# Quiet Failures

> Public security base rates measured across domains, packages, certificates and networks — 27 controls, sliced by country, company size, ecosystem and issuing CA. Passive and aggregate; measured since 2026-08-01. Licensed CC BY 4.0.

## Methodology

Aggregate-only — no individual company is ever named. Every figure carries a 95% Wilson confidence interval, and series are stepped at a population refresh rather than smoothed.

Sample floor: a slice is published only where it holds at least 100 measured members. Thinner slices are withheld rather than shown with a wide interval, so an absent country or CA means too little data, not zero failures.

Populations measured:
- domains — sampled from the Common Crawl web graph; email metrics use the MX-having subset, parked domains excluded
- domains attributed to companies — national registries (UK Companies House, Norway Brreg, France SIRENE) resolved to domains by a name heuristic, which is BIASED toward digitally mature firms; the unbiased global figure is always published alongside
- networks (ASNs) — those observed announcing a prefix in RIPE RIS
- packages — most-downloaded per ecosystem, plus a native-build stratum
- certificates — newly issued, read from Certificate Transparency logs

How each figure is obtained: domain metrics make one passive request per target (a DNS lookup, one TLS or SMTP handshake, or a single homepage GET). Network, package and certificate metrics contact NOTHING — they are built from public bulk feeds.

Cadence: every control is measured ONCE A WEEK, on a fixed weekday, and roughly a seventh of the corpus is measured each night. Controls sharing a day also share a probe and therefore an as-of date — the three certificate readings come from one TLS handshake, the four mail-transport readings from one SMTP handshake. Consequently figures for DIFFERENT controls can be up to six days apart; each dataset states its own measurement date, and that date is the one to cite.

Measurement days:
- Monday: dmarc-policy, mta-sts, spf-policy, tls-rpt
- Tuesday: caa, dnssec, ns-resilience
- Wednesday: cert-expiry, cert-trust, weak-crypto
- Thursday: https-redirect, security-headers, tls-legacy
- Friday: mx-dane, mx-rdns, mx-tls-cert, smtp-starttls
- Saturday: cert-lifetime-readiness, identity-federation, identity-platform, subdomain-exposure, subdomain-takeover
- Sunday: cert-validity-window, pkg-install-scripts, pkg-maintenance, pkg-provenance, rpki-roa-coverage

Two kinds of metric. Most report a failure rate. 2 are CONTEXT metrics (identity-federation, identity-platform) that describe a population's composition and have no failure rate — do not quote them as though a percentage were a defect.

## How to cite

Cite "Quiet Failures" (quietfailures.com), the dataset URL, and the measurement date. Append .json or .csv to any dataset page URL for machine-readable data; the .json also carries how the metric was measured and the stated limits of that measurement.

Full method per metric: https://github.com/sjzasada/quesvox/blob/main/data-plane/METRICS.md
Design decisions: https://github.com/sjzasada/quesvox/tree/main/decisions

