d433a0e75e
The roster writes itself. The scores do not. - db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by stars (usage); Flathub is a curated store of end-user Linux apps, so relevance is free there and has to be earned on GitHub. - db/ingest/run.mjs: discovers into the roster as unassessed products, never as scores. Every discovery leaves a receipt (source, url, usage metric, timestamp) so a reader can see where a product came from and why it ranks. - LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top because brokers are highly starred and are not things people install. - build.mjs no longer wipes the database. The DB authors itself, so a rebuild would have thrown the roster away. --fresh is now explicit. - v_backlog view: what to assess next, ordered by measured usage. - packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest, bound to a SHA-256 of catalog.json. The page recomputes the digest in the browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration. Roster now 122 products, 1 assessed. All instrument checks pass.
2947 lines
No EOL
78 KiB
JSON
2947 lines
No EOL
78 KiB
JSON
{
|
|
"generated_at": "2026-10-29T18:23:54.071Z",
|
|
"method_version": "btr-0.1",
|
|
"dimensions": [
|
|
{
|
|
"id": "telemetry_egress",
|
|
"label": "Telemetry and egress",
|
|
"weight": 25,
|
|
"anchor_10": "Published destination allowlist; cold idle produces zero unlisted packets, independently confirmed.",
|
|
"anchor_0": "Covert collection, or egress that cannot be enumerated."
|
|
},
|
|
{
|
|
"id": "verifiability",
|
|
"label": "Verifiability",
|
|
"weight": 20,
|
|
"anchor_10": "Reproducible build verified on the scored platform.",
|
|
"anchor_0": "Closed source, or no way to prove the binary matches the source."
|
|
},
|
|
{
|
|
"id": "server_retention",
|
|
"label": "Server-side retention",
|
|
"weight": 15,
|
|
"anchor_10": "Subpoena answer is two timestamps or an empty set.",
|
|
"anchor_0": "Content readable by the vendor."
|
|
},
|
|
{
|
|
"id": "ownership_jurisdiction",
|
|
"label": "Ownership, jurisdiction, business model",
|
|
"weight": 12,
|
|
"anchor_10": "Nonprofit or cooperative, no ad model, strong process protections.",
|
|
"anchor_0": "State-controlled."
|
|
},
|
|
{
|
|
"id": "local_data_exposure",
|
|
"label": "Local data exposure",
|
|
"weight": 10,
|
|
"anchor_10": "All artifacts encrypted at rest under a user-presence key.",
|
|
"anchor_0": "Everything plaintext on disk."
|
|
},
|
|
{
|
|
"id": "dependency_surface",
|
|
"label": "Dependency surface",
|
|
"weight": 8,
|
|
"anchor_10": "Small audited dependency tree, signed and pinned update channel.",
|
|
"anchor_0": "Huge unaudited tree, unsigned updates."
|
|
},
|
|
{
|
|
"id": "user_control_exit",
|
|
"label": "User control and exit",
|
|
"weight": 5,
|
|
"anchor_10": "Usable export, real deletion, no identity hostage-taking.",
|
|
"anchor_0": "No export, deletion that does not delete."
|
|
},
|
|
{
|
|
"id": "incident_record",
|
|
"label": "Incident record",
|
|
"weight": 5,
|
|
"anchor_10": "Flaws found, disclosed honestly, fixed fast.",
|
|
"anchor_0": "Unblemished only because nobody is allowed to test it."
