zoom" ,
"name" : "Zoom" ,
"platform" : "web" ,
"category_id" : "video" ,
"vendor_id" : "zoom" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_zoom" ,
"monthly_cost" : 16 ,
"vendor" : "Zoom Communications" ,
"entity_type" : "public" ,
"jurisdiction" : "US" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "whisper-api" ,
"name" : "OpenAI Whisper API" ,
"platform" : "web" ,
"category_id" : "voice" ,
"vendor_id" : "openai" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_whisper_api" ,
"monthly_cost" : 0 ,
"vendor" : "OpenAI" ,
"entity_type" : "private" ,
"jurisdiction" : "US" ,
"business_model" : "mixed" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
} ,
{
"id" : "nordvpn" ,
"name" : "NordVPN" ,
"platform" : "web" ,
"category_id" : "vpn" ,
"vendor_id" : "nord-security" ,
"sovereign" : 0 ,
"boss" : 0 ,
"art_slot" : "outlaw_nordvpn" ,
"monthly_cost" : 4 ,
"vendor" : "Nord Security" ,
"entity_type" : "private" ,
"jurisdiction" : "PA" ,
"business_model" : "subscription" ,
"weighted_total" : null ,
"grade" : null ,
"policy" : null ,
"infra" : null ,
"weakest_dimension" : null ,
"headline" : null ,
"assessed_on" : null
}
] ,
"assessments" : [
{
"id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"product_id" : "signal-desktop" ,
"version" : "8.36.0-alpha.1" ,
"source_commit" : "5dad34ad5ea1a5b6229412e5c8ac0a696ff7532d" ,
"assessed_on" : "2026-10-29" ,
"method_version" : "btr-0.1" ,
"reproducible_build" : 1 ,
feat: the Signal rumor ledger, and the half point it earned
Christian: 'If we can give it a higher rating or if we can dispel rumors, then we
need to make that part of our first post.'
Discipline first: debunking a rumor must not buy score, or the instrument
becomes a PR department with a database attached.
What the rumors actually did was correct one under-informed dimension.
- incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented
phishing campaign. FBI/CISA PSA260626 says plainly that the app and its
encryption were not compromised, Signal published a precise correction within
days and shipped linkage confirmations by 2026-05-13. Fast, accurate,
independently corroborated.
- Total 75.9 -> 76.4. Half a point. That is the correct size.
- Everything else was already priced in: the OTF funding was already docked under
ownership, the phone number already docked under user control.
Evidence rows added for the FBI advisory, Signal's statement, the itemised
,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments.
The recompute gate verified 76.4 from the weights and scores, not from trust.
2026-10-29 15:30:00 -05:00
"weighted_total" : 76.4 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"grade" : "B" ,
"weakest_dimension" : "local_data_exposure" ,
"headline" : "The strongest transport on the internet, sitting behind the weakest desktop client we have scored." ,
"not_tested" : "No live account was used. No packet capture was run (D1 to D4 not executed, this is a source audit only). Android and iOS clients not assessed. No attempt to verify the shipped .deb against a local rebuild."
