Topic
Security Automation
Within the Topic facet, Security Automation topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
CASE FILE
The Hashes Matched. That Did Not Prove the Network Was Right
Revision 01 of the proposed IS-IS Aggregated SNP Hash exchange can make a million-fragment database cheaper to compare. Its restraint matters more than its speed: a matching summary ends a search for differences, but does not authenticate the state, validate the topology or prove…
CASE FILE
Removing a PyPI Collaborator Is Not Trusted-Publisher Revocation
Taking a name off a project’s collaborator list is a real access decision. It should not be described as a complete release-channel revocation when the publishing identity is governed on a separate surface.
CASE FILE
The Grandmaster Won the Election. That Did Not Prove the Time Was Right: RFC 9760
The Best timeTransmitter can be selected exactly as the profile requires while the winning clock, its external reference or the path to it remains wrong. RFC 9760 gives enterprise PTP a disciplined way to interoperate at scale. It does not turn an election result into proof of…
CASE FILE
A Kubernetes Admission Policy Binding Is Not an Enforcement Outcome
A policy binding is a useful public declaration of intended admission behaviour. It becomes misleading only when it is allowed to stand in for the request, evaluation and response that it does not itself record.
CASE FILE
RDAP Can Name the Assessor. It Cannot Authenticate the Result
Revision 02 turns a lone score into a time-bounded, contestable set of claims from multiple issuers. Yet its most important field, `scoreIssuer`, supplies attribution rather than in-band proof that the named assessor actually made the assertion.
CASE FILE
An Archived GitHub Repository Is Not a Retirement Decision
GitHub’s archive control has a clear and useful job: it changes a repository’s platform state to read-only and signals that its owner no longer presents the project as actively maintained. That visible state can start a dependency review. It cannot decide, for a different…
History
The Area Learned the Route. The Backbone Had Not: RFC 1587
Published on the Standards Track in March 1994, RFC 1587 described how one external route could be present, current and usable inside an OSPF area while the backbone had no advertisement for it. That was not necessarily delay or failure. In the Not-So-Stubby Area, it was the…
CASE FILE
The Firewall Did Not Recognize the TLS Parameter. Blocking It Would Have Broken Extensibility: RFC 9761
A new ClientHello value can mean malware, a legitimate update, deliberate GREASE or simply that the firewall is older than the endpoint. RFC 9761 makes that uncertainty operational: compare the device's declared profile with what the firewall actually understands, then keep…
CASE FILE
An OpenSSF Scorecard Is Not a Dependency Decision
OpenSSF Scorecard turns selected repository signals into a compact public measurement. That is useful precisely because it is narrow. A number can focus a dependency conversation; it cannot decide whether a particular release belongs in a particular system.
CASE FILE
The Chain Passed. The Header That Said So Was Unsigned
A new DKIM2 draft gives mail systems a compact way to report a verified custody chain. Its sharper contribution is the warning attached to that convenience: the report is a local, unprotected memo, not evidence that can be inherited by the next hop.
CASE FILE
The Router Set the P Flag. No Prefix Had Been Delegated Yet: RFC 9762
An IPv6 Router Advertisement can now tell a capable host to prefer a delegated prefix over another address from the shared link. That one bit arrives early enough to prevent a disruptive double start. It still cannot stand in for the DHCP exchange, the relay route or a packet…
History
The Line Went Silent. The Route Stayed Reachable: RFC 1581
A quiet circuit used to look like missing evidence. Demand RIP made quietness the intended operating state. In February 1994, RFC 1581 and RFC 1582 described how routers on X.25 and ISDN could stop waking every peer with periodic updates, close idle calls, and keep the last…
History
The Sender Named the File. The Receiver Still Owned the Disk: RFC 1806
An attachment can arrive with a name and an instruction to stay closed until requested. Neither statement proves that a file was created, that the name is safe, or that the recipient surrendered control of the machine. Content-Disposition became durable because it carried intent…
History
The School Got a Connection. Its Policy Still Had to Be Written: RFC 1578
The circuit could come up before the institution was ready. In February 1994, RFC 1578 explained Internet access to primary and secondary schools by separating things that the verb “connect” made too easy to merge: a path, a set of usable applications, trained people, technical…
CASE FILE
The Large BFD Packet Stayed Up. The Whole Path Was Not Proven: RFC 9764
A green BFD session can now say something useful about packet size, but only if the claim stays as narrow as the packets that earned it. RFC 9764 turns padded control traffic into a recurring lower-bound test. It does not turn one forwarding treatment into a certificate for every…
CASE FILE
The Packet Carried a Resource ID. The Path Did Not Promise to Obey
An IPv6 packet may name the resource partition it wants at every hop and still emerge without proof that every router recognized the request, used the intended queue or preserved the promised isolation.
CASE FILE
The Certificates Were Related. The Verifier Still Owned the Decision: RFC 9763
A certificate authority can attest that two credentials belong to the same end entity. It cannot make two private keys act in a live exchange, choose a peer’s trust anchors or decide whether one successful authentication is enough. RFC 9763 is valuable because it draws that line…
CASE FILE
The Cache Could Stay. The Old Answer Could Not
An NFS client may re-read a busy directory, see the same names and still tell an application that a growing file has its old size. Revision 11 of a working-group draft answers that failure without pretending to abolish caching: it limits which answer the client may expose after…
CASE FILE
The Authorization Server Said Active. The Resource Server Still Had to Decide
One green boolean can look like permission. RFC 9767 is more disciplined: `active: true` is an authorization server’s answer to a resource server’s specific question about a token, a proof method and, sometimes, minimum access. The resource server still owns the application…
CASE FILE
One Subscription, Many Publishers: The Parent Owns the Split
A collector can ask one network node for one stream of updates and receive data from several publishing processes hidden behind the same address and subscription identifier. Revision 21 of the NETCONF distributed-notification draft corrects the authority that makes this possible…