Primary Domain
Security
Within the Primary Domain facet, Security intelligence groups reporting by primary domain so readers can follow a focused area of internet infrastructure, governance, connectivity markets, or digital capital. The page brings together related articles, public evidence, institutions, companies, people, regional exposure, operating dependencies, and market context that may otherwise sit across separate category pages. It explains the domain, the likely actor class, the market or governance context, and the source material readers should use when comparing signals. Operators, analysts, and governance readers can see how the same domain appears across events, profiles, market shifts, public-source evidence, regional dependencies, and longer-cycle infrastructure decisions over time.
CASE FILE
CrowdStrike's Channel File 291 remedy is a gate list without a test record
Two quoted sentences survive from the vendor's own root-cause text. What followed survives only as summaries — and a control that has been announced is not yet a control that has been demonstrated.
Europe and Middle East Cloud Services Trends
A Yandex.Cloud stream stopped. The customer still received familiar bots.
Cloudflare's account of the October outage contains two very different losses: search crawlers stopped arriving, while a suspicious stream changed hosting networks. Following the requests reveals what the traffic charts alone cannot.
North America Cloud Services
Proofpoint’s Varonis bid tests the link between threat signals and data access
A security alert becomes useful when an organisation can connect the person or agent that acted, the data it could reach, the permissions that made the action possible, and the remedy that actually changed exposure. Proofpoint’s proposed purchase of Varonis promises to join more…
Story
CEDIA’s FIRST Talk Leaves Critical CSIRT Decisions With People
At the LACNIC 46 co-located symposium, a 21 October session will describe DALIA’s AI-assisted triage and correlation while reserving critical decisions and containment for people. The abstract does not say how that boundary is enforced.
IETF
The Rule Matched the Body. Which Body Did It See?
One mail server found the phrase. Another, running the same rule against the same message, did not. RFC 5173 makes that result less mysterious: `:raw`, `:content` and `:text` do not expose one canonical body. They construct different evidence surfaces before the comparator ever…
IETF
The Child Token Was Valid. The Chain Still Had to Authorize It.
A delegated token can carry a perfect signature and still have no usable authority. The proposed OAuth chain works only when every parent, every narrowing step, the leaf key, current status and the resource server’s own policy agree on the same bounded operation.
IETF
The Manufacturer Signed the New Trust Roots. The Delivery Server Was Still Untrusted.
A factory-installed key can let a device accept a new operational CA bundle from an endpoint it cannot yet authenticate. That is not a paradox if every grant stays narrow: the signature authorizes the entity, the entity changes a local trust store, and only a fresh validated…
IETF
The Prefix Was Registered. The Interpreter Was Still Local.
One readable literal enters two production gates. The first interpreter recognizes its prefix and constructs a value. The second recognizes the same name but refuses to run the extension because the operator never allowed it. Nothing in the source file changed. The disagreement…
IETF
The String Was Exact. The Authority Was Still Local
A service can now hand a customer a precise DNS change instead of a paragraph of instructions. That removes one class of ambiguity. It does not tell the DNS operator who authored the request, whether the customer may alter the named zone, whether local policy should accept the…
IETF
The AS2 Names Matched. The Signer Was Still a Local Decision
A certificate rollover can leave every visible signal green—TLS connected, names reflected, signature valid, MIC matched—while one decisive fact remains outside the protocol transcript: who authorized this key to speak for this partner, in this direction, now?
CASE FILE
The Draft Had Eight Numbers. The Registry Still Had None
On 1 October 2026, an OpenPGP implementer could place two official-looking documents side by side and receive two different answers. Revision 05 of a working-group draft called eight composite algorithms 37 through 44. The live IANA registry still called the entire range from 37…
IETF
The ACME Key Rotated. Yesterday's DNS Authorization Still Works
The newest ACME DNS persistence draft turns routine key rotation into an accounting problem. A retired signing key may be unable to place another order while its public thumbprint still keeps an earlier DNS authorization usable.
IETF
Who Owns the Label After the Proof Verifies?
A Key Transparency proof can establish that a directory answered consistently and still leave an operator with the wrong question. The IETF’s latest review asks who is acting, who owns the binding and who must keep watching after access has changed.
History
When the Standard Outlives Its Authors: The Orphaned Stewardship of RFC 2350
Every network operator who has ever drafted a computer security incident response plan has, knowingly or not, touched the work of a working group that stopped existing nearly twenty-five years ago. RFC 2350 — 'Expectations for Computer Security Incident Response', published as…
CASE FILE
The Value Was the Same. The Reconstructed Bytes Were Not: Deterministic CBOR
The signer and verifier held the same decoded map, agreed on every field and still computed different signature inputs. Nothing in the value had changed. One encoder had merely exercised freedoms that the other had silently removed. The failure was not “CBOR versus cryptography.”…
CASE FILE
The Proof Was Unlinkable. The Envelope Was a Fingerprint: BBS Signatures
Two BBS proof values arrive at different verifiers. The bytes do not betray that they came from the same signature. Yet both presentations carry the same rare header, the same ten-slot credential shape, the same unusual disclosed indexes and a public key used for only twelve…
CASE FILE
The Registry Said `co`. The Handshake Had Said Nothing: RFC 9952
The same two bytes appear in an IANA row, a DNS service advertisement and an endpoint configuration. Yet the packet trace contains no ALPN extension. All three records may be accurate. None can be promoted into the missing wire event.
CASE FILE
The Primitive Kept Its Name. The Reuse Rule Changed: RFC 10032
Three adjacent functions accept an AEGIS key and nonce. One encrypts and authenticates, one emits a keystream after discarding authentication, and one creates a MAC under the only reuse exception in the document. The shared primitive name is technically accurate. Treating it as…
IETF
IDMEFv2 Makes 204 a Receipt—and Leaves the Retry Ledger to the Alliance
A security sensor submits an alert, the connection fails before the response arrives, and the manager may already have stored it. Revision 07 gives a 2xx reply unusually useful meaning. It does not tell a consortium how to classify the next POST.
CASE FILE
The Signature Verified. It Did Not Name the Approvers: RFC 9591
An auditor receives a valid Schnorr signature, the group public key and the exact message. The equation checks. The approval list is still missing. RFC 9591 makes that result possible by design: FROST compresses several signing shares into one ordinary-looking signature. The…