}
] ,
"scores" : [
{
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "telemetry_egress" ,
"value" : 9 ,
"rationale" : "Zero analytics packages across 224 dependencies. Crash reporter started with uploadToServer:false. Only signal.org, support.signal.org, updates*.signal.org and sfu.voip.signal.org appear in source. Docked one point for update checks on launch and the megaphone channel, neither of which is telemetry but both of which are vendor-initiated contact." ,
"label" : "Telemetry and egress" ,
"weight" : 25
} ,
{
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "verifiability" ,
"value" : 6 ,
"rationale" : "Fully open source. Reproducible builds exist for Linux only, via Docker, and Signal labels them experimental and possibly non-functioning on public releases. macOS and Windows have none. Capped at 6 by the instrument rule." ,
"label" : "Verifiability" ,
"weight" : 20
} ,
{
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "server_retention" ,
"value" : 10 ,
"rationale" : "The published answer to a 2021 federal grand jury subpoena was registration date and last connection date. No messages, contacts, groups, profile or avatar exist server-side to hand over." ,
"label" : "Server-side retention" ,
"weight" : 15
} ,
{
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "ownership_jurisdiction" ,
"value" : 8 ,
"rationale" : "501(c)(3) nonprofit, EIN 82-4506840, no advertising and no data sale, so the incentive to surveil is absent rather than merely restrained. Docked for US jurisdiction and for early Open Technology Fund grant funding." ,
"label" : "Ownership, jurisdiction, business model" ,
"weight" : 12
} ,
{
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "local_data_exposure" ,
"value" : 5 ,
"rationale" : "Received attachments are stored unencrypted at ~/.config/Signal/attachments.noindex (CVE-2023-24069). The SQLCipher key lives in gnome-keyring, so anything running as the user can read db.sqlite. On this operator machine that means every agent process." ,
"label" : "Local data exposure" ,
"weight" : 10
} ,
{
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "dependency_surface" ,
"value" : 6 ,
"rationale" : "224 dependencies, Electron 45.0.0 pinned. Electron has produced CVEs enabling persistent backdoors in exactly this class of app. Update channel is a signed apt repo, which is the good part." ,
"label" : "Dependency surface" ,
"weight" : 8
} ,
{
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "user_control_exit" ,
"value" : 7 ,
"rationale" : "Registration still requires a phone number, though usernames and phone-number privacy now reduce the exposure. No practical encrypted export of message history in a portable format." ,
"label" : "User control and exit" ,
"weight" : 5
} ,
{
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "incident_record" ,
feat: the Signal rumor ledger, and the half point it earned
Christian: 'If we can give it a higher rating or if we can dispel rumors, then we
need to make that part of our first post.'
Discipline first: debunking a rumor must not buy score, or the instrument
becomes a PR department with a database attached.
What the rumors actually did was correct one under-informed dimension.
- incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented
phishing campaign. FBI/CISA PSA260626 says plainly that the app and its
encryption were not compromised, Signal published a precise correction within
days and shipped linkage confirmations by 2026-05-13. Fast, accurate,
independently corroborated.
- Total 75.9 -> 76.4. Half a point. That is the correct size.
- Everything else was already priced in: the OTF funding was already docked under
ownership, the phone number already docked under user control.
Evidence rows added for the FBI advisory, Signal's statement, the itemised
,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments.
The recompute gate verified 76.4 from the weights and scores, not from trust.
2026-10-29 15:30:00 -05:00
"value" : 8 ,
"rationale" : "Roughly 15 CVEs under the signal vendor entry. In 2026 a large phishing campaign was widely reported as \"Signal hacked\"; the FBI and CISA PSA260626 state plainly that neither the app nor its encryption was compromised, and Signal published a precise correction within days and shipped additional linkage confirmations by 13 May 2026. Fast, accurate, independently corroborated incident handling. Not a 9 or 10 because the linked-device QR flow remained easy to phish for months, which is a design weakness even when the cryptography holds." ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"label" : "Incident record" ,
"weight" : 5
}
] ,
"evidence" : [
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 55 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "local_data_exposure" ,
"claim" : "Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring." ,
"tier" : 1 ,
"kind" : "source" ,
"artifact" : "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/01-capture-sites.txt" ,
"sha256" : null ,
"observed_at" : "2026-10-29T13:13:56-05:00"
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 56 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "telemetry_egress" ,
"claim" : "Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions." ,
"tier" : 1 ,
"kind" : "source" ,
"artifact" : "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/02-permissions.txt" ,
"sha256" : "0a64f213f3c241c1211dec56c0018d9220651c2550a7cf44609d586e74369cf2" ,
"observed_at" : "2026-10-29T13:13:56-05:00"
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 57 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "telemetry_egress" ,
"claim" : "Zero analytics, tracker or crash-upload dependencies across 224 packages." ,
"tier" : 1 ,
"kind" : "source" ,
"artifact" : "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/05-dependencies.txt" ,
"sha256" : null ,
"observed_at" : "2026-10-29T13:13:56-05:00"
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 58 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "telemetry_egress" ,
"claim" : "Only two audio capture call sites exist and both are reachable only from an explicit UI action." ,
"tier" : 1 ,
"kind" : "source" ,
"artifact" : "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/03-call-path.txt" ,
"sha256" : null ,
"observed_at" : "2026-10-29T13:13:56-05:00"
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 59 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "verifiability" ,
"claim" : "Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental." ,
"tier" : 2 ,
"kind" : "record" ,
"artifact" : "https://github.com/signalapp/Signal-Desktop/blob/main/reproducible-builds/README.md" ,
"sha256" : null ,
"observed_at" : "2026-10-29T13:13:56-05:00"
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 60 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "server_retention" ,
"claim" : "Grand jury subpoena response returned two timestamps and nothing else." ,
"tier" : 2 ,
"kind" : "filing" ,
"artifact" : "https://signal.org/bigbrother/cd-california-grand-jury/" ,
"sha256" : null ,
"observed_at" : "2026-10-29T13:13:56-05:00"
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 61 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "ownership_jurisdiction" ,
"claim" : "Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840." ,
"tier" : 2 ,
"kind" : "record" ,
"artifact" : "https://projects.propublica.org/nonprofits/organizations/824506840" ,
"sha256" : null ,
"observed_at" : "2026-10-29T13:13:56-05:00"
feat: the Signal rumor ledger, and the half point it earned
Christian: 'If we can give it a higher rating or if we can dispel rumors, then we
need to make that part of our first post.'