## Datasets

### cert-governance
- [caa](https://quietfailures.com/datasets/caa) — measured over domains: Share of domains publishing no CAA record to restrict which certificate authorities may issue for them.
    - [What share of UK dormant companies have no CAA record?](https://quietfailures.com/datasets/caa/gb-dormant) — 100.0% (n=195); data: https://quietfailures.com/datasets/caa/gb-dormant.json
    - [What share of domains in South Africa have no CAA record?](https://quietfailures.com/datasets/caa/za) — 99.65% (n=289); data: https://quietfailures.com/datasets/caa/za.json
    - [What share of domains in Japan have no CAA record?](https://quietfailures.com/datasets/caa/jp) — 99.65% (n=288); data: https://quietfailures.com/datasets/caa/jp.json
- [cert-expiry](https://quietfailures.com/datasets/cert-expiry) — measured over domains: Share of web-serving domains whose TLS certificate expires within 30 days, or has already expired.
    - [What share of domains in Vietnam have a TLS certificate expiring within 30 days, or expired?](https://quietfailures.com/datasets/cert-expiry/vn) — 18.75% (n=128); data: https://quietfailures.com/datasets/cert-expiry/vn.json
    - [What share of domains in Russia have a TLS certificate expiring within 30 days, or expired?](https://quietfailures.com/datasets/cert-expiry/ru) — 15.23% (n=151); data: https://quietfailures.com/datasets/cert-expiry/ru.json
    - [What share of domains in Austria have a TLS certificate expiring within 30 days, or expired?](https://quietfailures.com/datasets/cert-expiry/at) — 10.78% (n=269); data: https://quietfailures.com/datasets/cert-expiry/at.json
- [cert-lifetime-readiness](https://quietfailures.com/datasets/cert-lifetime-readiness) — measured over domains: Share of certificates issued for longer than the 47-day maximum lifetime.
    - [What share of domains in South Korea have certificates issued for longer than the 47-day maximum?](https://quietfailures.com/datasets/cert-lifetime-readiness/kr) — 62.58% (n=155); data: https://quietfailures.com/datasets/cert-lifetime-readiness/kr.json
    - [What share of domains in Germany have certificates issued for longer than the 47-day maximum?](https://quietfailures.com/datasets/cert-lifetime-readiness/de) — 41.98% (n=262); data: https://quietfailures.com/datasets/cert-lifetime-readiness/de.json
    - [What share of domains in Italy have certificates issued for longer than the 47-day maximum?](https://quietfailures.com/datasets/cert-lifetime-readiness/it) — 35.81% (n=229); data: https://quietfailures.com/datasets/cert-lifetime-readiness/it.json
- [cert-trust](https://quietfailures.com/datasets/cert-trust) — measured over domains: Share of certificates that are self-signed or not valid for the hostname served.
    - [What share of domains in South Korea have a certificate that is self-signed or invalid for its hostname?](https://quietfailures.com/datasets/cert-trust/kr) — 34.78% (n=161); data: https://quietfailures.com/datasets/cert-trust/kr.json
    - [What share of domains in Slovakia have a certificate that is self-signed or invalid for its hostname?](https://quietfailures.com/datasets/cert-trust/sk) — 16.84% (n=291); data: https://quietfailures.com/datasets/cert-trust/sk.json
    - [What share of France medium companies have a certificate that is self-signed or invalid for its hostname?](https://quietfailures.com/datasets/cert-trust/fr-medium) — 16.15% (n=130); data: https://quietfailures.com/datasets/cert-trust/fr-medium.json
- [cert-validity-window](https://quietfailures.com/datasets/cert-validity-window) — measured over certificates: Share of newly issued certificates with a validity window longer than the 47-day maximum the CA/Browser Forum is phasing in — renewals that must be automated before the deadline.
    - limits: Measured over a sample of recent issuance, so it reflects current practice rather than the installed base. The 47-day threshold was chosen after a 100-day cut returned 0% everywhere — issuance had already moved below it, leaving no variance to observe.
    - [What share of certificates issued by GoDaddy.com have a validity window longer than the 47-day maximum being phased in?](https://quietfailures.com/datasets/cert-validity-window/ca-godaddy-com) — 100.0% (n=181); data: https://quietfailures.com/datasets/cert-validity-window/ca-godaddy-com.json
    - [What share of certificates issued by ZeroSSL GmbH have a validity window longer than the 47-day maximum being phased in?](https://quietfailures.com/datasets/cert-validity-window/ca-zerossl-gmbh) — 100.0% (n=121); data: https://quietfailures.com/datasets/cert-validity-window/ca-zerossl-gmbh.json
    - [What share of certificates issued by Google Trust Services have a validity window longer than the 47-day maximum being phased in?](https://quietfailures.com/datasets/cert-validity-window/ca-google-trust-services) — 99.41% (n=3238); data: https://quietfailures.com/datasets/cert-validity-window/ca-google-trust-services.json
- [weak-crypto](https://quietfailures.com/datasets/weak-crypto) — measured over domains: Share of certificates using a weak key or signature (SHA-1, or a sub-2048-bit RSA key).
    - limits: **the rule must key on the algorithm, not the number.** `< 2048 bits` is weak only for **RSA**; EC keys are strong at 256/384/521 bits, and the `signature_algorithm` field describes the *issuer's* signature, not the subject key. Getting this wrong produced a false 30% weak rate before it was fixed — the canonical example of a wrong-rule bug in this project.
    - [What share of domains in South Korea have a certificate with a weak key or signature (SHA-1 or sub-2048-bit RSA)?](https://quietfailures.com/datasets/weak-crypto/kr) — 18.06% (n=144); data: https://quietfailures.com/datasets/weak-crypto/kr.json
    - [What share of domains in Ukraine have a certificate with a weak key or signature (SHA-1 or sub-2048-bit RSA)?](https://quietfailures.com/datasets/weak-crypto/ua) — 2.44% (n=205); data: https://quietfailures.com/datasets/weak-crypto/ua.json
    - [What share of domains in Slovakia have a certificate with a weak key or signature (SHA-1 or sub-2048-bit RSA)?](https://quietfailures.com/datasets/weak-crypto/sk) — 1.77% (n=283); data: https://quietfailures.com/datasets/weak-crypto/sk.json

