{
  "what": "What eight HTTP implementations actually did with the twenty-one /compress flavors, one row per observation. Six of them decode content codings and are the subject; two are Python urllib profiles that never decode and serve as controls — one sending no Accept-Encoding (so its bytes are what Cloudflare's edge made of the flavor), one asking for gzip and still not decoding (so its bytes are the flavor as this server sent it).",
  "why": "The home page has claimed these results since v0.12.0 and cited a private repository as the evidence. Here is the evidence. It is also the only data on this service that badhttp did not write about itself.",
  "jsonl": "https://badhttp.dev/clients.jsonl",
  "rows": 168,
  "family": "compress",
  "flavors": 21,
  "observed": "2026-09-02T00:57Z",
  "badhttp_version_observed": "4b211949",
  "join": "corpus_id joins each row to a row of https://badhttp.dev/corpus.jsonl",
  "clients": [
    {
      "id": "curl",
      "name": "curl",
      "role": "client",
      "version": "8.7.1",
      "platform": "x86_64-apple-darwin25.0",
      "invocation": "curl --compressed",
      "accept_encoding_sent": "gzip, deflate"
    },
    {
      "id": "undici",
      "name": "Node fetch (undici)",
      "role": "client",
      "version": "node v26.8.1 / undici 8.10.0",
      "platform": "node",
      "invocation": "fetch()",
      "accept_encoding_sent": "gzip, deflate, br"
    },
    {
      "id": "urllib",
      "name": "Python urllib.request",
      "role": "control",
      "version": "Python 3.14 stdlib",
      "platform": "python",
      "invocation": "urllib.request.urlopen",
      "accept_encoding_sent": "(none)",
      "note": "Sends no Accept-Encoding and never decodes, so its bytes are what the edge made of the flavor — not a decoder under test."
    },
    {
      "id": "urllib-gzip",
      "name": "Python urllib.request (Accept-Encoding: gzip)",
      "role": "control",
      "version": "Python 3.14 stdlib",
      "platform": "python",
      "invocation": "urllib.request.urlopen",
      "accept_encoding_sent": "gzip",
      "note": "Asks for gzip and still never decodes, so its bytes are the flavor as this server sent it — the as-sent oracle, not a decoder under test."
    },
    {
      "id": "requests",
      "name": "Python requests",
      "role": "client",
      "version": "2.34.2 (urllib3 decoder)",
      "platform": "python",
      "invocation": "requests.get",
      "accept_encoding_sent": "gzip, deflate, br, zstd"
    },
    {
      "id": "httpx",
      "name": "Python httpx",
      "role": "client",
      "version": "0.28.1 (own decoders)",
      "platform": "python",
      "invocation": "httpx.get",
      "accept_encoding_sent": "gzip, deflate, br, zstd"
    },
    {
      "id": "ruby-nethttp",
      "name": "Ruby Net::HTTP",
      "role": "client",
      "version": "ruby 2.6.10",
      "platform": "ruby",
      "invocation": "Net::HTTP.get_response",
      "accept_encoding_sent": "gzip;q=1.0,deflate;q=0.6,identity;q=0.3 (decode_content default)"
    },
    {
      "id": "go-nethttp",
      "name": "Go net/http",
      "role": "client",
      "version": "go1.27.0",
      "platform": "go",
      "invocation": "http.DefaultTransport",
      "accept_encoding_sent": "gzip"
    }
  ],
  "outcome_legend": {
    "plaintext": "The caller received exactly the flavor's documented plaintext (SHA-256 match), and the client reported no error.",
    "plaintext-then-error": "The caller received the whole documented plaintext AND the client reported an error — it handed over every byte and then told you something was wrong.",
    "differs-silently": "The bytes the caller received are not the documented plaintext, and the client reported nothing at all.",
    "differs-reported": "The bytes the caller received are not the documented plaintext, and the client reported an error.",
    "decode-error": "Response headers arrived; the body decode raised before a complete body reached the caller.",
    "request-failed": "The client raised before any usable response reached the caller."