Discipline first: debunking a rumor must not buy score, or the instrument
becomes a PR department with a database attached.
What the rumors actually did was correct one under-informed dimension.
- incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented
phishing campaign. FBI/CISA PSA260626 says plainly that the app and its
encryption were not compromised, Signal published a precise correction within
days and shipped linkage confirmations by 2026-05-13. Fast, accurate,
independently corroborated.
- Total 75.9 -> 76.4. Half a point. That is the correct size.
- Everything else was already priced in: the OTF funding was already docked under
ownership, the phone number already docked under user control.
Evidence rows added for the FBI advisory, Signal's statement, the itemised
,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments.
The recompute gate verified 76.4 from the weights and scores, not from trust.
2026-10-29 15:30:00 -05:00
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 62 ,
feat: the Signal rumor ledger, and the half point it earned
Christian: 'If we can give it a higher rating or if we can dispel rumors, then we
need to make that part of our first post.'
Discipline first: debunking a rumor must not buy score, or the instrument
becomes a PR department with a database attached.
What the rumors actually did was correct one under-informed dimension.
- incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented
phishing campaign. FBI/CISA PSA260626 says plainly that the app and its
encryption were not compromised, Signal published a precise correction within
days and shipped linkage confirmations by 2026-05-13. Fast, accurate,
independently corroborated.
- Total 75.9 -> 76.4. Half a point. That is the correct size.
- Everything else was already priced in: the OTF funding was already docked under
ownership, the phone number already docked under user control.
Evidence rows added for the FBI advisory, Signal's statement, the itemised
,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments.
The recompute gate verified 76.4 from the weights and scores, not from trust.
2026-10-29 15:30:00 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "incident_record" ,
"claim" : "FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself." ,
"tier" : 2 ,
"kind" : "advisory" ,
"artifact" : "https://www.ic3.gov/PSA/2026/PSA260626" ,
"sha256" : null ,
"observed_at" : "2026-10-29T15:26:00-05:00"
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 63 ,
feat: the Signal rumor ledger, and the half point it earned
Christian: 'If we can give it a higher rating or if we can dispel rumors, then we
need to make that part of our first post.'
Discipline first: debunking a rumor must not buy score, or the instrument
becomes a PR department with a database attached.
What the rumors actually did was correct one under-informed dimension.
- incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented
phishing campaign. FBI/CISA PSA260626 says plainly that the app and its
encryption were not compromised, Signal published a precise correction within
days and shipped linkage confirmations by 2026-05-13. Fast, accurate,
independently corroborated.
- Total 75.9 -> 76.4. Half a point. That is the correct size.
- Everything else was already priced in: the OTF funding was already docked under
ownership, the phone number already docked under user control.
Evidence rows added for the FBI advisory, Signal's statement, the itemised
,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments.
The recompute gate verified 76.4 from the weights and scores, not from trust.
