Topic
Software Lifecycle and Lock-in
Within the Topic facet, Software Lifecycle and Lock-in topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
History
Readable Without a Parser Did Not Mean Safe to Parse: RFC 1874
In 1995, one MIME label tried to preserve two truths about the same structured document. A person without SGML software might still read its general meaning; a machine with SGML software might interpret far more than the visible lines. RFC 1874 called the first case `text/sgml`…
CASE FILE
A security.txt File Needs a Live Disclosure-Channel Receipt
The `Expires` line says the coordinates are still publishable. It cannot tell a researcher whether anybody is listening. That gap between a fresh file and a working response operation is where a small disclosure-channel receipt becomes useful.
CASE FILE
The Message Was Encrypted. Its Headers Still Needed Their Own Receipts: RFC 9788
An encrypted-mail badge compresses a complicated evidence chain into one reassuring symbol. RFC 9788 shows why the symbol cannot answer which header was hidden, which sender identity was authenticated, what an intermediary changed, or where a reply may safely go.
CASE FILE
An OSPS Baseline Claim Needs a Version, a Level and a Date
“OSPS compliant” looks tidy in a supplier register. It is also incomplete. The Baseline is versioned, divided by project maturity and explicitly assessed at a point in time; a useful claim must preserve those coordinates and the evidence behind them.
History
The Departure Packet Asked Everyone to Forget. It Could Not Prove They Did: RFC 1868
In 1995, a dial-in user could leave one communications server and return through another while the local network kept sending packets to the first. RFC 1868 proposed a sixteen-byte correction: broadcast an unusual ARP Reply that told every peer to delete the departed address from…
CASE FILE
A CA Audit Is Not a Certificate-Issuance Verdict
An annual assurance report can show that a certificate authority’s controls were examined over a bounded period. It cannot, on its own, answer the smaller and more consequential question a relying party often needs to ask: why was this exact certificate for this exact name and…
CASE FILE
Four Bits Looked Like IP. They Were Not: RFC 9790 and the End of Payload Guessing
An MPLS router can see `0x4` after the label stack and reach for an IPv4 hash. RFC 9790 explains why those four bits cannot carry that conclusion on their own.
CASE FILE
A GitHub Actions workflow_run Trigger Is Not an Artifact-Trust Verdict
A GitHub Actions `workflow_run` trigger can create a useful separation between an upstream check and a downstream, more privileged workflow. It does not establish that the upstream result, the artifact consumed downstream, or a later target operation deserves trust.
History
The Shortest Timer Usually Won. The Client Still Had to Absorb the Race: RFC 1863
Redundancy sounds decisive only from a distance. Put two route servers beside the same clients, and it appears that either can replace the other. RFC 1863 described the harder machinery: each server kept its own picture of who was already being informed, waited for a load-ranked…
CASE FILE
A GitHub Actions OIDC Token Is Not a Cloud-Authorization Verdict
A GitHub Actions OIDC token can identify a bounded workflow context to an external provider. It does not, by itself, establish that a cloud trust policy matched, that a cloud session was issued, that a resource permitted an action or that a target changed.
History
The Address Was Supposed to Declare the Charging Rule Before Contact: RFC 1681
In 1994, one IPng paper imagined a Gopher server redirecting a caller to a paid destination before any useful warning could appear. Its answer was to make the destination address speak first: some bits would identify who paid, or point to a charging algorithm. RFC 1681 exposed a…
CASE FILE
A GitHub Actions Concurrency Group Is Not a Deployment-Serialization Verdict
A GitHub Actions concurrency group can reduce conflicts between named jobs or workflow runs. It does not, on its own, establish the order of every consequential action against a target or the effect of those actions.
CASE FILE
The Root Verified. The Proof Still Could Not Name the Leaf
A one-bit path can point to leaf 1, 2, 4 or 8, depending only on how large the tree was. The current SCITT profile can still prove that a candidate statement belongs under a signed CCF root. What it cannot always do, from the proof alone, is say where that statement sat.
History
The Test Measured the Reserve by Spending It: RFC 1628
A UPS exists to preserve power when ordinary supply disappears. RFC 1628 defined a diagnostic that learned more about that reserve by deliberately drawing it down. The result could improve confidence in battery replacement and run time, but the test left the protected load with…
CASE FILE
The Message Fit the Schema. That Still Did Not Make It True: RFC 8927
RFC 8927 builds a deliberately narrow gate for JSON messages. A message that passes has the declared shape; identity, authority, freshness and real-world effect still wait on the other side.
CASE FILE
A Dismissed Dependabot Alert Is Not a Remediation Verdict
A dismissed Dependabot alert records a triage decision about a repository-facing signal. It can be sensible and well documented. It still does not prove that vulnerable code is absent from a deployed system, that an upgrade was accepted, or that a remediation has happened.
History
The Switch Named the Service. The Endpoint Had Not Opened It: RFC 1618
An ISDN call could arrive at the number reserved for PPP and still meet a closed service. RFC 1618 made the order explicit: the switch could identify which doorway had been called, but only a human or local program could authorize PPP to use it. Without that administrative…
CASE FILE
The Client Reported the File Attributes. The Metadata Server Could Still Verify Them: RFC 9766
RFC 9766 gives an NFS client a cheaper way to carry data-file observations back to the metadata server. The design is valuable because it refuses to make that report final: weak evidence can save work without becoming metadata sovereignty.
CASE FILE
A Yanked PyPI Release Is Not a Package Withdrawal Verdict
A PyPI yank changes how a repository presents a release to selection tools. It can be an important signal for maintainers and consumers, particularly when a release is broken or violates a compatibility promise. It is not, by itself, a record that a package has been deleted, that…
History
The Channel Number Was Not the Circuit: RFC 1613 and X.25 over TCP
Two calls could arrive with the same twelve-bit channel number and still be different calls. RFC 1613 solved that 1994 X.25-over-TCP problem by refusing to make the enclosed number carry more identity than its local interface allowed. The TCP stream, the logical XOT interface and…