|
|
}
|
|
],
|
|
"products": [
|
|
{
|
|
"id": "alpaca",
|
|
"name": "Alpaca",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "ai",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "chatgpt",
|
|
"name": "ChatGPT",
|
|
"platform": "web",
|
|
"category_id": "ai",
|
|
"vendor_id": "openai",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_chatgpt",
|
|
"monthly_cost": 20,
|
|
"vendor": "OpenAI",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "mixed",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "chatqt",
|
|
"name": "ChatQT",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "ai",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "gpt4all",
|
|
"name": "GPT4ALL",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "ai",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "gai",
|
|
"name": "Gai",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "ai",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "gemini",
|
|
"name": "Google Gemini",
|
|
"platform": "web",
|
|
"category_id": "ai",
|
|
"vendor_id": "google",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_gemini",
|
|
"monthly_cost": 0,
|
|
"vendor": "Google LLC",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "lm-studio",
|
|
"name": "LM Studio",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "ai",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "mindmate",
|
|
"name": "MindMate",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "ai",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "moose",
|
|
"name": "Moose",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "ai",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "reins-chat-for-ollama",
|
|
"name": "Reins: Chat for Ollama",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "ai",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "tarotcaster",
|
|
"name": "TarotCaster",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "ai",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "writing-tools",
|
|
"name": "Writing Tools",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "ai",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "chromium-web-browser",
|
|
"name": "Chromium Web Browser",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "browser",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "firedragon",
|
|
"name": "FireDragon",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "browser",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "firefox",
|
|
"name": "Firefox",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "browser",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "chrome",
|
|
"name": "Google Chrome",
|
|
"platform": "web",
|
|
"category_id": "browser",
|
|
"vendor_id": "google",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_chrome",
|
|
"monthly_cost": 0,
|
|
"vendor": "Google LLC",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "librewolf",
|
|
"name": "LibreWolf",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "browser",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "microsoft-edge",
|
|
"name": "Microsoft Edge",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "browser",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "mullvad-browser",
|
|
"name": "Mullvad Browser",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "browser",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "waterfox",
|
|
"name": "Waterfox",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "browser",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "web",
|
|
"name": "Web",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "browser",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "web-apps",
|
|
"name": "Web Apps",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "browser",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "yandex-browser",
|
|
"name": "Yandex Browser",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "browser",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "google-calendar",
|
|
"name": "Google Calendar",
|
|
"platform": "web",
|
|
"category_id": "calendar",
|
|
"vendor_id": "google",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_google_calendar",
|
|
"monthly_cost": 0,
|
|
"vendor": "Google LLC",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "salesforce",
|
|
"name": "Salesforce",
|
|
"platform": "web",
|
|
"category_id": "crm",
|
|
"vendor_id": "salesforce",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_salesforce",
|
|
"monthly_cost": 25,
|
|
"vendor": "Salesforce, Inc.",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "github",
|
|
"name": "GitHub",
|
|
"platform": "web",
|
|
"category_id": "dev",
|
|
"vendor_id": "microsoft",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_github",
|
|
"monthly_cost": 0,
|
|
"vendor": "Microsoft Corporation",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "mixed",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "vercel",
|
|
"name": "Vercel",
|
|
"platform": "web",
|
|
"category_id": "dev",
|
|
"vendor_id": "vercel",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_vercel",
|
|
"monthly_cost": 20,
|
|
"vendor": "Vercel Inc.",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "aerion",
|
|
