The value was validated on the client and trusted on the server

# Self-authored for the EML case corpus (no external origin). The client checks
# every field before submitting and catches twenty-six thousand bad inputs a
# day. How many submissions reach the server unchecked is computed below.
#
# The client-side validation is thorough and it is not security theatre — it is
# there for the user. Every field is checked as it is typed, the message says
# what is wrong rather than that something is, and it turns twenty-six thousand
# would-be round trips a day into an immediate correction. Removing it would
# make the product worse.
#
# It runs where the user is. Server-side validation covers fourteen of fifteen
# fields; the fifteenth was left out during a deadline with the note that the
# form already checks it, which was true and is a statement about one caller.
#
# A hundred and twelve thousand submissions a day do not come from the form.

840000 => submissions_per_day
26400 => caught_by_the_client_per_day
15 => fields
14 => fields_checked_on_the_server
112000 => submissions_not_from_the_form

fields - fields_checked_on_the_server => fields_trusted_from_the_client
submissions_per_day - submissions_not_from_the_form => submissions_from_the_form

"submissions per day        : " + str(submissions_per_day) ^0
"  from the form            : " + str(submissions_from_the_form) ^0
"  from an integration      : " + str(submissions_not_from_the_form) ^0
"caught by the client daily : " + str(caught_by_the_client_per_day) ^0
"" ^0
"fields                     : " + str(fields) ^0
"  checked on the server    : " + str(fields_checked_on_the_server) ^0
"  trusted from the client  : " + str(fields_trusted_from_the_client) ^0
"" ^0

# ---- what the client validation does ----

"the form" ^0
"  checks every field as it is typed : yes" ^0
"  message names what is wrong       : yes" ^0
"  round trips saved per day         : " + str(caught_by_the_client_per_day) ^0
"  is it security theatre            : no, it is for the user" ^0
"  verdict                           : GOOD VALIDATION" ^0
"" ^0
"  removing it would make the product worse and nobody" ^0
"  should" ^0
"" ^0

# ---- what it is evidence about ----

"the scope of a client-side check" ^0
"  submissions it inspects : the ones it produced" ^0
"  submissions it inspects that it did not produce : none," ^0
"    because it is not on that path" ^0
"  what the note said : the form already checks it" ^0
"  what the note meant : the form's submissions are checked" ^0
"" ^0
"  the sentence is true; the inference drawn from it names" ^0
"  a population one caller does not cover" ^0
"" ^0

int(submissions_not_from_the_form * 10000 / submissions_per_day) => unvalidated_per_myriad
"share arriving with that field unchecked : " + str(unvalidated_per_myriad) + " per ten thousand" ^0
"" ^0

# ---- why the integrations exist ----

# They are documented, supported, and were the reason the API was built. Nobody
# bypassed anything; the form is one client among several and it is the only
# one the note considered.
"the callers" ^0
"  the form               : one client" ^0
"  documented integrations : several, supported, intended" ^0
"  anyone bypassing a control : nobody" ^0
"  clients the note considered : one" ^0
"" ^0

# ---- null control ----

# The same client validation, with the fifteenth field checked on the server
# as well.
0 => nc_submissions_with_an_unchecked_field
caught_by_the_client_per_day => nc_caught_by_the_client

"null control - the fifteenth field checked on the server too" ^0
"  caught by the client : " + str(nc_caught_by_the_client) + ", unchanged" ^0
"  submissions with an unchecked field : " + str(nc_submissions_with_an_unchecked_field) ^0
"  the form did not change; the check moved to the place" ^0
"  every caller passes through" ^0
"" ^0

# ---- the rule ----

"what client-side validation guarantees" ^0
"  this client sends well-formed values : exactly" ^0
"  the server receives well-formed values : not addressed;" ^0
"    it is a property of one caller, and the server's" ^0
"    population is every caller" ^0
"" ^0
"a check is evidence about the traffic that passes through it;" ^0
"moving one to the client improves the experience of that" ^0
"client and removes it from the boundary" ^0
"" ^0