  },
  "reading_this": "Read `outcome` as a description of what the caller received, never as a verdict on the client. \"differs-silently\" is the CORRECT behaviour on some flavors and the finding on others, and the difference is a property of the flavor, not of the client. On `undeclared` and `double-hidden` this server declares no coding for the client to strip, so returning the bytes exactly as sent is right — and all six clients do. On `truncated` the identical outcome is the finding: five of six returned a partial document as though it were whole. GET /compress documents which is which, per flavor. No client here is scored, ranked, or called conformant: no specification says what a client must surface to its caller for most of these cases, which is exactly why the observations are worth more than an opinion.",
  "observation_counts_by_role": {
    "client:plaintext": 72,
    "client:plaintext-then-error": 8,
    "client:differs-silently": 24,
    "client:differs-reported": 5,
    "client:decode-error": 5,
    "control:plaintext": 18,
    "control:differs-silently": 22,
    "control:request-failed": 2,
    "client:request-failed": 12
  },
  "disagreement_by_flavor": {
    "not-compressed": {
      "distinct_outcomes": 4,
      "outcomes": [
        "decode-error",
        "differs-reported",
        "plaintext-then-error",
        "request-failed"
      ]
    },
    "wrong-length": {
      "distinct_outcomes": 4,
      "outcomes": [
        "decode-error",
        "plaintext",
        "plaintext-then-error",
        "request-failed"
      ]
    },
    "bad-crc": {
      "distinct_outcomes": 3,
      "outcomes": [
        "decode-error",
        "plaintext-then-error",
        "request-failed"
      ]
    },
    "corrupt": {
      "distinct_outcomes": 3,
      "outcomes": [
        "decode-error",
        "differs-reported",
        "request-failed"
      ]
    },
    "deflate-raw": {
      "distinct_outcomes": 3,
      "outcomes": [
        "differs-silently",
        "plaintext",
        "request-failed"
      ]
    },
    "multi-member": {
      "distinct_outcomes": 3,
      "outcomes": [
        "differs-reported",
        "differs-silently",
        "plaintext"
      ]
    },
    "trailing-garbage": {
      "distinct_outcomes": 3,
      "outcomes": [
        "decode-error",
        "plaintext",
        "plaintext-then-error"
      ]
    },
    "double": {
      "distinct_outcomes": 2,
      "outcomes": [
        "differs-silently",
        "plaintext"
      ]
    },
    "truncated": {
      "distinct_outcomes": 2,
      "outcomes": [
        "differs-reported",
        "differs-silently"
      ]
    },
    "unknown-coding": {
      "distinct_outcomes": 2,
      "outcomes": [
        "plaintext",
        "plaintext-then-error"
      ]
    },
    "x-gzip": {
      "distinct_outcomes": 2,
      "outcomes": [
        "differs-silently",
        "plaintext"
      ]
    },
    "bomb": {
      "distinct_outcomes": 1,
      "outcomes": [
        "plaintext"
      ]
    },
    "br": {
      "distinct_outcomes": 1,
      "outcomes": [
        "plaintext"
      ]
    },
    "deflate": {
      "distinct_outcomes": 1,
      "outcomes": [
        "plaintext"
      ]
    },
    "double-hidden": {
      "distinct_outcomes": 1,
      "outcomes": [
        "differs-silently"
      ]
    },
    "empty": {
      "distinct_outcomes": 1,
      "outcomes": [
        "plaintext"
      ]
    },
    "gzip-file": {
      "distinct_outcomes": 1,
      "outcomes": [
        "plaintext"
      ]
    },
    "ok": {
      "distinct_outcomes": 1,
      "outcomes": [
        "plaintext"
      ]
    },
    "undeclared": {
      "distinct_outcomes": 1,
      "outcomes": [
        "differs-silently"
      ]
    },
    "uppercase": {
      "distinct_outcomes": 1,
      "outcomes": [
        "plaintext"
      ]
    },
    "zstd": {
      "distinct_outcomes": 1,
      "outcomes": [
        "plaintext"
      ]
    }
  },
  "freshness": "A dated capture, not a live measurement: taken 2026-09-02T00:57Z against badhttp version 4b211949, with the client versions on each row. Client behaviour changes between releases and this table does not update itself. Re-run it from scripts/compress-witness/ in the source and the numbers move; the date on every row is how you know whether to trust it.",
  "reproduce": "Every row is one request. Fetch the row's url with the row's client at the row's accept_encoding_sent, compare what your caller receives against the response's x-badhttp-plain-sha256 header, and you have re-derived the row.",
  "license": "CC0-1.0",
  "license_url": "https://badhttp.dev/license"
}