bunkhouse/bigtech-sucks
7
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
The living database and website behind bigtech.sucks. Every score traces to a reproducible artifact.
9 commits 1 branch 0 tags 535 KiB
TypeScript 49.7%
HTML 24.3%
JavaScript 23.4%
CSS 2.6%
Find a file
CLU aafce7773b feat: the hook prober, and the list becomes the front door 
Christian: 'drop any URL and say tell me where Big Tech has its hooks... we're
not just rating software, we're rating software as a service.'

db/hooks/probe.mjs answers that from public records only: DNS, MX, SPF, ASN via
Team Cymru, HTTP headers, and the third-party hosts named in the page's own HTML.
Nothing is scanned. If a site tells the world it sends mail through Google, this
reads it.

Verified live, 2026-10-29:
  parler.com   -> AS16509 AMAZON, plus Microsoft email, plus Vercel
  netflix.com  -> AS40027 NETFLIX (their own Open Connect edge), NOT AWS
  signal.org   -> Cloudflare CDN, Google touchpoints
  bigtech.sucks-> AS16509 AMAZON (GoDaddy parking sits on AWS)

That netflix result is the important one. The front door is Netflix's own network;
the catalog and user data are in AWS. Edge ASN is not backend custody, and the tool
says so in its own header comment rather than pretending otherwise.

Also:
- The list is now the front door (public/index.html, generated from the DB).
  The game moved to /game.html and keeps working, ready for its own subdomain.
- suggestion table + v_requested view: anyone can ask for a product to be rated,
  no account, no email. Optional contact. Addresses are salted-hashed, never stored.
- POST /api/suggest on the existing server package, with a graceful fallback on the
  static page to a Forgejo issue so requests are never lost when the server is down.
2026-10-29 17:23:11 -05:00
deploy feat: the Nextcloud stack on the board, above everything else 2026-10-29 17:19:01 -05:00
packages feat: the hook prober, and the list becomes the front door 2026-10-29 17:23:11 -05:00
.gitignore bigtech.sucks: living database + first assessment 2026-10-29 13:16:29 -05:00
package-lock.json bigtech.sucks: living database + first assessment 2026-10-29 13:16:29 -05:00
package.json feat: render the public site from the database 2026-10-29 16:24:13 -05:00
README.md docs: document the living-database workflow and its enforced rules 2026-10-29 13:17:21 -05:00

README.md

bigtech.sucks — Draw the Line

V0.1 scaffold per master spec. A retro frontier game that scopes Big Tech exposure and sequences the off-ramp.

Structure

packages/
  core/     Render-agnostic game logic, seed data, scoring
  core/db/  The living database: schema, seeds, build + verify
  web/      React + Vite SPA (V1 funnel)
  server/   Minimal waitlist API (email + channel only)

The living database

The database is the source of truth. The site is a view over it. Nothing in the UI may hardcode a number that lives in bigtech.db.

npm run db:build     # rebuild the db, apply seeds, verify, regenerate the catalog
npm run db:verify    # run the instrument's own checks against the existing db

packages/core/db/bigtech.db is built, not committed. What is committed is the part that matters: db/schema.sql, db/seed/*.sql, and db/build.mjs.

The build refuses to pass if a score breaks the instrument's own rules:

  • dimension weights must sum to 100
  • every stored weighted_total must recompute from its scores
  • every grade must match its band
  • every score must carry a written rationale
  • no tier-4 claim may attach to a scored dimension
  • the reproducible-build caps are enforced, not documented: no reproducible build caps verifiability at 3, an experimental one at 6

A product with no assessment surfaces as unassessed. It is never given a guessed number. That is why the 43 legacy roster entries sit in the database as placeholders and exactly one product carries a real score.

Adding an assessment

  1. Write packages/core/db/seed/000N-<slug>.sql using the shape in 0001-signal.sql.
  2. Every score needs a rationale and at least three tier-1 or tier-2 evidence rows.
  3. npm run db:build. If it fails, the report is not ready to publish.

What the numbers mean

See the instrument spec. Scores are 0 to 100, and a weighted average is not the headline: the weakest dimension is, because a 90 with a 5 on local data exposure is a 90 that will leak.

Quick start

npm install
npm run build -w @bigtech-sucks/core
npm run dev          # web on :5173
npm run dev:server   # waitlist API on :3001

V1 flow

Welcome → Meet Red → Draw the Line → Overworld → Showdown → Homestead → Reveal (Binary Ranch) → Waitlist

Governance

  • Creative assets are candidates — director approval required before ship
  • Company name revealed only at homestead/reveal phase
  • §13 open decisions are not silently resolved (see packages/core/src/data/config.ts)
  • Client-side sovereignty report; server stores waitlist fields only

Roadmap

  • V1.5: Terminal/SSH render (Go + Charm)
  • V2: Concierge migration, journey chronicle, physical fulfillment (stubs in v2-stubs.ts)