### dns-integrity
- [dnssec](https://quietfailures.com/datasets/dnssec) — measured over domains: Share of domains without validated DNSSEC — unsigned, or signed with no DS record at the parent.
    - limits: Must be measured locally. The DomainAPI health endpoint exposes no DNSSEC state and resolves DS at the child, which cannot distinguish `broken_chain` from `signed`.
    - [What share of domains in Ukraine have no validated DNSSEC (unsigned, or signed with no DS at the parent)?](https://quietfailures.com/datasets/dnssec/ua) — 100.0% (n=168); data: https://quietfailures.com/datasets/dnssec/ua.json
    - [What share of domains in Japan have no validated DNSSEC (unsigned, or signed with no DS at the parent)?](https://quietfailures.com/datasets/dnssec/jp) — 100.0% (n=216); data: https://quietfailures.com/datasets/dnssec/jp.json
    - [What share of domains in Slovenia have no validated DNSSEC (unsigned, or signed with no DS at the parent)?](https://quietfailures.com/datasets/dnssec/si) — 100.0% (n=217); data: https://quietfailures.com/datasets/dnssec/si.json
- [ns-resilience](https://quietfailures.com/datasets/ns-resilience) — measured over domains: Share of domains whose authoritative nameservers are all on a single provider.
    - limits: Low severity; single-provider is a reasonable choice for a small company, so this is context on concentration risk rather than a defect.
    - [What share of domains in Peru have all nameservers on a single provider?](https://quietfailures.com/datasets/ns-resilience/pe) — 100.0% (n=231); data: https://quietfailures.com/datasets/ns-resilience/pe.json
    - [What share of domains in New Zealand have all nameservers on a single provider?](https://quietfailures.com/datasets/ns-resilience/nz) — 99.61% (n=258); data: https://quietfailures.com/datasets/ns-resilience/nz.json
    - [What share of domains in Malaysia have all nameservers on a single provider?](https://quietfailures.com/datasets/ns-resilience/my) — 99.55% (n=223); data: https://quietfailures.com/datasets/ns-resilience/my.json