"name": "Aerion",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "betterbird",
|
|
"name": "Betterbird",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "convey",
|
|
"name": "Convey",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "geary",
|
|
"name": "Geary",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "gmail",
|
|
"name": "Gmail",
|
|
"platform": "web",
|
|
"category_id": "email",
|
|
"vendor_id": "google",
|
|
"sovereign": 0,
|
|
"boss": 1,
|
|
"art_slot": "outlaw_gmail",
|
|
"monthly_cost": 0,
|
|
"vendor": "Google LLC",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "kanmail",
|
|
"name": "Kanmail",
|
|
"platform": "source",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "mail",
|
|
"name": "Mail",
|
|
"platform": "source",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "mailspring",
|
|
"name": "Mailspring",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "meli",
|
|
"name": "Meli",
|
|
"platform": "source",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "meron",
|
|
"name": "Meron",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "outlook",
|
|
"name": "Outlook",
|
|
"platform": "web",
|
|
"category_id": "email",
|
|
"vendor_id": "microsoft",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_outlook",
|
|
"monthly_cost": 0,
|
|
"vendor": "Microsoft Corporation",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "mixed",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "protonmail",
|
|
"name": "Proton Mail",
|
|
"platform": "web",
|
|
"category_id": "email",
|
|
"vendor_id": "proton",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_protonmail",
|
|
"monthly_cost": 5,
|
|
"vendor": "Proton AG",
|
|
"entity_type": "private",
|
|
"jurisdiction": "CH",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "thunderbird",
|
|
"name": "Thunderbird",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "thunderbird-esr",
|
|
"name": "Thunderbird ESR",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "tuta-experimental",
|
|
"name": "Tuta (Experimental)",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "email",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "dropbox",
|
|
"name": "Dropbox",
|
|
"platform": "web",
|
|
"category_id": "files",
|
|
"vendor_id": "dropbox",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_dropbox",
|
|
"monthly_cost": 12,
|
|
"vendor": "Dropbox, Inc.",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "google-drive",
|
|
"name": "Google Drive",
|
|
"platform": "web",
|
|
"category_id": "files",
|
|
"vendor_id": "google",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_google_drive",
|
|
"monthly_cost": 3,
|
|
"vendor": "Google LLC",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "lazyrsync",
|
|
"name": "Lazyrsync",
|
|
"platform": "source",
|
|
"category_id": "files",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "nextcloud",
|
|
"name": "Nextcloud (self-hosted)",
|
|
"platform": "web",
|
|
"category_id": "files",
|
|
"vendor_id": "nextcloud-gmbh",
|
|
"sovereign": 1,
|
|
"boss": 0,
|
|
"art_slot": "ally_nextcloud",
|
|
"monthly_cost": 0,
|
|
"vendor": "Nextcloud GmbH",
|
|
"entity_type": "private",
|
|
"jurisdiction": "DE",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "ocis",
|
|
"name": "Ocis",
|
|
"platform": "source",
|
|
"category_id": "files",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "onedrive",
|
|
"name": "OneDrive",
|
|
"platform": "web",
|
|
"category_id": "files",
|
|
"vendor_id": "microsoft",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_onedrive",
|
|
"monthly_cost": 7,
|
|
"vendor": "Microsoft Corporation",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "mixed",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "oxicloud",
|
|
"name": "OxiCloud",
|
|
"platform": "source",
|
|
"category_id": "files",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "seafile",
|
|
"name": "Seafile",
|
|
"platform": "source",
|
|
"category_id": "files",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "syncthing-macos",
|
|
"name": "Syncthing Macos",
|
|
"platform": "source",
|
|
"category_id": "files",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "twentythreeandme",
|
|
"name": "23andMe",
|
|
"platform": "web",
|
|
"category_id": "health",
|
|
"vendor_id": "23andme",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_23andme",
|
|
"monthly_cost": 0,
|
|
"vendor": "23andMe Holding Co.",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "mixed",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "fitbit",
|
|
"name": "Fitbit",
|
|
"platform": "web",
|
|
"category_id": "health",
|
|
"vendor_id": "google",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_fitbit",
|
|
"monthly_cost": 10,
|
|
"vendor": "Google LLC",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "bitchat",
|
|
"name": "Bitchat",
|
|
"platform": "source",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "chat",
|
|
"name": "Chat",
|
|
"platform": "source",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "discord",
|
|
"name": "Discord",
|
|
"platform": "web",
|
|
"category_id": "messaging",
|
|
"vendor_id": "discord",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_discord",
|
|
"monthly_cost": 0,
|
|
"vendor": "Discord Inc.",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "flare",
