Quellschau: what happens in the TYPO3 ecosystem, on one page

Why another site?

A fair question, and the answer is unspectacular: because the information is all public, yet it never comes together anywhere. A security advisory for an extension you run in four projects appears on typo3.org. The severity rating and the affected versions are not there — they sit in the Packagist advisory database, usually a day or two later. The release that closes the hole shows up in the TER. Three places for one event.

A feed reader solves half of it. It brings the notices together, but it does not sort them, does not summarise, and does not know that an advisory matters more than a podcast episode. And it does nothing for the colleague who does not have a feed reader open.

Quellschau is an attempt to put it on one page: www.quellschau.de. No login, no registration, no JavaScript in the delivery path. Those who prefer reading get an RSS feed; those who prefer a mail get the weekly digest.

What Quellschau collects

Fourteen sources at the moment, and the selection follows a single hard rule: there has to be a feed or an API. What that excludes, and why, is further down.

• Security advisories from typo3.org, enriched afterwards with severity, CVE number and affected versions from the Packagist advisory database. The enrichment is a separate, repeatable step — those databases publish later than typo3.org, and doing it once at fetch time would have frozen the gap permanently.
• Core releases through the get.typo3.org API.
• Extension releases from the TER, around fifty a week.
• News from typo3.org.
• Forums: talk.typo3.org and the TYPO3 tag on Stack Overflow.
• Podcast and video: Inside TYPO3 and the Association's YouTube channel.
• Community blogs, including our own.

The site is open about where every item comes from and what is shown of it: the sources page lists each one with its type and how it is displayed.

Security notices can additionally be filtered by TYPO3 version and by severity — both as real addresses, not search parameters. /sicherheit/typo3-13/stufe-high is a link you can send to somebody.

What the AI does — and what it may not

Every item gets a summary of two or three sentences, in German and in English. That is the only place a language model is involved, and it is tightly bounded.

The model never sees the article. It gets the headline and at most 200 characters of teaser — more is never stored in the first place. That is not technical thrift but German ancillary copyright law for press publishers: anything beyond "individual words or the smallest text excerpts" needs a licence. Fetching the full text of somebody else's article to feed it to an AI is exactly what an aggregator should not do.

That the summaries read soberly as a result is a consequence we accepted deliberately.

Not every item gets one. At first they all did — until we read the results. For release notices the model was translating the sentence our own adapter had written. For security advisories it was worse: the boilerplate gives it little to work with, and the model filled the required two or three sentences with invented recommendations — "developers are advised to take appropriate measures". That appeared in no source. Invented advice underneath a real vulnerability is the worst conceivable place for it. Since then releases and advisories get no summary; severity, CVE and affected versions are on the card anyway.

Every summary is visibly marked as AI-generated, on the item and in the mail. Article 50 of the AI Regulation requires it, and we consider it the bare minimum regardless.

The weekly digest

One mail goes out on Friday morning: security notices, releases, community posts, events. Double opt-in on subscribing, an unsubscribe link in every mail.

One decision in it is worth mentioning because the first draft got it wrong. Originally neither security nor releases were capped. Run against a real week, that produced 52 version notices and zero community posts — the mail would have been a TER changelog. Now every section has its own ceiling, and only one has none: security. An advisory that no longer fits is the one mistake this digest cannot afford.

You do not have to subscribe to see what you would be subscribing to: the digest archive shows every issue that was sent — the stored mail, not a fresh rendering. What you read there is exactly what went out.

What we deliberately do not do

An aggregator lives off other people's content. To keep that fair there are a few rules that are not up for negotiation:

• No scraping. Sources without a feed are not taken up. Reading a page breaks silently the moment its HTML changes — and nobody notices. Better one source fewer than one that delivers nothing for months.
• No images from other sources. No thumbnail, no OG image. Taking the publisher's photograph is republishing. Featured items get a generated graphic instead.
• No full text. See above — 200 characters, capped in the database column itself so no code path can exceed it.
• No copy. Every headline leads to the original page. Quellschau wants to pass traffic on, not keep it.
• No editorial queue. Items go live on arrival. An approval step somebody would have to wait for would be the beginning of the end of a site meant to run itself.

Your blog as a source

If you write about TYPO3, your blog can appear there. The only condition is a feed. There are two ways in:

• Headline and link. The default, no arrangement needed — what a public feed offers may be linked to.
• With a summary. This needs your explicit consent.

If your blog writes about more than TYPO3 — ours does — it can be narrowed to a category the feed itself declares. Of ten posts on our own blog, two make it through.

One message is enough: info@~@netthinks.com, with the address of your feed.

Conclusion

Quellschau is not a product and costs nothing. It exists because we needed the information ourselves and found it tedious to gather by hand every week. That it turned into something useful to others was the second thought.

The site runs unattended: it polls its sources, switches off broken ones temporarily and tries them again later, and speaks up only when something is wrong. Running it costs us a quarter of an hour a week — in good weeks, nothing.

Have a look: www.quellschau.de.