### email-auth
- [dmarc-policy](https://quietfailures.com/datasets/dmarc-policy) — measured over domains: Share of email-active domains whose DMARC policy is absent or monitor-only (p=none).
    - limits: A domain may be mid-rollout in `none` deliberately; we measure the state, not intent.
    - [What share of domains in South Korea have a DMARC policy that is absent or monitor-only (p=none)?](https://quietfailures.com/datasets/dmarc-policy/kr) — 98.9% (n=182); data: https://quietfailures.com/datasets/dmarc-policy/kr.json
    - [What share of domains in Japan have a DMARC policy that is absent or monitor-only (p=none)?](https://quietfailures.com/datasets/dmarc-policy/jp) — 95.49% (n=288); data: https://quietfailures.com/datasets/dmarc-policy/jp.json
    - [What share of domains in Italy have a DMARC policy that is absent or monitor-only (p=none)?](https://quietfailures.com/datasets/dmarc-policy/it) — 94.93% (n=276); data: https://quietfailures.com/datasets/dmarc-policy/it.json
- [mta-sts](https://quietfailures.com/datasets/mta-sts) — measured over domains: Share of email-active domains with no enforcing MTA-STS policy (absent, or testing mode only).
    - [What share of France small companies have no enforcing MTA-STS policy (absent or testing mode)?](https://quietfailures.com/datasets/mta-sts/fr-small) — 100.0% (n=245); data: https://quietfailures.com/datasets/mta-sts/fr-small.json
    - [What share of France micro companies have no enforcing MTA-STS policy (absent or testing mode)?](https://quietfailures.com/datasets/mta-sts/fr-micro) — 100.0% (n=212); data: https://quietfailures.com/datasets/mta-sts/fr-micro.json
    - [What share of France medium companies have no enforcing MTA-STS policy (absent or testing mode)?](https://quietfailures.com/datasets/mta-sts/fr-medium) — 100.0% (n=200); data: https://quietfailures.com/datasets/mta-sts/fr-medium.json
- [spf-policy](https://quietfailures.com/datasets/spf-policy) — measured over domains: Share of email-active domains with no enforcing SPF record (absent, ~all soft-fail, or +all).
    - limits: The lookup count is **non-recursive** (it does not expand `include:`), so it is a lower bound and catches only egregiously over-limit records.
    - [What share of domains in South Korea have no enforcing SPF record (absent, ~all soft-fail, or +all)?](https://quietfailures.com/datasets/spf-policy/kr) — 95.05% (n=182); data: https://quietfailures.com/datasets/spf-policy/kr.json
    - [What share of domains in Russia have no enforcing SPF record (absent, ~all soft-fail, or +all)?](https://quietfailures.com/datasets/spf-policy/ru) — 94.57% (n=184); data: https://quietfailures.com/datasets/spf-policy/ru.json
    - [What share of domains in Ukraine have no enforcing SPF record (absent, ~all soft-fail, or +all)?](https://quietfailures.com/datasets/spf-policy/ua) — 93.24% (n=222); data: https://quietfailures.com/datasets/spf-policy/ua.json
- [tls-rpt](https://quietfailures.com/datasets/tls-rpt) — measured over domains: Share of email-active domains publishing no TLS-RPT (SMTP TLS reporting) record.
    - limits: Low severity and near-universally absent, so it is reported as context on adoption maturity rather than as an urgent defect.
    - [What share of France small companies have no TLS-RPT record?](https://quietfailures.com/datasets/tls-rpt/fr-small) — 100.0% (n=245); data: https://quietfailures.com/datasets/tls-rpt/fr-small.json
    - [What share of France medium companies have no TLS-RPT record?](https://quietfailures.com/datasets/tls-rpt/fr-medium) — 100.0% (n=199); data: https://quietfailures.com/datasets/tls-rpt/fr-medium.json
    - [What share of domains in the Netherlands have no TLS-RPT record?](https://quietfailures.com/datasets/tls-rpt/nl) — 100.0% (n=286); data: https://quietfailures.com/datasets/tls-rpt/nl.json