|
|
"name": "Flare",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "fluxer",
|
|
"name": "Fluxer",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "gnunet-messenger",
|
|
"name": "GNUnet Messenger",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "gajim",
|
|
"name": "Gajim",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "kaidan",
|
|
"name": "Kaidan",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "karere",
|
|
"name": "Karere",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "lightning",
|
|
"name": "Lightning",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "mumble",
|
|
"name": "Mumble",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "parla",
|
|
"name": "Parla",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "signal-desktop",
|
|
"name": "Signal Desktop",
|
|
"platform": "linux-x86_64",
|
|
"category_id": "messaging",
|
|
"vendor_id": "signal-foundation",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_signal",
|
|
"monthly_cost": 0,
|
|
"vendor": "Signal",
|
|
"entity_type": "nonprofit",
|
|
"jurisdiction": "US",
|
|
"business_model": "none",
|
|
"weighted_total": 75.9,
|
|
"grade": "B",
|
|
"policy": 85,
|
|
"infra": 58,
|
|
"weakest_dimension": "local_data_exposure",
|
|
"headline": "The strongest transport on the internet, sitting behind the weakest desktop client we have scored.",
|
|
"assessed_on": "2026-10-29"
|
|
},
|
|
{
|
|
"id": "simplex-chat",
|
|
"name": "Simplex Chat",
|
|
"platform": "source",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "slack",
|
|
"name": "Slack",
|
|
"platform": "web",
|
|
"category_id": "messaging",
|
|
"vendor_id": "salesforce",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_slack",
|
|
"monthly_cost": 8,
|
|
"vendor": "Salesforce, Inc.",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "whatsie",
|
|
"name": "Whatsie",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "messaging",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "mint",
|
|
"name": "Mint (Intuit)",
|
|
"platform": "web",
|
|
"category_id": "money",
|
|
"vendor_id": "intuit",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_mint",
|
|
"monthly_cost": 0,
|
|
"vendor": "Intuit Inc.",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "plaid",
|
|
"name": "Plaid",
|
|
"platform": "web",
|
|
"category_id": "money",
|
|
"vendor_id": "plaid",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_plaid",
|
|
"monthly_cost": 0,
|
|
"vendor": "Plaid Inc.",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "mixed",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "beaver-notes",
|
|
"name": "Beaver Notes",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "notes",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "evernote",
|
|
"name": "Evernote",
|
|
"platform": "web",
|
|
"category_id": "notes",
|
|
"vendor_id": "evernote",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_evernote",
|
|
"monthly_cost": 8,
|
|
"vendor": "Evernote",
|
|
"entity_type": "private",
|
|
"jurisdiction": "IT",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "notes",
|
|
"name": "Notes",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "notes",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "notesnook",
|
|
"name": "Notesnook",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "notes",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "notion",
|
|
"name": "Notion",
|
|
"platform": "web",
|
|
"category_id": "notes",
|
|
"vendor_id": "notion",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_notion",
|
|
"monthly_cost": 10,
|
|
"vendor": "Notion Labs",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "obsidian-sync",
|
|
"name": "Obsidian Sync",
|
|
"platform": "web",
|
|
"category_id": "notes",
|
|
"vendor_id": "obsidian",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_obsidian_sync",
|
|
"monthly_cost": 5,
|
|
"vendor": "Dynalist Inc.",
|
|
"entity_type": "private",
|
|
"jurisdiction": "CA",
|
|
"business_model": "license",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "scrivano-for-handwritten-notes",
|
|
"name": "Scrivano for Handwritten Notes",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "notes",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "standard-notes",
|
|
"name": "Standard Notes",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "notes",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "sticky-notes",
|
|
"name": "Sticky Notes",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "notes",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "swifty-notes",
|
|
"name": "Swifty Notes",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "notes",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "trilium-notes",
|
|
"name": "Trilium Notes",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "notes",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "android",
|
|
"name": "Google Android",
|
|
"platform": "web",
|
|
"category_id": "os",
|
|
"vendor_id": "google",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_android",
|
|
"monthly_cost": 0,
|
|
"vendor": "Google LLC",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "windows",
|
|
"name": "Windows 11",
|
|
"platform": "web",
|
|
"category_id": "os",
