Christian: 'drop any URL and say tell me where Big Tech has its hooks... we're
not just rating software, we're rating software as a service.'
db/hooks/probe.mjs answers that from public records only: DNS, MX, SPF, ASN via
Team Cymru, HTTP headers, and the third-party hosts named in the page's own HTML.
Nothing is scanned. If a site tells the world it sends mail through Google, this
reads it.
Verified live, 2026-10-29:
parler.com -> AS16509 AMAZON, plus Microsoft email, plus Vercel
netflix.com -> AS40027 NETFLIX (their own Open Connect edge), NOT AWS
signal.org -> Cloudflare CDN, Google touchpoints
bigtech.sucks-> AS16509 AMAZON (GoDaddy parking sits on AWS)
That netflix result is the important one. The front door is Netflix's own network;
the catalog and user data are in AWS. Edge ASN is not backend custody, and the tool
says so in its own header comment rather than pretending otherwise.
Also:
- The list is now the front door (public/index.html, generated from the DB).
The game moved to /game.html and keeps working, ready for its own subdomain.
- suggestion table + v_requested view: anyone can ask for a product to be rated,
no account, no email. Optional contact. Addresses are salted-hashed, never stored.
- POST /api/suggest on the existing server package, with a graceful fallback on the
static page to a Forgejo issue so requests are never lost when the server is down.
Christian: 'Let's have every NextCloud thing come back as well-rated as it
should be. It's deserving of the same level of scrutiny everybody else is.'
Priority 20, above Slack and Kino, because this is the replacement we recommend
to clients. If we will not grade our own recommendation, nothing else we publish
is worth reading.
14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck,
Office, Passwords, the spreed signaling stack, and both migration bridges
(Dropbox, Google Drive). The migration apps matter most, because a migration
tool that does not work makes the off-ramp a slogan.
Nextcloud Server is the one to grade first. Every app score is conditioned on the
platform underneath it, so grading the apps before the server would be measuring
the second thing.
None of these has a score yet, and none will get one until it has evidence. The
recently-added attestation ladder and the reproducible-build cap both apply:
Nextcloud is open source but has no reproducible build practice yet, so
verifiability cannot exceed 3 on any of these today no matter how good the code
is.
The site is now a view over bigtech.db, not a hand-maintained set of pages.
- packages/core/db/render.mjs emits report/<product>.html and method.html into
web/public, so Vite copies them into the deployable bundle. Re-running
db:build regenerates them from whatever the database currently says.
- The report page leads with the score, then the dimension table with the
weakest rung highlighted, then findings, then the evidence table with its
tiers, then what was not tested, then how to clone and re-run the audit.
- The method page publishes the eight weights, the evidence tiers, both caps
(reproducible builds and the closed-source ladder), the D1-D4 dynamic test,
and a plain section on what the method cannot do.
Deployable bundle is 372K: the game, the method, the oath, the catalog and the
report. No server-side code, so it can sit on a Caddy static root and be nobody
else's problem to host.
Rendered 1 report page + method.html. All instrument checks still pass.
Christian: 'The goal is not to hamstring closed source developers. It's just to
validate clean code.'
Right. So the cap is a rung, not a wall, and it now says so.
L0 unattested -> 3 nothing but your word
L1 declared -> 5 SBOM + signed hash + published destination allowlist
L2 observed -> 7 someone other than you watched this exact binary
L3 reproducible -> 9 anyone can rebuild it and get the same bytes
L4 contested -> 10 someone tried to break it and published the attempt
A court filing lifts the ceiling entirely, because it needs no vendor cooperation.
db/attest/validate.mjs computes the level from which artifacts exist. A vendor
cannot claim one. The load-bearing rule is the attestor column:
a vendor running our harness produces a DECLARATION, not an OBSERVATION.
Verified against three cases. A vendor claiming L2 with their own capture report
is downgraded to L1 and fails validation. The same artifacts with us as attestor
grant L2. A broken rebuild claim never reaches L3.
Levels 3 and 4 survive a self-run on purpose: a public rebuild recipe and a
published adversarial review can be re-executed or re-read by anyone, so who
pressed the button stops mattering.
Honest limit, written into the module: this cannot prove the absence of a
backdoor. Rice's theorem makes that undecidable, and a backdoor triggered by
remote config or message content is invisible to static inspection. An
attestation raises the cost and shortens the shelf life. It is not a proof.
Christian: 'If we can give it a higher rating or if we can dispel rumors, then we
need to make that part of our first post.'
Discipline first: debunking a rumor must not buy score, or the instrument
becomes a PR department with a database attached.
What the rumors actually did was correct one under-informed dimension.
- incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented
phishing campaign. FBI/CISA PSA260626 says plainly that the app and its
encryption were not compromised, Signal published a precise correction within
days and shipped linkage confirmations by 2026-05-13. Fast, accurate,
independently corroborated.
- Total 75.9 -> 76.4. Half a point. That is the correct size.
- Everything else was already priced in: the OTF funding was already docked under
ownership, the phone number already docked under user control.
Evidence rows added for the FBI advisory, Signal's statement, the itemised
,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments.
The recompute gate verified 76.4 from the weights and scores, not from trust.
Christian, 2026-10-29: 'Closed source software, you have no idea. And then all
we have is reputation. So you kind of start with one arm or two arms tied
behind your back.'
That is now arithmetic instead of an opinion.
- assessment.source_available: 1 = we can read the code, 0 = we cannot.
- Closed source cannot exceed 5 on ANY dimension without tier-1 or tier-2
evidence of kind 'capture' or 'filing'. Reputation is tier 3, and tier 3 is
not a measurement. The build fails if a closed-source score breaks the rule.
- Verifiability still caps at 3 with no reproducible build.
Practical ceiling for closed source: 86/100 in theory, if every dimension is
backed by a capture or a court filing. In practice it is a fight for a C.
- product.priority puts a human's ask ahead of a crawler's discovery.
- v_backlog orders by priority, then measured usage.
- migrate(): the database authors itself, so it must survive its own schema
changes. Add columns, drop views, let schema.sql recreate them. Never drop
and rebuild, which would destroy the self-authored roster.
On the board: Slack (closed, capped) and Kino (closed, capped, founders call
2026-10-30 17:00). Neither is scored. Neither gets a number until it has
evidence.
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
The database is the source of truth; the site is a view over it.
- packages/core/db/schema.sql: vendors, products, categories, the 8-dimension
instrument, assessments, scores, evidence, findings, off-ramp, plus the
derived v_product_score view the game reads.
- packages/core/db/build.mjs: rebuilds bigtech.db, absorbs the legacy 43-product
roster as unassessed, applies seeds, then verifies the instrument's own rules
(weights sum to 100, totals recompute, grades match bands, every score has a
rationale, no tier-4 evidence on a scored dimension, reproducible-build caps
actually enforced).
- packages/core/db/seed/0001-signal.sql: Signal Desktop 8.36.0-alpha.1 on linux,
75.9/100 grade B, weakest dimension local_data_exposure. Evidence points at
the re-runnable audit artifacts in the Servetus vault.
- packages/core/src/data/generated/catalog.{ts,json}: generated export.
Verified: 44 products, 1 assessed, all checks pass.
