Research
Research
Things we measured ourselves, published as statistics with the method and the limits attached. The numbers are recomputed by a script each time rather than typed, so the page and the run cannot disagree.
- Research · 8 min · updated 30 August 2026The invisible business problemWe surveyed 9,779 Pune businesses recorded in OpenStreetMap and checked every website on record. 82.1% have no independent web presence at all, and 10.1% own a website. Of the whole survey, 4.9% had a site that was working and current.
- Research · 6 min · updated 26 August 2026What ambitious websites weighWe weighed 33 websites captured as design references: heavy 3D, WebGL, scroll-driven motion. The median ships 11.8 megabytes and nine of the 33 exceed 20. This is a selected set and not a sample of the web, so the figures describe the ambitious end of it and nothing else.
- Research · 9 min · updated 3 September 2026What we found auditing our own siteWe measured our own published content instead of writing about content decay in general. Ten pages carried money figures with no source, and the first count said seventy because the scanner was counting ordinary words as prices. Fifty-eight of 209 titles were too long to display. None of it was visible without a script.
- Research · 7 min · updated 3 September 2026What local business domains leave openWe queried the DNS of 836 business domains from a Pune survey. 83 no longer resolve at all. Of the 569 that accept mail, only 182 publish a DMARC policy that tells a receiver to do anything about a forgery.
- Research · 7 min · updated 3 September 2026When the measurement is the bugOver one fortnight, five of our own automated checks were wrong. One counted ordinary words as prices and reported six times the problem that existed. One reported a live page as dead. One could not fail at all. Every one of them failed in the direction that looks like diligence.
- Research · 6 min · updated 24 August 2026An overwrite that was a createA rule in our own code said clients could never modify an uploaded file. It never ran. Cloud Storage evaluates an upload over an existing object as a create, not an update, so the person being audited could quietly replace their own submitted attachment. Found by a test's first run.
- Research · 6 min · updated 24 August 2026A rate limiter one header could defeatOur public endpoints were rate limited per IP, and the IP came from a header the caller controls. Sending a different value each time bought a fresh budget each time. We added a second limit that nothing in a request can influence, and left the first one spoofable on purpose.
- Research · 5 min · updated 24 August 2026An id that could collideWe build a document id by joining a user id, a policy slug and a version with underscores. That is ambiguous: two different triples can flatten to the same string. It cannot happen with our current inputs, and we rejected it anyway, because the id is the only uniqueness constraint there is.