### email-transport
- [mx-dane](https://quietfailures.com/datasets/mx-dane) — measured over domains: Share of email-active domains with no DANE/TLSA record — nothing cryptographically binds their mail server's TLS certificate.
    - limits: Near-universally absent outside a few countries; useful as an adoption frontier rather than an actionable defect for a small company.
    - [What share of France small companies have no DANE/TLSA record binding their mail server's certificate?](https://quietfailures.com/datasets/mx-dane/fr-small) — 98.75% (n=240); data: https://quietfailures.com/datasets/mx-dane/fr-small.json
    - [What share of France large companies have no DANE/TLSA record binding their mail server's certificate?](https://quietfailures.com/datasets/mx-dane/fr-large) — 98.31% (n=178); data: https://quietfailures.com/datasets/mx-dane/fr-large.json
    - [What share of UK newly-formed (no accounts filed) companies have no DANE/TLSA record binding their mail server's certificate?](https://quietfailures.com/datasets/mx-dane/gb-no-accounts) — 98.21% (n=112); data: https://quietfailures.com/datasets/mx-dane/gb-no-accounts.json
- [mx-rdns](https://quietfailures.com/datasets/mx-rdns) — measured over domains: Share of mail servers with no reverse-DNS (PTR) record — a common, quiet cause of degraded deliverability.
    - [What share of UK dormant companies have a mail server with no reverse-DNS (PTR) record?](https://quietfailures.com/datasets/mx-rdns/gb-dormant) — 10.19% (n=108); data: https://quietfailures.com/datasets/mx-rdns/gb-dormant.json
    - [What share of France micro companies have a mail server with no reverse-DNS (PTR) record?](https://quietfailures.com/datasets/mx-rdns/fr-micro) — 8.65% (n=208); data: https://quietfailures.com/datasets/mx-rdns/fr-micro.json
    - [What share of France medium companies have a mail server with no reverse-DNS (PTR) record?](https://quietfailures.com/datasets/mx-rdns/fr-medium) — 8.56% (n=187); data: https://quietfailures.com/datasets/mx-rdns/fr-medium.json
- [mx-tls-cert](https://quietfailures.com/datasets/mx-tls-cert) — measured over domains: Among mail servers offering STARTTLS, the share presenting a self-signed or expired certificate — TLS that authenticates nothing.
    - limits: Honesty demands the split. Because opportunistic TLS tolerates mismatches, only `self_signed` and `expired` are counted as the quiet failure; `hostname_mismatch` is reported but **not** counted.
    - [What share of France micro companies have a mail server presenting a self-signed or expired certificate?](https://quietfailures.com/datasets/mx-tls-cert/fr-micro) — 6.62% (n=136); data: https://quietfailures.com/datasets/mx-tls-cert/fr-micro.json
    - [What share of France medium companies have a mail server presenting a self-signed or expired certificate?](https://quietfailures.com/datasets/mx-tls-cert/fr-medium) — 6.47% (n=139); data: https://quietfailures.com/datasets/mx-tls-cert/fr-medium.json
    - [What share of France companies have a mail server presenting a self-signed or expired certificate?](https://quietfailures.com/datasets/mx-tls-cert/fr-companies) — 6.06% (n=578); data: https://quietfailures.com/datasets/mx-tls-cert/fr-companies.json
- [smtp-starttls](https://quietfailures.com/datasets/smtp-starttls) — measured over domains: Share of email-active domains whose primary mail server accepts mail without offering STARTTLS — inbound mail is delivered in the clear.
    - limits: ~32% of small-company MXs never answer within a 6s timeout and are excluded, so this is measured over *reachable* mail servers.
    - [What share of France large companies have a mail server that accepts mail without offering STARTTLS?](https://quietfailures.com/datasets/smtp-starttls/fr-large) — 2.99% (n=134); data: https://quietfailures.com/datasets/smtp-starttls/fr-large.json
    - [What share of France micro companies have a mail server that accepts mail without offering STARTTLS?](https://quietfailures.com/datasets/smtp-starttls/fr-micro) — 2.86% (n=140); data: https://quietfailures.com/datasets/smtp-starttls/fr-micro.json
    - [What share of UK small companies have a mail server that accepts mail without offering STARTTLS?](https://quietfailures.com/datasets/smtp-starttls/gb-small) — 2.72% (n=405); data: https://quietfailures.com/datasets/smtp-starttls/gb-small.json

