Open source, and what it lets you check
The extension, the verifier and the whole record of reactions are public, so the numbers can be added up again by anyone.
What is published
Three repositories, and what each one is for. Nothing here needs an account to read, and nothing is a marketing mirror of a private tree — these are the trees the releases are built from.
-
emojery
The browser extension: every adapter that finds the action row on a site, the picker, the popup, the local history, and the client half of the counting.
GPL-3.0
-
emojery-verifier
The independent recount. Downloads the public record, adds every reaction up again, and compares its own totals against the ones we publish.
GPL-3.0
-
emojery-log
The record itself, as data rather than code: the signed checkpoints and their timestamps, appended by machine, never rewritten.
CC0 1.0
How the numbers stay checkable
Every accepted reaction is written into a public record that is only ever added to, that record is regularly sealed in places outside our control, and the verifier adds every reaction up again from it without contacting our servers. So a total on this site is not something you have to take our word for: it is something you, or anyone else, can produce independently and compare.
That is the part worth knowing, and it is why the service that keeps the totals is not itself published. What makes a count trustworthy here is not reading the code that produced it — it is being able to reach the same number from the published record, with a program we do not control. The check is on the answer rather than on the method, which is a thing you can do in an afternoon without reading a line of anything we wrote.
The parts that keep the poll clean stay unpublished for the ordinary reason, and they change nothing about the above: whatever was counted is in the record, in the open, for anyone to add up.
The build you install matches the source
A repository proves nothing on its own if the package in the store was built from something else. This one is checkable: clone the repository, build it, and compare the output with the published package. A release build inlines 4 fixed values, so a rebuild in the same calendar month comes out
byte-identical, and a rebuild in a later month differs only in a YYYY-MM stamp the popup shows in its header.
Nothing in the extension is fetched and executed at run time — no remote code, no hosted script, no bundle pulled in after install. What is in the package is what runs, which is the property that makes comparing it worth anything. Building and loading the extension locally is documented in the repository, and Before you install lists the rest of what you can check without taking our word for it.
What the licenses let you do
| The extension and the verifier | GPL-3.0. Read the source, modify it, and try a local fork for learning or research. If you distribute a modified version, the GPL requires you to make its corresponding source available to recipients under the license. The license covers the code rather than the hosted backend: a build from the public source talks to the staging environment, and Forks and other clients is how a fork asks for the other one. |
|---|---|
| The reaction record | CC0 1.0. Public domain, no conditions. Copy it, mirror it, build something else on it, publish research from it. Evidence with a license attached would be a strange kind of evidence. |
| If the project stops | The published source remains available, and the license lets someone else carry it on. The reaction record is mirrored independently, and the verifier can check an archived copy even if the hosted service is no longer available. |
Reading it is not the only way to contribute
The most useful thing most people send is not a patch. A site changes its markup and the button stops mounting; the Report tab in the extension sends that from the page it broke on, which is what an adapter fix is written from. A site nobody has asked for yet is a request on the issue tracker, and the roadmap is ordered by how many people asked.
Reading the code and disagreeing with it is welcome too, and so is running the verifier on a schedule and telling everyone if it ever disagrees with us. That last one is the contribution the whole design is asking for.
Check it rather than believe it
The repository is the first half and the verifier is the second. Neither asks you to take anything on faith, which is the only reason the counts are worth showing.