|
|
"vendor_id": "microsoft",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_windows",
|
|
"monthly_cost": 0,
|
|
"vendor": "Microsoft Corporation",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "mixed",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "onepassword",
|
|
"name": "1Password",
|
|
"platform": "web",
|
|
"category_id": "passwords",
|
|
"vendor_id": "1password",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_1password",
|
|
"monthly_cost": 3,
|
|
"vendor": "AgileBits Inc.",
|
|
"entity_type": "private",
|
|
"jurisdiction": "CA",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "key-rack",
|
|
"name": "Key Rack",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "passwords",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "lastpass",
|
|
"name": "LastPass",
|
|
"platform": "web",
|
|
"category_id": "passwords",
|
|
"vendor_id": "lastpass",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_lastpass",
|
|
"monthly_cost": 3,
|
|
"vendor": "LastPass",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "nextcloud-password-client",
|
|
"name": "Nextcloud Password Client",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "passwords",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "nitrokey-app2",
|
|
"name": "Nitrokey App2",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "passwords",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "onekeepass",
|
|
"name": "OneKeePass",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "passwords",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "password",
|
|
"name": "Password",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "passwords",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "password-generator",
|
|
"name": "Password Generator",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "passwords",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "password-safe",
|
|
"name": "Password Safe",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "passwords",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "password-secure",
|
|
"name": "Password Secure",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "passwords",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "passwords-and-keys",
|
|
"name": "Passwords and Keys",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "passwords",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "proton-pass",
|
|
"name": "Proton Pass",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "passwords",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "a-photo-tool-libre",
|
|
"name": "A Photo Tool (Libre)",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "photos",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "camera",
|
|
"name": "Camera",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "photos",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "ente-photos",
|
|
"name": "Ente Photos",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "photos",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "gnu-image-manipulation-program",
|
|
"name": "GNU Image Manipulation Program",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "photos",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "google-photos",
|
|
"name": "Google Photos",
|
|
"platform": "web",
|
|
"category_id": "photos",
|
|
"vendor_id": "google",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_google_photos",
|
|
"monthly_cost": 3,
|
|
"vendor": "Google LLC",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "photocollage",
|
|
"name": "PhotoCollage",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "photos",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "photoqt",
|
|
"name": "PhotoQt",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "photos",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "photobooth",
|
|
"name": "Photobooth",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "photos",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "photoflare",
|
|
"name": "Photoflare",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "photos",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "photometry",
|
|
"name": "Photometry",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "photos",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "photos",
|
|
"name": "Photos",
|
|
"platform": "linux-flatpak",
|
|
"category_id": "photos",
|
|
"vendor_id": "unknown",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": null,
|
|
"monthly_cost": null,
|
|
"vendor": "Unknown vendor",
|
|
"entity_type": "unknown",
|
|
"jurisdiction": "unknown",
|
|
"business_model": "unknown",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "icloud-photos",
|
|
"name": "iCloud Photos",
|
|
"platform": "web",
|
|
"category_id": "photos",
|
|
"vendor_id": "apple",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_icloud_photos",
|
|
"monthly_cost": 3,
|
|
"vendor": "Apple Inc.",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "hardware",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "google-workspace",
|
|
"name": "Google Workspace",
|
|
"platform": "web",
|
|
"category_id": "productivity",
|
|
"vendor_id": "google",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_google_workspace",
|
|
