Topic
Security Automation
Within the Topic facet, Security Automation topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
History
The Reply That Did Not Have to Return to the Room: How Followup-To Separated Audience from Destination
A Usenet article could be read in several newsgroups while asking that the next response appear somewhere else. `Followup-To` did not move the original or close its audience. It gave a posting agent a default for the new act of replying—and left the next poster able to choose…
CASE FILE
The Policy Named a Partition. It Did Not Reserve the Resources.
Two candidate paths can point to the same endpoint while carrying different Network Resource Partition identifiers. One 32-bit value changes which underlay resources the headend is meant to invoke. The BGP field can state that association; it cannot create the resources, install…
ICANN
ICANN Would Make the DNS-Abuse Check Mandatory—but Not Comparable
ICANN's newest DNS-abuse proposal would require a registrar to look beyond one evidenced malicious registration, yet it would let every registrar document that check in its own format. The investigation should remain flexible; the evidence interface should not. Unless a source…
CASE FILE
Fourteen ACKs Did Not Prove a Window of Twenty-Four
An application sends ten segments, pauses, then supplies four more. Every segment is acknowledged. A naive slow-start counter can call the resulting congestion window twenty-four, although the path has never carried more than ten in one round trip. The IESG has now approved a…
History
The Border That Could Not Live in a Header: How Distribution Scoped Usenet Without Making It Private
Usenet could carry a request for an article to remain local, national or organizational. It could not carry the border itself. That boundary existed in the agreements between relays, the names each site recognized and the gateways an operator controlled. `Distribution` was…
History
The Second Date That Refused to Replace the First: How Injection-Date Separated Writing from Entry
A Netnews article could be finished on Monday, wait on a disconnected machine, and enter the network on Friday. One clock described when the writer declared the text ready; another was needed to decide whether the network was seeing fresh traffic or an old duplicate. The design…
CASE FILE
The Proxy Opened a Port. It Did Not Authorize the Internet.
The IESG has approved an HTTP extension that lets one proxy-bound UDP socket serve many remote peers. Its operational lesson is sharper than the feature: advertising a reachable address allocates a path, while Context IDs, tuple policy and observed forwarding decide who may use…
Global Cloud Services Trends
Okta Governs AI Agents; Its Terms Leave Every Act With the Customer
Okta can register an AI agent, bind it to a human owner, restrict the resources it reaches, issue a short-lived credential and record the decision. Its contract still says the customer's agents act for the customer and that the customer owns their acts, controls, configurations…
CASE FILE
The Signature Was Valid. The Token Was Wrong.
The IESG has approved a replacement for the JWT security playbook. Its hardest rule is also its most practical: a receiver must prove not only that a token is authentic, but that this exact kind of token is entitled to cross this exact application boundary.
History
The Number That Meant Somewhere, Not Something: How Xref Made Usenet Location Local
One Usenet article could sit at a different number in every group and on every server. Xref turned that apparent contradiction into useful metadata: keep the article's identity global, but let each server publish its own filing coordinates.
CASE FILE
The Path Kept Its ID. Its Instructions Changed.
The IESG has approved a compact identifier for segment lists carried in BGP SR Policy. The number can simplify telemetry and cross-system configuration, but it stays meaningful only inside its Candidate Path—and it can remain unchanged while the actual SID sequence changes.
History
The List That Was Not Its Address: How List-Id Gave Mailing Lists a Stable Name
When a mailing list changed processors, the place used to submit a message could move while the community stayed put. List-Id turned that mismatch into a design rule: give the list one durable name, then keep routing, actions and authentication under separate authority.
History
The Route the Relay Was Told to Forget: How SMTP Kept Source-Route Syntax After Removing Its Authority
An old SMTP recipient can still arrive carrying a list of relays before the mailbox. A modern server must understand the form, yet it need not follow the list. That apparent contradiction records a deliberate transition: compatibility preserved the grammar after normal control of…
CASE FILE
The Gateway Said “Post-Quantum Ready.” The Tunnel Still Used ECDSA.
The IESG approved a mechanism for post-quantum signature authentication in IKEv2 on 24 August 2026. The decision advances the standards path for ML-DSA and SLH-DSA, but a supported algorithm, an advertised method and an authenticated tunnel remain three different facts.
History
The New Address That Was Not a Rename: How SMTP Split Forwarding from Referral
Two mail servers can know exactly the same thing—that a mailbox has moved—and still owe the sender opposite answers. SMTP encoded the difference in `251` and `551`: one server accepted responsibility and forwarded; the other refused the old recipient and left the next attempt to…
CASE FILE
IANA Registered a DELEG Capability Key. Deployment Still Needs Proof.
IANA added a temporary `deleg` key to the DNS Resolver Information registry on 24 August 2026. The entry gives operators a common way to declare support for the emerging DELEG protocol; it does not turn an Internet-Draft into a standard or a declaration into running behavior.
CASE FILE
The First Endpoint Was Preferred. It Was Never Eligible.
An HTTPS record can put one endpoint first and still require a client to ignore it. SVCB makes DNS a publisher of bounded connection plans, not a substitute for compatibility, endpoint authentication or running evidence.
IETF
Job Snijders and the Checklist That Could Sign Bytes, Not Truth
A cryptographic signature can settle a narrow argument and still leave the important business question open. Job Snijders and his co-authors designed the RPKI Signed Checklist to prove that a resource-authorized key signed a list of exact file digests. Its usefulness begins with…
CASE FILE
The Network Named a Provisioning Domain. It Did Not Choose the Path.
A Provisioning Domain can keep one network's addresses, resolvers and routes from contaminating another. It names a coherent context; it does not convert a Router Advertisement into a command that chooses a connection.
CASE FILE
The bridge was gone. The topology still crossed it
Two BGP-LS producers can each retain one stale half of a failed link. A consumer that merges their disclosures may reconstruct a plausible connection that no longer exists, and a controller may compute straight across it. The failure is not simply “bad telemetry.” It exposes who…