2026-10-29 15:30:00 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "incident_record" ,
"claim" : "Signal statement, 28 April 2026: \"Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised.\" Additional linkage confirmations shipped 13 May 2026." ,
"tier" : 2 ,
"kind" : "record" ,
"artifact" : "https://x.com/signalapp/status/2048866663580246302" ,
"sha256" : null ,
"observed_at" : "2026-10-29T15:26:00-05:00"
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 64 ,
feat: the Signal rumor ledger, and the half point it earned
Christian: 'If we can give it a higher rating or if we can dispel rumors, then we
need to make that part of our first post.'
Discipline first: debunking a rumor must not buy score, or the instrument
becomes a PR department with a database attached.
What the rumors actually did was correct one under-informed dimension.
- incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented
phishing campaign. FBI/CISA PSA260626 says plainly that the app and its
encryption were not compromised, Signal published a precise correction within
days and shipped linkage confirmations by 2026-05-13. Fast, accurate,
independently corroborated.
- Total 75.9 -> 76.4. Half a point. That is the correct size.
- Everything else was already priced in: the OTF funding was already docked under
ownership, the phone number already docked under user control.
Evidence rows added for the FBI advisory, Signal's statement, the itemised
,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments.
The recompute gate verified 76.4 from the weights and scores, not from trust.
2026-10-29 15:30:00 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "ownership_jurisdiction" ,
"claim" : "Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the \"US government funded Signal\" claim, and it is already reflected in the two points docked on this dimension." ,
"tier" : 2 ,
"kind" : "record" ,
"artifact" : "https://www.opentech.fund/projects-we-support/supported-projects/signal-open-whisper-systems" ,
"sha256" : null ,
"observed_at" : "2026-10-29T15:26:00-05:00"
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 65 ,
feat: the Signal rumor ledger, and the half point it earned
Christian: 'If we can give it a higher rating or if we can dispel rumors, then we
need to make that part of our first post.'
Discipline first: debunking a rumor must not buy score, or the instrument
becomes a PR department with a database attached.
What the rumors actually did was correct one under-informed dimension.
- incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented
phishing campaign. FBI/CISA PSA260626 says plainly that the app and its
encryption were not compromised, Signal published a precise correction within
days and shipped linkage confirmations by 2026-05-13. Fast, accurate,
independently corroborated.
- Total 75.9 -> 76.4. Half a point. That is the correct size.
- Everything else was already priced in: the OTF funding was already docked under
ownership, the phone number already docked under user control.
Evidence rows added for the FBI advisory, Signal's statement, the itemised
,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments.
The recompute gate verified 76.4 from the weights and scores, not from trust.
2026-10-29 15:30:00 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"dimension_id" : "user_control_exit" ,
"claim" : "Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor." ,
"tier" : 2 ,
"kind" : "record" ,
"artifact" : "https://www.infosecurity-magazine.com/news/signal-exit-sweden-government/" ,
"sha256" : null ,
"observed_at" : "2026-10-29T15:26:00-05:00"
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
}
] ,
"findings" : [
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 25 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"severity" : "high" ,
"title" : "Received attachments are stored unencrypted on disk" ,
"detail" : "Every image and file received is readable by any process running as the user. On a machine running agent software under the same account, this is the most likely real-world exposure." ,
"status" : "by_design" ,
"cve" : "CVE-2023-24069"
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 26 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"severity" : "medium" ,
"title" : "No verified reproducible build for the Linux package" ,
"detail" : "The source is auditable; the shipped binary is not yet provably the same artifact. Until this closes, a source audit is evidence about the repository, not about the running process." ,
"status" : "open" ,
"cve" : null
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 27 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"severity" : "medium" ,
"title" : "Local database key is held in the OS keyring" ,
"detail" : "Any process running in the unlocked session can decrypt db.sqlite. There is no user-presence gate." ,
"status" : "accepted" ,
"cve" : null
} ,
{
feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
2026-10-29 17:19:01 -05:00
"id" : 28 ,
feat: self-authoring ingest, relevance gate, and the Ranch Oath
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
2026-10-29 13:23:57 -05:00
"assessment_id" : "A-2026-10-29-SIGNAL-DESKTOP" ,
"severity" : "low" ,
"title" : "Registration requires a phone number" ,
"detail" : "Mitigated by usernames and phone-number privacy, but the account root remains a phone number." ,
"status" : "accepted" ,
"cve" : null
}
]
}