"monthly_cost": 14,
|
|
"vendor": "Google LLC",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "microsoft-365",
|
|
"name": "Microsoft 365",
|
|
"platform": "web",
|
|
"category_id": "productivity",
|
|
"vendor_id": "microsoft",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_microsoft_365",
|
|
"monthly_cost": 13,
|
|
"vendor": "Microsoft Corporation",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "mixed",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "asana",
|
|
"name": "Asana",
|
|
"platform": "web",
|
|
"category_id": "project",
|
|
"vendor_id": "asana",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_asana",
|
|
"monthly_cost": 11,
|
|
"vendor": "Asana, Inc.",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "trello",
|
|
"name": "Trello",
|
|
"platform": "web",
|
|
"category_id": "project",
|
|
"vendor_id": "atlassian",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_trello",
|
|
"monthly_cost": 0,
|
|
"vendor": "Atlassian Corporation",
|
|
"entity_type": "public",
|
|
"jurisdiction": "AU",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "nest",
|
|
"name": "Google Nest",
|
|
"platform": "web",
|
|
"category_id": "smarthome",
|
|
"vendor_id": "google",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_nest",
|
|
"monthly_cost": 0,
|
|
"vendor": "Google LLC",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "ring",
|
|
"name": "Ring (Amazon)",
|
|
"platform": "web",
|
|
"category_id": "smarthome",
|
|
"vendor_id": "amazon",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_ring",
|
|
"monthly_cost": 0,
|
|
"vendor": "Amazon.com, Inc.",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "mixed",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "facebook",
|
|
"name": "Facebook",
|
|
"platform": "web",
|
|
"category_id": "social",
|
|
"vendor_id": "meta",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_facebook",
|
|
"monthly_cost": 0,
|
|
"vendor": "Meta Platforms",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "twitter",
|
|
"name": "X (Twitter)",
|
|
"platform": "web",
|
|
"category_id": "social",
|
|
"vendor_id": "x-corp",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_twitter",
|
|
"monthly_cost": 0,
|
|
"vendor": "X Corp.",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "advertising",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "netflix",
|
|
"name": "Netflix",
|
|
"platform": "web",
|
|
"category_id": "streaming",
|
|
"vendor_id": "netflix",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_netflix",
|
|
"monthly_cost": 16,
|
|
"vendor": "Netflix, Inc.",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "teams",
|
|
"name": "Microsoft Teams",
|
|
"platform": "web",
|
|
"category_id": "video",
|
|
"vendor_id": "microsoft",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_teams",
|
|
"monthly_cost": 0,
|
|
"vendor": "Microsoft Corporation",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "mixed",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "otter",
|
|
"name": "Otter.ai",
|
|
"platform": "web",
|
|
"category_id": "video",
|
|
"vendor_id": "otter",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_otter",
|
|
"monthly_cost": 17,
|
|
"vendor": "Otter.ai",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "zoom",
|
|
"name": "Zoom",
|
|
"platform": "web",
|
|
"category_id": "video",
|
|
"vendor_id": "zoom",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_zoom",
|
|
"monthly_cost": 16,
|
|
"vendor": "Zoom Communications",
|
|
"entity_type": "public",
|
|
"jurisdiction": "US",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "whisper-api",
|
|
"name": "OpenAI Whisper API",
|
|
"platform": "web",
|
|
"category_id": "voice",
|
|
"vendor_id": "openai",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_whisper_api",
|
|
"monthly_cost": 0,
|
|
"vendor": "OpenAI",
|
|
"entity_type": "private",
|
|
"jurisdiction": "US",
|
|
"business_model": "mixed",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
},
|
|
{
|
|
"id": "nordvpn",
|
|
"name": "NordVPN",
|
|
"platform": "web",
|
|
"category_id": "vpn",
|
|
"vendor_id": "nord-security",
|
|
"sovereign": 0,
|
|
"boss": 0,
|
|
"art_slot": "outlaw_nordvpn",
|
|
"monthly_cost": 4,
|
|
"vendor": "Nord Security",
|
|
"entity_type": "private",
|
|
"jurisdiction": "PA",
|
|
"business_model": "subscription",
|
|
"weighted_total": null,
|
|
"grade": null,
|
|
"policy": null,
|
|
"infra": null,
|
|
"weakest_dimension": null,
|
|
"headline": null,
|
|
"assessed_on": null
|
|
}
|
|
],
|
|
"assessments": [
|
|
{
|
|
"id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"product_id": "signal-desktop",
|
|
"version": "8.36.0-alpha.1",
|
|
"source_commit": "5dad34ad5ea1a5b6229412e5c8ac0a696ff7532d",
|
|
"assessed_on": "2026-10-29",
|
|
"method_version": "btr-0.1",
|
|
"reproducible_build": 1,
|
|
"weighted_total": 75.9,
|
|
"grade": "B",
|
|
"weakest_dimension": "local_data_exposure",
|
|
"headline": "The strongest transport on the internet, sitting behind the weakest desktop client we have scored.",
|
|
"not_tested": "No live account was used. No packet capture was run (D1 to D4 not executed, this is a source audit only). Android and iOS clients not assessed. No attempt to verify the shipped .deb against a local rebuild."
