Topic
Security Automation
Within the Topic facet, Security Automation topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
CASE FILE
The Log Filter Made Tomorrow’s Evidence Decision
RFC 9742 gives network operators a common language for configuring syslog. The harder question is whether that language preserves the particular evidence an incident will make valuable.
IETF
PQC Readiness Draft Lists One Implementation but Closes None of Five Gaps
Running code deserves attention. It does not deserve a larger claim than its evidence can carry. A new revision of an individual Internet-Draft on post-quantum readiness now lists one certification-authority implementation, one estate and one set of classical-certificate…
IETF
A Fast-Path Timestamp Is Not an Authenticated Measurement
A network can make a measurement faster by keeping a probe in silicon. That is an engineering gain, not a cryptographic transformation. The proposed Timestamp and Forward mode for segment-routing STAMP lets a reflector write a receive time in the data plane and send the packet…
Story
RIPE NCC Lets Operators Sign ASPAs Without Showing the Providers It Sees
RIPE NCC has made ASPA signing possible and tells operators to list every real upstream. Its public guide also says the Dashboard offers no BGP-derived hint about who those upstreams might be. The missing interface is not an automatic answer but an evidence receipt that helps a…
IETF
An Unset FRR Flag Cannot Name the Local Policy That Won
A traffic-engineering head end asks every repair point to keep a backup path below a delay bound. The reservation comes back with one repair point’s new flag unset. Traffic may still have a backup there, computed under local policy, but the ingress cannot tell from that bit which…
IETF
COSE HPKE's Default Mode Does Not Authenticate the Sender
A protected COSE entity arrives, the selected recipient key opens it and every cryptographic check in the HPKE operation succeeds. That result is valuable, but it does not always answer the question an operator is most likely to ask next: who sent this, and were they allowed to?…
Story
LACNIC’s AI Client Resolves a Model, Then Chats Without a Resolution ID
LACNIC has published a cleaner way for Java applications to reach its PAI AI gateway. The new client says which model answered. What it cannot say, in its public typed contract, is whether that answer came from the exact model-resolution state the application inspected a moment…
IETF
An Authenticated BGP Update Is Not an SD-WAN Tunnel Admission Record
When a protected control-plane session delivers a syntactically valid route, it is tempting to treat the event as one completed act of trust. In an SD-WAN, however, the update has only crossed the first of several institutional boundaries. The harder question is not whether BGP…
IETF
A Writable Port Map Needs an Override Receipt
The service orchestrator has found a promising attachment point. One reference tells it which physical port lies beneath the logical choice, and the next capacity query may decide whether the order proceeds. In the IETF’s new Last Call, that small reference is normally…
IETF
OCM Can Remove a Member Without Rotating the File Key
A person disappears from a federated group. The membership tree advances, the remaining entities receive a new group secret, and the user no longer appears on the current roster. Yet the file they once opened may still be encrypted with exactly the same key. The first Open Cloud…
History
RFC 2056 and the Fork in a Z39.50 URL
In 1996, RFC 2056 gave two URL schemes to Z39.50 because one locator could conceal two very different kinds of work. One scheme entered a continuing, stateful inquiry; the other attempted a tightly bounded retrieval of a server-identified item. The distinction is a small piece of…
CASE FILE
RFC 9747: the neighbour returns a packet, not a health declaration
Unaffiliated BFD Echo removes the need for the far end to speak BFD. That useful simplification leaves the local operator owning both the test and the decision made from its result.
IETF
A Valid CoSERV Result Is Not a Completeness Proof
A relying party asks for the reference material needed to judge attestation evidence. The query is deterministic, the response is signed, the contents are still valid and every cryptographic check succeeds. That is a strong result—but a bounded one. The exchange proves what was…
History
The Zero Handle Opened a Door. It Did Not Grant Entry
In 1996, RFC 2054 tried to remove two conversations that stood between an NFS client and its first useful file reference. Its answer was not a new permission system. It was a disciplined gamble: try the port most servers already used, try the newer protocol first, and present a…
History
A Cipher Name Was Not Enough: RFC 2040 and the Missing Identity of RC5
RFC 2040 reads less like a manifesto for a cipher than a parts ledger for agreement. Its lasting historical value is the discipline with which it separates a family name from an executable identity: word size, rounds, key length, expanded state, chaining state and the rule used…
History
The Configuration Row Vanished. RFC 2051 Kept the Session Alive
RFC 2051 turned an obscure APPC management model into a durable lesson about evidence: the record of what should exist can disappear while the record of what is already running remains true.
IETF
The Zone Was Still Answering. The Signing Key Was Already Gone
A correctly signed zone can outlive the private key that produced it. That interval is not recovery; it is a perishable option whose value depends on preserving old cryptographic state while proving, clock by clock, that a replacement chain has taken over.
IETF
DANCE 14 Turns Four TLSA Outcomes Into a Two-Way Server Decision
Four DNS observations can now enter the same TLS policy gate. The latest DANCE client-authentication draft tells a server what to do when it receives anything other than a DNSSEC-validated TLSA record set: abort, or continue while treating the client as unauthenticated. Revision…
IETF
A Signed Transaction Token Does Not Attest Every Claim
A service accepts a correctly signed Transaction Token and treats every nested value as independently verified by the signer. The signature is real, the token is intact, and the conclusion is still too broad. What the Transaction Token Service chose to carry is not the same…
IETF
A TLS Flag Is Not a Feature-State Record
A monitor stores flag 8 as `true`. That compact fact does not say whether a client proposed a feature, a server announced it in a ticket, an acknowledgement was required, early data was involved, or the feature was ever exercised. The bit can be exact while the state inferred…