Topic
Security Automation
Within the Topic facet, Security Automation topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
North America Cloud Services Trends
AITX’s 14% Payment Drop Does Not Yet Clear the Cash-Flow Test
AITX spent less cash in a selected set of operating categories in August than in July. That is a useful observation, but the company’s own exclusions, timing notes and financing record show why one smaller month cannot yet carry the weight of a cash-flow result.
CASE FILE
The Controller Received the State. It Still Needed a Clock: RFC 9857
RFC 9857 gives external controllers a structured view of Segment Routing candidate-path state. The harder operational question begins after receipt: whose observation was it, which generation did it describe, and what later evidence shows that the reported state still governed…
IETF
A Deprecated TLS Suite Is Not a Disabled TLS Endpoint
RFC 10015 changes what compliant TLS 1.2 and DTLS 1.2 implementations may offer or select. It does not reach into a listener, rewrite a proxy policy, reload a process or prove what was negotiated yesterday. Closing that gap requires evidence from the registry all the way to the…
Creators
Cricket Liu: how DNS became managed infrastructure
Cricket Liu's career traces the path of the domain name system from a specialised service handled by a small group of operators to an enterprise control plane and, increasingly, a security sensor. His significance lies not in inventing protocols but in explaining how names…
IETF
The Principal Signed the Delegation. The Issuer Still Bound the Agent Key
Two valid signatures can sit in one credential without answering the same question. A new AIC-JWT revision puts the principal’s authorization inside an issuer-signed token, yet draws a precise line between the Agent identity the principal authorized and the proof-of-possession…
IETF
Fresh Entropy Entered the Session. Recovery Still Needed Proof in Both Directions
TLS 1.3's ordinary KeyUpdate advances a secret already known to the current chain. The active Internet-Draft for Extended Key Update proposes something stronger: rerun the negotiated key exchange inside a live session and mix fresh input into the next traffic secrets. That can…
History
The URL Carried a Query, Not Its Authority: RFC 1959
In 1996, a directory lookup could be folded into a string short enough to paste into a document or hand to a web client. That convenience was exact but narrow. RFC 1959 could name a server, a place in the directory, the attributes to request, a search scope and a filter. It could…
CASE FILE
Two Sources, One Election, No Continuity Verdict: RFC 9856
RFC 9856 gives an EVPN fabric disciplined ways to choose among redundant multicast sources. The useful discipline begins by refusing a tempting shortcut: the chosen path is not the received service.
CASE FILE
The Parameter Set Verified. The Signing State Did Not: RFC 9858
RFC 9858 gives HSS/LMS implementers more hash and security-strength choices. It does not make the stateful part of a stateful signature disappear. The operational question is therefore not only whether a verifier can parse the new typecodes, but whether the signer can prove that…
IETF
RFC-to-be 10040 Can Sign a Map-Reply. It Cannot Verify the Location
A coordinate can arrive in a reply whose sender and contents are cryptographically authenticated, yet still lack an answer to the most physical question in the exchange: who actually measured the place? RFC-to-be 10040 is nearly through the publication workshop. Its governance…
Story
A Scan Found 4,611 Exposed BGP Routers in APNIC. It Cannot Say Why They Were Open
At APNIC 62, researchers put a regional number on a quiet control-plane problem: 4,611 routers across 1,343 APNIC-region autonomous systems answered an unsolicited BGP OPEN exchange in a February IPv4 scan. That is firmer evidence than a port banner, but it is neither a breach…
IETF
A D-PATH Stops Loops Only When Gateways Agree on the Domain
A BGP attribute can carry a domain history, but it cannot decide what a domain is. RFC 10039 makes that prior decision operationally consequential: the same configured identifier that lets a gateway reject a returning route can also discard a legitimate route when the gateways…
Creators
Cricket Liu and the long work of making DNS operable
Cricket Liu’s career follows the Domain Name System from a specialist service run by a small group of operators to an enterprise control plane and, increasingly, a security sensor. His importance lies less in inventing protocols than in explaining how names, addresses, leases and…
IETF
DNSOP Adopted the Multi-Algorithm Problem, Not the UNIVERSAL Label
One sentence in a Working Group chair’s message does two jobs. It records “clear support” for taking on a DNSSEC draft, then preserves concerns about the complexity of its mechanism. The first clause changed the document’s process state. The second stopped that state change from…
IETF
RFC 7506 Is Historic. Router Alert 69 Can Still Be on the Wire
A standards register can retire a behavior without touching a single router. RFC 7506 is now Historic, its MPLS OAM Router Alert value is deprecated, and RFC 9570 says new LSP Ping implementations must not set it. None of those facts proves that value 69 has disappeared from an…
History
The Proposal Added a Header. It Refused to Rewrite the Address: RFC 1955
RFC 1955 described a way to make the Internet's routing problem look smaller without pretending that its addressing problem had disappeared. At an entrance border, the proposal would place the original IPv4 datagram inside a second IP header addressed to an autonomous domain. At…
History
The Cell Carried a Label. It Did Not Carry a Verdict: RFC 1954
In Ipsilon's 1996 ATM design, a flow label did not decorate an IPv4 packet. It changed the virtual channel and, for two flow types, changed which IPv4 fields crossed the link at all. That economy made forwarding state executable—and made the limits of the resulting evidence…
IETF
A NAT64 Mapping Is Not a Filtering Policy
A repeatable public tuple can prove how a stateful NAT64 translator allocates an address and port. It cannot prove which IPv4 sources are allowed to use that state on the way back. Treating those two facts as one control turns an interoperability test into a security verdict it…
History
The Switch Offered a Shortcut. The Router Could Refuse: RFC 1953
In RFC 1953, the faster path began as a neighbor's request, not a command. A downstream node chose a label from its own local space and asked the upstream node to attach it to a defined IP flow. The upstream node could ignore the request. Even acceptance lasted only for a stated…
IETF
One Operator Does Not Make One SRv6 Trusted Domain
A merger puts two routing estates beneath one legal owner. The new diagram draws a single box around them, and an automation team proposes removing the filters at the seam. The diagram may be administratively correct. It proves nothing about whether the two SRv6 instances share…