Observed on the operator's machine 2026-10-30 while reinstalling to put the app
to use. Four months after the package was purged, a fresh install found
~/.config/Signal/sql/db.sqlite (54,214,656 bytes, mtime 2026-06-21), tried to
open it, and aborted before the linking screen:
MainSQL: sqlite(SQLITE_NOTADB): file is not a database in PRAGMA journal_mode = WAL
MainSQL: migrateDatabase: Migration without cipher change failed
sql.initialize was unsuccessful; returning early
The SQLCipher key in config.json no longer resolved. The UI named nothing and
offered only 'Delete data and restart', which discards the history. Moving the
config directory aside fixes it; nothing in the product says so.
Recorded as a medium finding, status open. The score does not move: 76.4 / B.
local_data_exposure was already 5 for exactly this behaviour, and a finding is
evidence, not a point. What changes is that the number now has a receipt instead
of a rationale.
Artifact: Servetus/00-Artifacts/2026/10-Oct/30/clu-signal-startup-failure/
main.log.excerpt - the failing run, verbatim
00-provenance.txt - package version, file sizes, sha256 of the retained db
Retained state moved to ~/Signal-backup-2026-10-30-0026, not deleted.
Christian: 'I want them to put the BigTech.Sucks rating badge on their site.
It should be marketing for them.'
A sticker anyone can copy is worthless, so it is not a sticker.
- badge/<product>.svg is generated from the assessment row on every build.
Score, grade and date are never typed by a human.
- Served from bigtech.sucks. A copy pasted onto a vendor's own server is not a
badge and its link will not resolve. The domain is the signature.
- Regenerated every build, so improving earns a better badge without asking and
regressing loses it without warning.
- The SVG carries the record id, version and method in a comment, so a real
badge can be traced back to one assessment.
badges.html publishes the rules: free forever, only rated products, no badge as
a favour, and misuse called out publicly. Free matters, because charging for it
would make it worthless to both sides: marketing for the vendor, receipts for
their customer.
Also rewrote the write pass to emit report + badge per assessment in one loop, so
they can never drift apart.
Christian: 'drop any URL and say tell me where Big Tech has its hooks... we're
not just rating software, we're rating software as a service.'
db/hooks/probe.mjs answers that from public records only: DNS, MX, SPF, ASN via
Team Cymru, HTTP headers, and the third-party hosts named in the page's own HTML.
Nothing is scanned. If a site tells the world it sends mail through Google, this
reads it.
Verified live, 2026-10-29:
parler.com -> AS16509 AMAZON, plus Microsoft email, plus Vercel
netflix.com -> AS40027 NETFLIX (their own Open Connect edge), NOT AWS
signal.org -> Cloudflare CDN, Google touchpoints
bigtech.sucks-> AS16509 AMAZON (GoDaddy parking sits on AWS)
That netflix result is the important one. The front door is Netflix's own network;
the catalog and user data are in AWS. Edge ASN is not backend custody, and the tool
says so in its own header comment rather than pretending otherwise.
Also:
- The list is now the front door (public/index.html, generated from the DB).
The game moved to /game.html and keeps working, ready for its own subdomain.
- suggestion table + v_requested view: anyone can ask for a product to be rated,
no account, no email. Optional contact. Addresses are salted-hashed, never stored.
- POST /api/suggest on the existing server package, with a graceful fallback on the
static page to a Forgejo issue so requests are never lost when the server is down.