### exposure
- [subdomain-exposure](https://quietfailures.com/datasets/subdomain-exposure) — measured over domains: Share of domains with ten or more externally discoverable subdomains.
    - [What share of domains in Slovakia have ten or more discoverable subdomains?](https://quietfailures.com/datasets/subdomain-exposure/sk) — 78.11% (n=297); data: https://quietfailures.com/datasets/subdomain-exposure/sk.json
    - [What share of domains in Czechia have ten or more discoverable subdomains?](https://quietfailures.com/datasets/subdomain-exposure/cz) — 60.66% (n=272); data: https://quietfailures.com/datasets/subdomain-exposure/cz.json
    - [What share of domains in Lithuania have ten or more discoverable subdomains?](https://quietfailures.com/datasets/subdomain-exposure/lt) — 53.2% (n=297); data: https://quietfailures.com/datasets/subdomain-exposure/lt.json
- [subdomain-takeover](https://quietfailures.com/datasets/subdomain-takeover) — measured over domains: Share of domains with at least one subdomain whose dangling record is a takeover candidate.
    - [What share of domains in the Philippines have a subdomain that is a takeover candidate?](https://quietfailures.com/datasets/subdomain-takeover/ph) — 9.94% (n=161); data: https://quietfailures.com/datasets/subdomain-takeover/ph.json
    - [What share of domains in the UAE have a subdomain that is a takeover candidate?](https://quietfailures.com/datasets/subdomain-takeover/ae) — 8.7% (n=253); data: https://quietfailures.com/datasets/subdomain-takeover/ae.json
    - [What share of domains in New Zealand have a subdomain that is a takeover candidate?](https://quietfailures.com/datasets/subdomain-takeover/nz) — 7.36% (n=258); data: https://quietfailures.com/datasets/subdomain-takeover/nz.json

### identity
- [identity-federation](https://quietfailures.com/datasets/identity-federation) — measured over domains [context measure, not a failure rate]: Among domains with a Microsoft Entra tenant, the share federating sign-in to an external identity provider rather than using cloud-managed identity.
    - [What is the split between cloud-managed and federated sign-in of France companies?](https://quietfailures.com/datasets/identity-federation/fr-companies) — 0.0% (n=321); data: https://quietfailures.com/datasets/identity-federation/fr-companies.json
    - [What is the split between cloud-managed and federated sign-in of UK companies?](https://quietfailures.com/datasets/identity-federation/gb-companies) — 0.0% (n=904); data: https://quietfailures.com/datasets/identity-federation/gb-companies.json
    - [What is the split between cloud-managed and federated sign-in of UK medium & large companies?](https://quietfailures.com/datasets/identity-federation/gb-medium-large) — 0.0% (n=452); data: https://quietfailures.com/datasets/identity-federation/gb-medium-large.json
- [identity-platform](https://quietfailures.com/datasets/identity-platform) — measured over domains [context measure, not a failure rate]: Which identity and productivity platform a domain runs on, by segment. Context for the identity metrics, not a failure in itself.
    - limits: Precedence is stated — an Entra tenant wins over Google MX, because a domain can hold both (identity on Microsoft, mail on Google).
    - [What is the identity-platform mix (Microsoft Entra / Google Workspace / neither) of France medium companies?](https://quietfailures.com/datasets/identity-platform/fr-medium) — 0.0% (n=200); data: https://quietfailures.com/datasets/identity-platform/fr-medium.json
    - [What is the identity-platform mix (Microsoft Entra / Google Workspace / neither) of France companies?](https://quietfailures.com/datasets/identity-platform/fr-companies) — 0.0% (n=841); data: https://quietfailures.com/datasets/identity-platform/fr-companies.json
    - [What is the identity-platform mix (Microsoft Entra / Google Workspace / neither) of France micro companies?](https://quietfailures.com/datasets/identity-platform/fr-micro) — 0.0% (n=212); data: https://quietfailures.com/datasets/identity-platform/fr-micro.json

