Topic
Software Lifecycle and Lock-in
Within the Topic facet, Software Lifecycle and Lock-in topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
History
The Permission That Survived Deletion: How IMAP Separated ACL Entries from Effective Rights
The administrator removed Fred from the mailbox list. Fred could still write to it. Nothing supernatural had happened, and the server did not need to be broken: Fred might also belong to a group, or receive the same authority through `anyone`. In the access-control language that…
CASE FILE
A Kubernetes NetworkPolicy Is Not a Network-Flow Verdict
A Kubernetes `NetworkPolicy` can be a disciplined way to declare which layer-3/4 connections should be allowed for selected Pods. It is not a transcript of a particular connection. It cannot, by its existence, prove that a CNI implementation enforced it at a stated instant, that…
CASE FILE
The Second Approval Could Be Prepared Before the First Was Signed
Revision 04 of EP-QUORUM fixes an unusually revealing defect: its earlier “strong” approval chain linked contexts that could all exist before any human signed. The replacement makes each successor depend on the completed predecessor proof. That repairs cryptographic causality…
CASE FILE
A GitHub Ruleset Bypass Actor Is Not a Bypass Event
A repository can deliberately name the people, roles, teams, apps or keys that may bypass a GitHub ruleset. That is an important control decision. It is not a record that any one of them did so on a particular ref, and it is not a substitute for the separate records of review…
History
The Quarter-Hour Had Ended. Its Counters Had Not: RFC 1595
A performance window can be over without being final. RFC 1595 made that awkward truth visible in 1994: if ten severely errored seconds straddled a SONET/SDH quarter-hour boundary, the agent could later move seconds in the completed interval from error counters into unavailable…
CASE FILE
The Hashes Matched. That Did Not Prove the Network Was Right
Revision 01 of the proposed IS-IS Aggregated SNP Hash exchange can make a million-fragment database cheaper to compare. Its restraint matters more than its speed: a matching summary ends a search for differences, but does not authenticate the state, validate the topology or prove…
CASE FILE
Removing a PyPI Collaborator Is Not Trusted-Publisher Revocation
Taking a name off a project’s collaborator list is a real access decision. It should not be described as a complete release-channel revocation when the publishing identity is governed on a separate surface.
CASE FILE
The Grandmaster Won the Election. That Did Not Prove the Time Was Right: RFC 9760
The Best timeTransmitter can be selected exactly as the profile requires while the winning clock, its external reference or the path to it remains wrong. RFC 9760 gives enterprise PTP a disciplined way to interoperate at scale. It does not turn an election result into proof of…
CASE FILE
A Kubernetes Admission Policy Binding Is Not an Enforcement Outcome
A policy binding is a useful public declaration of intended admission behaviour. It becomes misleading only when it is allowed to stand in for the request, evaluation and response that it does not itself record.
CASE FILE
An Archived GitHub Repository Is Not a Retirement Decision
GitHub’s archive control has a clear and useful job: it changes a repository’s platform state to read-only and signals that its owner no longer presents the project as actively maintained. That visible state can start a dependency review. It cannot decide, for a different…
History
The Area Learned the Route. The Backbone Had Not: RFC 1587
Published on the Standards Track in March 1994, RFC 1587 described how one external route could be present, current and usable inside an OSPF area while the backbone had no advertisement for it. That was not necessarily delay or failure. In the Not-So-Stubby Area, it was the…
CASE FILE
The Firewall Did Not Recognize the TLS Parameter. Blocking It Would Have Broken Extensibility: RFC 9761
A new ClientHello value can mean malware, a legitimate update, deliberate GREASE or simply that the firewall is older than the endpoint. RFC 9761 makes that uncertainty operational: compare the device's declared profile with what the firewall actually understands, then keep…
CASE FILE
An OpenSSF Scorecard Is Not a Dependency Decision
OpenSSF Scorecard turns selected repository signals into a compact public measurement. That is useful precisely because it is narrow. A number can focus a dependency conversation; it cannot decide whether a particular release belongs in a particular system.
CASE FILE
A CODEOWNERS File Is Not a Review Receipt
A `CODEOWNERS` file can tell GitHub where review responsibility should be routed for a changed path. That is useful machinery. It is not a historical record of who was selected for a particular pull request, whether the eligible person received or completed a review, or whether…
History
The Link That Borrowed Its Address: How Relative URLs Made Documents Movable
A short hyperlink is not a small absolute address. It is an instruction to borrow missing components from a base. That dependency let authors omit repeated schemes, hosts and path prefixes, and it let a collection of pages move while preserving its internal edges. The economy…
CASE FILE
The Chain Passed. The Header That Said So Was Unsigned
A new DKIM2 draft gives mail systems a compact way to report a verified custody chain. Its sharper contribution is the warning attached to that convenience: the report is a local, unprotected memo, not evidence that can be inherited by the next hop.
CASE FILE
The Router Set the P Flag. No Prefix Had Been Delegated Yet: RFC 9762
An IPv6 Router Advertisement can now tell a capable host to prefer a delegated prefix over another address from the shared link. That one bit arrives early enough to prevent a disruptive double start. It still cannot stand in for the DHCP exchange, the relay route or a packet…
History
The Line Went Silent. The Route Stayed Reachable: RFC 1581
A quiet circuit used to look like missing evidence. Demand RIP made quietness the intended operating state. In February 1994, RFC 1581 and RFC 1582 described how routers on X.25 and ISDN could stop waking every peer with periodic updates, close idle calls, and keep the last…
CASE FILE
An SPDX License Expression Is Not a Compliance Verdict
An SPDX expression can make a licensing statement easier to exchange, compare and correct. That is valuable precisely because the statement has limits. A syntax-valid string can identify information that an author declared, information someone found in a file, or a conclusion…
History
The Sender Named the File. The Receiver Still Owned the Disk: RFC 1806
An attachment can arrive with a name and an instruction to stay closed until requested. Neither statement proves that a file was created, that the name is safe, or that the recipient surrendered control of the machine. Content-Disposition became durable because it carried intent…