Second Measurements — Markovian Protocol

SM-021: Sent 19 Oct, awaiting reply

Mon, 19 Oct 2026 07:07:34 +0000

Claim: GitHub advisory review: docs say up to 72 hours; since April, 72.1% of reviewed advisories took longer

Found: 3,226 of 4,472 advisories published since April took longer than 72 hours to be reviewed (72.1%), median 8 days; January to March, 4.6%. Dependabot does not alert until review.

Status: Published 19 Oct; questions sent to the GitHub Advisory Database team 19 Oct (issue 10425); no reply yet

SM-021: Published 19 Oct; question to GitHub pending

Mon, 19 Oct 2026 07:03:32 +0000

Claim:

Found:

Status: Published 19 Oct; question to the GitHub Advisory Database team pending

SM-009: Closed 17 Oct

Mon, 19 Oct 2026 01:02:17 +0000

Claim: Mozilla: CRLite stores all certificate revocations locally; Firefox enforces it and skips the online check for what it doesn’t cover

Found: 38 of 465 current revocations missing; 37 of 108 among certificates revoked within a day of issuance, for up to 28 days

Status: Sent 2 Oct; Mozilla replied 5 Oct, 6 of 6 answered; gap closed in the 17 Oct full filter, on the date Mozilla gave

SM-017: Sent 14 Oct, awaiting reply

Wed, 14 Oct 2026 12:00:00 +0000

Claim: FCC public-file lists: one in ten late in 2025

Found: 6,177 of 59,982 lists late in 2025 across 18,041 stations; 3,329 over a month late.

Status: Published 10 Oct, updated 14 Oct; questions sent to the FCC 14 Oct; no reply yet

SM-019: Sent 13 Oct to six agencies, awaiting reply

Tue, 13 Oct 2026 12:00:00 +0000

Claim: Federal sub-awards reported late: GAO found 41% of non-pandemic, ours say 56.6%, state agencies carry three-quarters

Found: 1,202,449 of 2,125,343 sub-awards at or above the threshold late (56.6%), $809.5B net; state governments carry 76.9% of the late reports. Corrected 13 Oct.

Status: Published and corrected 13 Oct; questions sent to six agencies 13 Oct; no reply yet

SM-018: Sent to four CNAs 12 Oct and the CVE Secretariat 15 Oct, awaiting reply

Sun, 11 Oct 2026 12:00:00 +0000

Claim: CNA 72-hour rule: four CNAs late on two records in three

Found: 1,816 of 13,871 records late (13.1%). ZDI 77%, Dell 49%, Drupal 82%, Arista 86%; Microsoft 0.5%.

Status: Sent to four CNAs 12 Oct and the CVE Program Secretariat 15 Oct; no reply yet

SM-012: No reply; filed in Bugzilla 16 Oct

Sat, 03 Oct 2026 12:00:00 +0000

Claim: CCADB: CAs upload audit statements within 92 days; Microsoft: audits “on an annual basis”

Found: 11 of 119 statements past the deadline, 7 with nothing on file; 24 Microsoft-trusted roots with audits over 15 months old, one from 2019

Status: Sent to CCADB and Microsoft 3 Oct; no reply; filed in Bugzilla 16 Oct

SM-014: RIPE NCC replied 14 Oct; NIC.br awaited

Sat, 03 Oct 2026 12:00:00 +0000

Claim: RPKI: Brazil gives a member five days to fix a lapsed manifest; validators give zero

Found: 30 members lapsed in the week to 3 October; by 8 October 20 were deleted, 10 recovered. Validators drop a lapsed member’s authorisations in the first hour; RIPE’s service still carried 34 lapsed points under 18 CAs.

Status: Published 12 Oct; RIPE NCC answered 14 Oct; NIC.br awaited

SM-015: Apple fixed its list 15 Oct; Chrome awaited

Sat, 03 Oct 2026 12:00:00 +0000

Claim: Chrome CT policy: logs include within the MMD, RFC 6962 MMD at most 4 h, shard windows at most a year; Apple: “usable” logs can be relied on

Found: 64 of 64 logs inside their MMD, tiled ones under 6 s; Chrome’s list declares 24 h against a 4 h policy, admits four 380-day shards; Apple’s list marks 12 closed shards usable, untouched since March

Status: Sent 3 Oct; Apple fixed its list 15 Oct; Chrome asked again on ct-policy 16 Oct

SM-016: Sent 4 Oct, awaiting reply

Sat, 03 Oct 2026 12:00:00 +0000

Claim: Toxic-release reports: a thousand plants a year late, 61 EPA cases

Found: 5,964 of 473,709 forms over a year late; EPA actions fell from 52 a year to 16.

Status: Sent to EPA’s TRI Program 4 Oct; no reply yet

SM-007: No reply; data posted on Docker’s roadmap issue 16 Oct