Christian: 'drop any URL and say tell me where Big Tech has its hooks... we're
not just rating software, we're rating software as a service.'
db/hooks/probe.mjs answers that from public records only: DNS, MX, SPF, ASN via
Team Cymru, HTTP headers, and the third-party hosts named in the page's own HTML.
Nothing is scanned. If a site tells the world it sends mail through Google, this
reads it.
Verified live, 2026-10-29:
parler.com -> AS16509 AMAZON, plus Microsoft email, plus Vercel
netflix.com -> AS40027 NETFLIX (their own Open Connect edge), NOT AWS
signal.org -> Cloudflare CDN, Google touchpoints
bigtech.sucks-> AS16509 AMAZON (GoDaddy parking sits on AWS)
That netflix result is the important one. The front door is Netflix's own network;
the catalog and user data are in AWS. Edge ASN is not backend custody, and the tool
says so in its own header comment rather than pretending otherwise.
Also:
- The list is now the front door (public/index.html, generated from the DB).
The game moved to /game.html and keeps working, ready for its own subdomain.
- suggestion table + v_requested view: anyone can ask for a product to be rated,
no account, no email. Optional contact. Addresses are salted-hashed, never stored.
- POST /api/suggest on the existing server package, with a graceful fallback on the
static page to a Forgejo issue so requests are never lost when the server is down.
The site is now a view over bigtech.db, not a hand-maintained set of pages.
- packages/core/db/render.mjs emits report/<product>.html and method.html into
web/public, so Vite copies them into the deployable bundle. Re-running
db:build regenerates them from whatever the database currently says.
- The report page leads with the score, then the dimension table with the
weakest rung highlighted, then findings, then the evidence table with its
tiers, then what was not tested, then how to clone and re-run the audit.
- The method page publishes the eight weights, the evidence tiers, both caps
(reproducible builds and the closed-source ladder), the D1-D4 dynamic test,
and a plain section on what the method cannot do.
Deployable bundle is 372K: the game, the method, the oath, the catalog and the
report. No server-side code, so it can sit on a Caddy static root and be nobody
else's problem to host.
Rendered 1 report page + method.html. All instrument checks still pass.