### routing
- [rpki-roa-coverage](https://quietfailures.com/datasets/rpki-roa-coverage) — measured over networks: Share of networks that announce routes but publish no RPKI ROA — their route origins cannot be validated, so a hijack of their prefixes is indistinguishable from a legitimate announcement.
    - limits: Measures **ROA publication, not per-prefix validation state** — an ASN with a ROA may still announce prefixes its ROAs don't cover. Segments are country/RIR, **not** company size: a different axis, stated as such rather than forced into the SME frame.
    - [What share of networks in South Korea have no RPKI ROA, so their route origins cannot be validated?](https://quietfailures.com/datasets/rpki-roa-coverage/kr) — 91.38% (n=928); data: https://quietfailures.com/datasets/rpki-roa-coverage/kr.json
    - [What share of networks in TZ have no RPKI ROA, so their route origins cannot be validated?](https://quietfailures.com/datasets/rpki-roa-coverage/tz) — 74.26% (n=101); data: https://quietfailures.com/datasets/rpki-roa-coverage/tz.json
    - [What share of networks in NG have no RPKI ROA, so their route origins cannot be validated?](https://quietfailures.com/datasets/rpki-roa-coverage/ng) — 71.05% (n=228); data: https://quietfailures.com/datasets/rpki-roa-coverage/ng.json

### supply-chain
- [pkg-install-scripts](https://quietfailures.com/datasets/pkg-install-scripts) — measured over packages: Share of widely-used packages that execute publisher-supplied code during installation — an npm lifecycle script, or a PyPI release shipping only a source archive that pip builds on the machine installing it.
    - limits: The PyPI rule ("ships no wheel") is near-vacuous for top packages, which all ship wheels, so PyPI reads ~0% and needs that caveat or a better signal. Also: `hasInstallScript` appears **only** in npm's abbreviated packument — reading the full document returns false for everything.
    - [What share of widely-used packages that build or fetch a binary at install time have an install script that runs on every install?](https://quietfailures.com/datasets/pkg-install-scripts/stratum-native-build) — 77.06% (n=279); data: https://quietfailures.com/datasets/pkg-install-scripts/stratum-native-build.json
    - [What share of packages in long-tail have an install script that runs on every install?](https://quietfailures.com/datasets/pkg-install-scripts/download_tier-long-tail) — 76.98% (n=278); data: https://quietfailures.com/datasets/pkg-install-scripts/download_tier-long-tail.json
    - [What share of packages on npm have an install script that runs on every install?](https://quietfailures.com/datasets/pkg-install-scripts/ecosystem-npm) — 31.81% (n=679); data: https://quietfailures.com/datasets/pkg-install-scripts/ecosystem-npm.json
- [pkg-maintenance](https://quietfailures.com/datasets/pkg-maintenance) — measured over packages: Share of widely-depended-on packages with no release for over two years — still installed everywhere, no longer maintained.
    - limits: A mature, complete library can be legitimately quiet; release cadence is a proxy for maintenance, not proof of abandonment.
    - [What share of widely-used packages that build or fetch a binary at install time have had no release in over two years?](https://quietfailures.com/datasets/pkg-maintenance/stratum-native-build) — 100.0% (n=283); data: https://quietfailures.com/datasets/pkg-maintenance/stratum-native-build.json
    - [What share of packages in long-tail have had no release in over two years?](https://quietfailures.com/datasets/pkg-maintenance/download_tier-long-tail) — 100.0% (n=282); data: https://quietfailures.com/datasets/pkg-maintenance/download_tier-long-tail.json
    - [What share of packages on npm have had no release in over two years?](https://quietfailures.com/datasets/pkg-maintenance/ecosystem-npm) — 60.18% (n=683); data: https://quietfailures.com/datasets/pkg-maintenance/ecosystem-npm.json
- [pkg-provenance](https://quietfailures.com/datasets/pkg-provenance) — measured over packages: Share of widely-used npm packages published without a provenance attestation linking the artefact to the source that built it.
    - limits: **npm only.** PyPI is *excluded* rather than counted as unsigned, because its JSON API does not surface PEP 740 attestations — absence of evidence is not evidence of absence. The earlier framing (counting only `unsigned`) read 0% because npm signs everything; the real gap is build provenance, which is why `signed_only` is a failure state.
    - [What share of widely-used packages that build or fetch a binary at install time have no build-provenance attestation tying the artifact to its source?](https://quietfailures.com/datasets/pkg-provenance/stratum-native-build) — 98.92% (n=279); data: https://quietfailures.com/datasets/pkg-provenance/stratum-native-build.json
    - [What share of packages in long-tail have no build-provenance attestation tying the artifact to its source?](https://quietfailures.com/datasets/pkg-provenance/download_tier-long-tail) — 98.92% (n=278); data: https://quietfailures.com/datasets/pkg-provenance/download_tier-long-tail.json
    - [What share of packages worldwide have no build-provenance attestation tying the artifact to its source?](https://quietfailures.com/datasets/pkg-provenance/global) — 84.68% (n=679); data: https://quietfailures.com/datasets/pkg-provenance/global.json

