SECOND MEASUREMENTS

Rechecks

Each paper's check runs again on a schedule, and every result stays here. A claim that is still wrong months later reads differently from one that was fixed the week after we wrote.

Updated 2026-10-15 00:10 UTCSM-001, SM-009 and SM-011 daily, SM-005, SM-007 and SM-008 weekly, SM-006 monthly

SM-001 · Google's Pixel software ledger

Google says the log covers every factory image on its download page, from Pixel 6 on. Paper.

"Logged as generic" means filed under a label phones don't report, so a phone can't find its own entry. Missing is counted on full rechecks only.

SM-005 · Meta's private-AI log

Meta's whitepaper says the pulled-software list is published every 3 hours and server software is released weekly. Paper.

SM-006 · x402 payments on Base

One 24-hour count of payments, and the share sent by the two wallet groups. Paper.

Group shares come from 400 random blocks per day. Counts include every EIP-3009 transfer, so they are upper bounds on x402.

SM-007 · Docker Official Images signatures

Docker committed to signed SBOM and provenance attestations for all Official Images. Its old signing service shuts down on 8 December 2026. Paper.

Weekly: a random 300 image entries for coverage, 10 repositories for signatures (attestation envelope and referrers). The first row is the full census.

SM-008 · CISA’s answers on Linux kernel CVEs

CISA’s directive says it publishes three answers for every CVE. Kernel CVEs have had almost none since March. Paper.

Weekly: 30 random kernel CVEs and 30 others from the week ending two days before the check. The first row is the paper’s sample.

SM-009 · Firefox CRLite and the CAs’ revocation lists

The 465 revoked certificates from the paper, asked of each day’s Firefox filters. Mozilla says the missing ones appear in the next full filter. Paper.

Same certificates every day; the count falls as they expire. Snapshot is the full filter the deltas build on; the paper’s was 20260902-0.

SM-011 · How far behind the logs Firefox’s filter reads

From each day’s newest filter: the reader’s lag on the largest logs, and how many of the top 1,000 sites’ live certificates the filter covers. Paper.

Lag is measured from the run time to the coverage cutoff the filter states for that log. Certificates are fetched fresh each day, so the covered count moves as sites rotate certificates.

SM-012 · CCADB audit statements past the 92-day deadline

From each day’s CCADB export: standard audit statements on trusted records dated past 92 days, and included roots whose newest audit is more than 15 months old, per program. Paper.

Statement date is a floor on upload date, so “past 92 days” is a floor on lateness. Daily.

SM-013 · Federal .gov domains with DNSSEC

CISA’s registry, every domain asked for its DS record and a validated answer. Paper in review before publication.

Weekly. “Fail validation” counts domains a validating resolver refuses but answers with checking disabled.

SM-014 · Expired RPKI manifests

Read straight from each repository’s RRDP snapshot, no validator in between: manifests past nextUpdate, and how many lapsed in the last seven days. Paper in review before publication.

Daily. The “last 7 days” column is the live problem; the rest of registro.br’s and RIPE’s expired manifests are years old and outside any chain.

SM-015 · The browsers’ CT log lists

Apple’s list: version, last modified, and “usable” logs whose window has closed. Chrome’s: version, shards over a year, and the MMD it declares for RFC 6962 logs. Paper.

Daily. The day Apple’s Last-Modified changes, or Chrome’s list says 14400, the paper’s finding is closed and this table shows when.

SM-016 · Toxics Release Inventory, the 1 July deadline

Monthly: whether EPA has loaded any forms for the year whose deadline has passed, and for the newest loaded year, the forms and facilities postmarked after 1 July. Paper.

The day the pending year’s count leaves zero, its late forms start their clock here; the enforcement join reruns after each ECHO refresh.

SM-017 · Broadcast stations’ issues/programs lists

Quarterly, on the 14th of January, April, July and October: the FCC public file of every full-power and Class A TV station and every full-power FM and AM station, read the day after the list deadline. For the newest quarter: lists found, late, and stations with none yet. Paper.

Read the day after the deadline, “none found” still holds the late lists to come; the next quarter’s read fills them in. “Late by the tenth” counts against the rule’s plain date, before the weekend and holiday rollover.

SM-018 · CVE records against the CNA 72-hour rule

Monthly, on the first: the newest cvelistV5 midnight archive re-scored with the paper’s script. Records whose CNA cites its own site: late share overall and for the newest complete quarter, and the four named CNAs. Paper.

A quarter counts as closed when, a month or more after it ended, its late share for a named CNA sits near zero; an advisory that never gets a record never appears here.

Scripts: github.com/MarkovianProtocol/second-measurements/rechecks.