Not really. It is possible with a purpose built browser extesion. if you have an account, web programming experience, and you write an extension that manipulates the data in transit. That's the straightforward way to corrupt data for any service or application with an open client - by attaching an extension to their web client, cooking the data there, and sending it on to the app server. If that were to happen on a Local analysis, there's mitigation where a site mod can delete the bad eval from the game.
But I don't think a one off or even a spree like that is at all likely. It's too much work for too little reward. But imagine that jackhole who made ACAS "the learning tool!" If someone like that with skills made an extension to wreck evals and gave script kiddies a button to torch the lichess analysis database, Lichess would need to lock things down. It sounds scary but it's an existing vulnerability in study eval right now. All that study data is sitting there in the client and an extension has free reign on most of it. If I'm wearing a black hat, I'm probably going after harder targets like inbox messages, titles, trophies, etc.
Game analisis
@gamblej said [^](/forum/redirect/post/OVUDxBS9)
> You can actually see the node count of a cloud, server, or local eval by hovering it
Yeah, but the type of engine matters. For the same amount of nodes you get very different values. Also, what happens if I use the external engine API with the local analysis?
@BaronVonChickenpants said [^](/forum/redirect/post/zpiUF0cb)
> Sounds interesting. Is there any way that bad faith actors could use this 'publish' feature to break,dilute or corrupt the server stored analysis?
I thought about this too. But it depends on the storage. If it's stored per game/study chapter and person, you're the only one seeing that eval, right? I guess the evals can then be farmed to be included in the cloud storage.
@TotalNoob69 said [^](/forum/redirect/post/OlVYRzXu)
> I guess the evals can then be farmed to be included in the cloud storage.
I think he was talking about corrupting analysis for a single game. So everyone who visits that game gets the bad stuff.
@TotalNoob69 said [^](/forum/redirect/post/0i0bMwuY)
> Also, what happens if I use the external engine API with the local analysis?
You can use external engine with local analysis via the Custom tab, but you can't publish those evals to the server. That's an integrity measure for game analysis. An engine may claim to be Stockfish 18 over UCI but the Lichess external engine protocol has no signature mechanism to verify executables. Unless that changes (and it won't), only evals from the official browser stockfish can be published.
Perhaps it could be allowed in studies where the contributor permission is required.
@Egil7 said [^](/forum/redirect/post/u7UQ0xT8)
> Mullvad Browser 15.0.19 (based on Mozilla Firefox 140.13.0esr), when I click on "Device local analysis":
That is fixed now on https://gamblej.org
@gamblej said [^](/forum/redirect/post/GPSKwLGP)
> > Mullvad Browser 15.0.19 (based on Mozilla Firefox 140.13.0esr), when I click on "Device local analysis":
>
> That is fixed now on https://gamblej.org
It works now, quite slow though. Apparently, Mullvad disables certain required features for privacy reasons.
I just checked it out and Mullvad's doesn't allow a javascript feature (SharedArrayBuffer) that all lichess-org/stockfish-web engines require. So you're stuck with the slower, single thread, pre-nnue stockfish version.
Sounds good although most people probably wouldn't use it