|
|
}
|
|
],
|
|
"scores": [
|
|
{
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "telemetry_egress",
|
|
"value": 9,
|
|
"rationale": "Zero analytics packages across 224 dependencies. Crash reporter started with uploadToServer:false. Only signal.org, support.signal.org, updates*.signal.org and sfu.voip.signal.org appear in source. Docked one point for update checks on launch and the megaphone channel, neither of which is telemetry but both of which are vendor-initiated contact.",
|
|
"label": "Telemetry and egress",
|
|
"weight": 25
|
|
},
|
|
{
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "verifiability",
|
|
"value": 6,
|
|
"rationale": "Fully open source. Reproducible builds exist for Linux only, via Docker, and Signal labels them experimental and possibly non-functioning on public releases. macOS and Windows have none. Capped at 6 by the instrument rule.",
|
|
"label": "Verifiability",
|
|
"weight": 20
|
|
},
|
|
{
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "server_retention",
|
|
"value": 10,
|
|
"rationale": "The published answer to a 2021 federal grand jury subpoena was registration date and last connection date. No messages, contacts, groups, profile or avatar exist server-side to hand over.",
|
|
"label": "Server-side retention",
|
|
"weight": 15
|
|
},
|
|
{
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "ownership_jurisdiction",
|
|
"value": 8,
|
|
"rationale": "501(c)(3) nonprofit, EIN 82-4506840, no advertising and no data sale, so the incentive to surveil is absent rather than merely restrained. Docked for US jurisdiction and for early Open Technology Fund grant funding.",
|
|
"label": "Ownership, jurisdiction, business model",
|
|
"weight": 12
|
|
},
|
|
{
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "local_data_exposure",
|
|
"value": 5,
|
|
"rationale": "Received attachments are stored unencrypted at ~/.config/Signal/attachments.noindex (CVE-2023-24069). The SQLCipher key lives in gnome-keyring, so anything running as the user can read db.sqlite. On this operator machine that means every agent process.",
|
|
"label": "Local data exposure",
|
|
"weight": 10
|
|
},
|
|
{
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "dependency_surface",
|
|
"value": 6,
|
|
"rationale": "224 dependencies, Electron 45.0.0 pinned. Electron has produced CVEs enabling persistent backdoors in exactly this class of app. Update channel is a signed apt repo, which is the good part.",
|
|
"label": "Dependency surface",
|
|
"weight": 8
|
|
},
|
|
{
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "user_control_exit",
|
|
"value": 7,
|
|
"rationale": "Registration still requires a phone number, though usernames and phone-number privacy now reduce the exposure. No practical encrypted export of message history in a portable format.",
|
|
"label": "User control and exit",
|
|
"weight": 5
|
|
},
|
|
{
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "incident_record",
|
|
"value": 7,
|
|
"rationale": "Roughly 15 CVEs under the signal vendor entry. The 2023 local-storage flaws were acknowledged and fixed in 6.2.0. Signal is under continuous scrutiny, which is a better position than an untested clean record.",
|
|
"label": "Incident record",
|
|
"weight": 5
|
|
}
|
|
],
|
|
"evidence": [
|
|
{
|
|
"id": 8,
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "local_data_exposure",
|
|
"claim": "Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.",
|
|
"tier": 1,
|
|
"kind": "source",
|
|
"artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/01-capture-sites.txt",
|
|
"sha256": null,
|
|
"observed_at": "2026-10-29T13:13:56-05:00"
|
|
},
|
|
{
|
|
"id": 9,
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "telemetry_egress",