### transport
- [https-redirect](https://quietfailures.com/datasets/https-redirect) — measured over domains: Share of web-serving domains that do not redirect http requests to https.
    - [What share of domains in South Korea have no redirect from http to https?](https://quietfailures.com/datasets/https-redirect/kr) — 56.29% (n=167); data: https://quietfailures.com/datasets/https-redirect/kr.json
    - [What share of UK dormant companies have no redirect from http to https?](https://quietfailures.com/datasets/https-redirect/gb-dormant) — 43.64% (n=165); data: https://quietfailures.com/datasets/https-redirect/gb-dormant.json
    - [What share of domains in Hong Kong have no redirect from http to https?](https://quietfailures.com/datasets/https-redirect/hk) — 38.03% (n=213); data: https://quietfailures.com/datasets/https-redirect/hk.json
- [tls-legacy](https://quietfailures.com/datasets/tls-legacy) — measured over domains: Share of TLS endpoints still accepting legacy TLS 1.0 or 1.1.
    - limits: Must be measured server-side. A modern client cannot detect this, because its own OpenSSL refuses to *offer* TLS 1.0/1.1.
    - [What share of domains in Ukraine have legacy TLS 1.0/1.1 still enabled?](https://quietfailures.com/datasets/tls-legacy/ua) — 55.5% (n=209); data: https://quietfailures.com/datasets/tls-legacy/ua.json
    - [What share of domains in South Korea have legacy TLS 1.0/1.1 still enabled?](https://quietfailures.com/datasets/tls-legacy/kr) — 50.94% (n=159); data: https://quietfailures.com/datasets/tls-legacy/kr.json
    - [What share of domains in Russia have legacy TLS 1.0/1.1 still enabled?](https://quietfailures.com/datasets/tls-legacy/ru) — 41.83% (n=153); data: https://quietfailures.com/datasets/tls-legacy/ru.json

### web-hardening
- [security-headers](https://quietfailures.com/datasets/security-headers) — measured over domains: Share of web-serving domains missing HSTS and Content-Security-Policy response headers.
    - [What share of domains in Russia have no HSTS or Content-Security-Policy header?](https://quietfailures.com/datasets/security-headers/ru) — 95.45% (n=154); data: https://quietfailures.com/datasets/security-headers/ru.json
    - [What share of domains in Israel have no HSTS or Content-Security-Policy header?](https://quietfailures.com/datasets/security-headers/il) — 94.81% (n=212); data: https://quietfailures.com/datasets/security-headers/il.json
    - [What share of domains in Slovenia have no HSTS or Content-Security-Policy header?](https://quietfailures.com/datasets/security-headers/si) — 94.57% (n=276); data: https://quietfailures.com/datasets/security-headers/si.json