No measurement without evidence

How the network comes to trust its own numbers – signature, plausibility, agreement.

A measurement network anyone may join has a problem a closed one does not: who guarantees the numbers are real?

A node could report whatever it likes. 0.1 ms to Australia, no loss, every time. That would corrupt baselines and make every statement built on the network worthless.

So NODE64 checks in three layers. None of them trusts the previous one.

1. Signature: who delivered? #

On enrolment every node generates an Ed25519 key pair. The private half never leaves the machine; the public half goes to the server once, with the enrolment.

After that the node signs every submission. The server verifies before it records anything.

What gets signed is exactly the text that is transmitted – not a message reassembled from fields. The difference sounds technical and is decisive: if both sides had to assemble the message byte for byte alike, the check would sooner or later break on a detail. And a broken check gets switched off.

If the signature does not match, the whole submission falls. Not individual lines from it: the signature covers the transmitted text; if it does not match, no part of it is evidenced. Picking out the plausible-looking lines would be exactly what the signature stands against.

The key is accepted only at enrolment. A key that can be supplied later can be supplied by anyone holding the device token – and then the signature proves nothing.

Nodes enrolled before this check existed have no key. They keep delivering and show up under Verification as unsigned – that is information, not an error. Whoever wants to sign re-enrols their node; the fingerprint leads it back to the same device, with its identity, reputation and history.

2. Plausibility: was that even possible? #

Four checks, all arithmetic. They do not say whether a measurement was good – they say whether it was possible.

Jitter is checked too, and arithmetically: the mean of the gaps between consecutive packets cannot exceed the span between smallest and largest value. Reporting 0.0 ms of jitter claims a line without any unrest – reporting more than the span allows means someone did not calculate but write.

3. Agreement: do the others see the same? #

The first two layers check a result against itself. Both are survived by anyone inventing plausible numbers: 12 ms, 0 % loss, every time, properly signed. It is possible, it is genuinely signed – and it is still a lie.

Such numbers only stand out when placed beside everyone else's.

What is compared is loss and reachability to the same target, in the same address family, in the same window. Both are properties of the target and the path to it: if a target is up, everyone sees it up.

Latency is explicitly not compared. A node in Sydney legitimately measures ten times what a node in Düsseldorf measures to a target in Frankfurt. Turning that into a deviation would punish nodes for their location – and the location is the reason they exist.

The arithmetic uses median and median absolute deviation, the same method as Timbre: a single outlier does not shift the median. The threshold comes from Iglewicz/Hoaglin and is not ours.

A comparison needs at least five nodes on the same target. With three, "the majority" is two, and whoever is once off is the minority.

This layer discards nothing. A deviation is not proof: a node behind a congested line departs without lying. A single outlier means nothing; a pattern over weeks costs reputation.

What was rejected is on the record #

Under Measurement network → Verification you see what was turned away – with the reason, the reported value and what would have been possible.

A rejected result is a finding, not a disturbance. Throwing it away silently would mean nobody ever learns that someone tried.

And the number of accepted ones stands beside it. Twelve rejected results out of twelve submissions is something else than out of twelve thousand.