|
|
"claim": "Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.",
|
|
"tier": 1,
|
|
"kind": "source",
|
|
"artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/02-permissions.txt",
|
|
"sha256": "0a64f213f3c241c1211dec56c0018d9220651c2550a7cf44609d586e74369cf2",
|
|
"observed_at": "2026-10-29T13:13:56-05:00"
|
|
},
|
|
{
|
|
"id": 10,
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "telemetry_egress",
|
|
"claim": "Zero analytics, tracker or crash-upload dependencies across 224 packages.",
|
|
"tier": 1,
|
|
"kind": "source",
|
|
"artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/05-dependencies.txt",
|
|
"sha256": null,
|
|
"observed_at": "2026-10-29T13:13:56-05:00"
|
|
},
|
|
{
|
|
"id": 11,
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "telemetry_egress",
|
|
"claim": "Only two audio capture call sites exist and both are reachable only from an explicit UI action.",
|
|
"tier": 1,
|
|
"kind": "source",
|
|
"artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/03-call-path.txt",
|
|
"sha256": null,
|
|
"observed_at": "2026-10-29T13:13:56-05:00"
|
|
},
|
|
{
|
|
"id": 12,
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "verifiability",
|
|
"claim": "Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.",
|
|
"tier": 2,
|
|
"kind": "record",
|
|
"artifact": "https://github.com/signalapp/Signal-Desktop/blob/main/reproducible-builds/README.md",
|
|
"sha256": null,
|
|
"observed_at": "2026-10-29T13:13:56-05:00"
|
|
},
|
|
{
|
|
"id": 13,
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "server_retention",
|
|
"claim": "Grand jury subpoena response returned two timestamps and nothing else.",
|
|
"tier": 2,
|
|
"kind": "filing",
|
|
"artifact": "https://signal.org/bigbrother/cd-california-grand-jury/",
|
|
"sha256": null,
|
|
"observed_at": "2026-10-29T13:13:56-05:00"
|
|
},
|
|
{
|
|
"id": 14,
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"dimension_id": "ownership_jurisdiction",
|
|
"claim": "Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.",
|
|
"tier": 2,
|
|
"kind": "record",
|
|
"artifact": "https://projects.propublica.org/nonprofits/organizations/824506840",
|
|
"sha256": null,
|
|
"observed_at": "2026-10-29T13:13:56-05:00"
|
|
}
|
|
],
|
|
"findings": [
|
|
{
|
|
"id": 5,
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"severity": "high",
|
|
"title": "Received attachments are stored unencrypted on disk",
|
|
"detail": "Every image and file received is readable by any process running as the user. On a machine running agent software under the same account, this is the most likely real-world exposure.",
|
|
"status": "by_design",
|
|
"cve": "CVE-2023-24069"
|
|
},
|
|
{
|
|
"id": 6,
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"severity": "medium",
|
|
"title": "No verified reproducible build for the Linux package",
|
|
"detail": "The source is auditable; the shipped binary is not yet provably the same artifact. Until this closes, a source audit is evidence about the repository, not about the running process.",
|
|
"status": "open",
|
|
"cve": null
|
|
},
|
|
{
|
|
"id": 7,
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"severity": "medium",
|
|
"title": "Local database key is held in the OS keyring",
|
|
"detail": "Any process running in the unlocked session can decrypt db.sqlite. There is no user-presence gate.",
|
|
"status": "accepted",
|
|
"cve": null
|
|
},
|
|
{
|
|
"id": 8,
|
|
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
|
"severity": "low",
|
|
"title": "Registration requires a phone number",
|
|
"detail": "Mitigated by usernames and phone-number privacy, but the account root remains a phone number.",
|
|
"status": "accepted",
|
|
"cve": null
|
|
}
|
|
]
|
|
} |