[Docs] The FAQ claims a client-side-only architecture with no backend #602

New issue

Closed

opened 2026-07-22 16:18:17 +00:00 by brenno · 1 comment

brenno commented

2026-07-22 16:18:17 +00:00

Owner

Found in the pre-publication claim audit.

Evidence: docs/FAQ.md:45 lists as a security measure "- Client-side only architecture with no backend". But server/fetch-proxy/ocideck_fetch_proxy.py is a server-side component in this repository, and docs/ARCHITECTURE.md:43-48 describes it: "fetch-proxy (server/fetch-proxy/) — the one optional server-side component… So in that one case the host does see the fetched URL." It is reached from lib/services/parts/file_service_net.dart:42 and lib/services/git/git_transport_web.dart:129.

README.md:15 was corrected for exactly this on 2026-07-21 — the correction note is still there — but it never reached the FAQ. And docs/FAQ.md:18-21, in the same file, does get it right ("including the few whose address you did not choose"), so the document contradicts itself two sections apart.

Why this matters now: the FAQ is what a casual reader opens, and this bullet sits under "What security measures does OciDeck implement?" — the highest-stakes list in the file. A one-line self-contradiction is the cheapest possible way for a critic to argue that the careful README wording was written after the fact.

Proposal: change the bullet to "No application backend for editing; the one optional server-side component is the web build CORS fetch-proxy, and it relays raw bytes only (see ARCHITECTURE.md, runtime and network model)." While in the file: docs/FAQ.md:33-34 ("nothing to download yet. No version has been tagged") goes stale the moment a release is cut — fold it into the release checklist in #520.

Found in the pre-publication claim audit. **Evidence:** `docs/FAQ.md:45` lists as a security measure "- Client-side only architecture with no backend". But `server/fetch-proxy/ocideck_fetch_proxy.py` is a server-side component in this repository, and `docs/ARCHITECTURE.md:43-48` describes it: "**fetch-proxy** (`server/fetch-proxy/`) — the *one* optional server-side component… So in that one case the host does see the fetched URL." It is reached from `lib/services/parts/file_service_net.dart:42` and `lib/services/git/git_transport_web.dart:129`. `README.md:15` was corrected for exactly this on 2026-07-21 — the correction note is still there — but it never reached the FAQ. And `docs/FAQ.md:18-21`, in the same file, *does* get it right ("including the few whose address you did not choose"), so the document contradicts itself two sections apart. **Why this matters now:** the FAQ is what a casual reader opens, and this bullet sits under "What security measures does OciDeck implement?" — the highest-stakes list in the file. A one-line self-contradiction is the cheapest possible way for a critic to argue that the careful README wording was written after the fact. **Proposal:** change the bullet to "No application backend for editing; the one optional server-side component is the web build CORS fetch-proxy, and it relays raw bytes only (see ARCHITECTURE.md, runtime and network model)." While in the file: `docs/FAQ.md:33-34` ("nothing to download yet. No version has been tagged") goes stale the moment a release is cut — fold it into the release checklist in #520.

brenno added the

docs

label

2026-07-22 16:18:17 +00:00

brenno referenced this issue from a commit

2026-07-22 17:07:10 +00:00

docs: claims en cijfers die niet meer klopten (#602 #599 #614 #640 #634 #587 #623)

brenno referenced this issue from a commit

2026-07-22 17:12:52 +00:00

docs: claims en cijfers die niet meer klopten (#602 #599 #614 #640 #634 #587 #623)

brenno referenced this issue

2026-07-22 17:14:10 +00:00