"The form checks every field as it is typed and saves " + str(caught_by_the_client_per_day) + " round trips a day," ^0
"which is real and worth keeping. " + str(fields_checked_on_the_server) + " of " + str(fields) + " fields are also checked on the" ^0
"server; the fifteenth was left to the form, so the " + str(submissions_not_from_the_form) + " submissions a day" ^0
"that arrive from documented integrations - " + str(unvalidated_per_myriad) + " per ten thousand - carry that" ^0
"field unchecked, and nobody bypassed anything." ^0

submissions_per_day = 840000
caught_by_the_client_per_day = 26400
fields = 15
fields_checked_on_the_server = 14
submissions_not_from_the_form = 112000
fields_trusted_from_the_client = fields - fields_checked_on_the_server
submissions_from_the_form = submissions_per_day - submissions_not_from_the_form
print("submissions per day        : " + str(submissions_per_day))
print("  from the form            : " + str(submissions_from_the_form))
print("  from an integration      : " + str(submissions_not_from_the_form))
print("caught by the client daily : " + str(caught_by_the_client_per_day))
print("")
print("fields                     : " + str(fields))
print("  checked on the server    : " + str(fields_checked_on_the_server))
print("  trusted from the client  : " + str(fields_trusted_from_the_client))
print("")
print("the form")
print("  checks every field as it is typed : yes")
print("  message names what is wrong       : yes")
print("  round trips saved per day         : " + str(caught_by_the_client_per_day))
print("  is it security theatre            : no, it is for the user")
print("  verdict                           : GOOD VALIDATION")
print("")
print("  removing it would make the product worse and nobody")
print("  should")
print("")
print("the scope of a client-side check")
print("  submissions it inspects : the ones it produced")
print("  submissions it inspects that it did not produce : none,")
print("    because it is not on that path")
print("  what the note said : the form already checks it")
print("  what the note meant : the form's submissions are checked")
print("")
print("  the sentence is true; the inference drawn from it names")
print("  a population one caller does not cover")
print("")
unvalidated_per_myriad = int(submissions_not_from_the_form * 10000 / submissions_per_day)
print("share arriving with that field unchecked : " + str(unvalidated_per_myriad) + " per ten thousand")
print("")
print("the callers")
print("  the form               : one client")
print("  documented integrations : several, supported, intended")
print("  anyone bypassing a control : nobody")
print("  clients the note considered : one")
print("")
nc_submissions_with_an_unchecked_field = 0
nc_caught_by_the_client = caught_by_the_client_per_day
print("null control - the fifteenth field checked on the server too")
print("  caught by the client : " + str(nc_caught_by_the_client) + ", unchanged")
print("  submissions with an unchecked field : " + str(nc_submissions_with_an_unchecked_field))
print("  the form did not change; the check moved to the place")
print("  every caller passes through")
print("")
print("what client-side validation guarantees")
print("  this client sends well-formed values : exactly")
print("  the server receives well-formed values : not addressed;")
print("    it is a property of one caller, and the server's")
print("    population is every caller")
print("")
print("a check is evidence about the traffic that passes through it;")
print("moving one to the client improves the experience of that")
print("client and removes it from the boundary")
print("")
print("The form checks every field as it is typed and saves " + str(caught_by_the_client_per_day) + " round trips a day,")
print("which is real and worth keeping. " + str(fields_checked_on_the_server) + " of " + str(fields) + " fields are also checked on the")
print("server; the fifteenth was left to the form, so the " + str(submissions_not_from_the_form) + " submissions a day")
print("that arrive from documented integrations - " + str(unvalidated_per_myriad) + " per ten thousand - carry that")
print("field unchecked, and nobody bypassed anything.")

submissions per day        : 840000
  from the form            : 728000
  from an integration      : 112000
caught by the client daily : 26400

fields                     : 15
  checked on the server    : 14
  trusted from the client  : 1

the form
  checks every field as it is typed : yes
  message names what is wrong       : yes
  round trips saved per day         : 26400
  is it security theatre            : no, it is for the user
  verdict                           : GOOD VALIDATION

  removing it would make the product worse and nobody
  should

the scope of a client-side check
  submissions it inspects : the ones it produced
  submissions it inspects that it did not produce : none,
    because it is not on that path
  what the note said : the form already checks it
  what the note meant : the form's submissions are checked

  the sentence is true; the inference drawn from it names
  a population one caller does not cover

share arriving with that field unchecked : 1333 per ten thousand

the callers
  the form               : one client
  documented integrations : several, supported, intended
  anyone bypassing a control : nobody
  clients the note considered : one

null control - the fifteenth field checked on the server too
  caught by the client : 26400, unchanged
  submissions with an unchecked field : 0
  the form did not change; the check moved to the place
  every caller passes through

what client-side validation guarantees
  this client sends well-formed values : exactly
  the server receives well-formed values : not addressed;
    it is a property of one caller, and the server's
    population is every caller

a check is evidence about the traffic that passes through it;
moving one to the client improves the experience of that
client and removes it from the boundary

The form checks every field as it is typed and saves 26400 round trips a day,
which is real and worth keeping. 14 of 15 fields are also checked on the
server; the fifteenth was left to the form, so the 112000 submissions a day
that arrive from documented integrations - 1333 per ten thousand - carry that
field unchecked, and nobody bypassed anything.

Trace event types