Strategic Circle Briefing
Join to unlock strategic briefings after signing in.
Join Strategic CircleGovernance / IETF
IETF
The IETF writes the protocols every network runs on. We follow the drafts, the working-group fights and the standards that ship, and explain what each one changes for operators before it reaches production.
GlobalProtocol GovernanceInteroperability Risk
Latest Coverage
Latest from IETF
1,656 articles
IETF
The AS Number Is Registered. Who Gets to Promise How It Routes?
A new routing draft separates the name on an Internet number record from the operator who can speak for a network’s BGP policy. It wants each commitment tied to the actual issuer, a narrow set of routes and neighbors, and evidence an outside observer can really see.
IETF
The IETF Chair Could Pick a Stand-In. The New Draft Gives That Choice to the IESG.
A working-group rewrite of the emergency-chair proposal moves the selection from the sitting Chair to the IESG. It also names the body that decides when a Chair cannot, will not or is disputed in declaring an absence: the IESG again.
IETF
The Agent's Door Can Move Without the App Moving
An IETF proposal gives a small file at an application's origin the power to advertise which operations agents may perform. Its own security section names the uncomfortable consequence: whoever can replace that file can move the agent's door without shipping new application code.
IETF
The Suspended Agent Is in the Chain. The Gate Cannot Use It to Say No.
A new agent-evidence draft gives the receiving service a history of who handled a request. Its November revision draws a hard line: that history can expose a suspended upstream actor after the fact, but the gate checks the current actor when deciding whether to let the request…
IETF
The Log Can Be Honest. Its Owner Can Still Replace Your Verifier.
Key Transparency promises to catch a messaging service that shows different public keys to different users. A new IETF draft section puts the service's software update channel under the lamp: the operator often supplies both the log and the app meant to check it.
IETF
Two Names, One Voice: An IETF Draft Draws a Line Around the Debate
One person may keep two unlinked identities for separate standards work under a new proposal. Put both identities into the same argument, and the permission ends. The draft wants a human answerable for every contribution an agent submits; it has yet to decide who can verify that…
IETF
The Agent Had a Mandate. Its Identity Expired at the Gate.
A cross-domain software agent can carry a valid delegation and still lose the right to act in the time between checking its papers and issuing an access token. A 1 November Internet-Draft revision puts the agent instance's own identity expiry on the final authorization clock.
IETF
The Live Stream Needs a Relay. The Old Map Shuts the Gate.
The show is on. A new viewer arrives. A proposed Media over QUIC load balancer may have a map of relays, yet its information about their health may be too old to trust. After a deadline set by the operator, it must refuse a new request that depends on that old information.
IETF
The Link Fails. A Legacy Router May Keep the Redirect.
A revised FlowSpec draft gives routers a bit that ties a traffic detour to the life of a direct link. Its new deployment section admits the catch: a router that does not understand the bit must ignore it and may keep steering packets after that link is gone.
IETF
The Gateway Sees Your AI Stream. Standard RADIUS Counts Only the Session.
An operator can classify traffic at the edge and give one stream special treatment. A new Internet-Draft asks who authorized that stream, how the decision reaches the access network, and which record could justify a separate charge.
IETF
A Trusted Root Does Not Give a Bad Certificate a Second Turn
A TLS draft now draws a line through its own recovery mechanism: a certificate rejected for expiry, revocation or the wrong name cannot borrow the reputation of its root to claim a retry with that same trust-anchor ID.
IETF
A Vendor’s Subdomain Can Bless the Parent’s From Address
DKIM2’s new draft gives a parent domain a switch to stop its delegated subdomains authenticating the name readers see in From. The switch starts in the permissive position.
IETF
The Agent Can Restart. Who Signed the Empty Boxes?
A new IETF individual draft would put an AI agent’s return from an incident on a signed record. Its sharpest choice is to make missing evidence visible while leaving the final switch in the receiver’s hands.
IETF
The Prefix Asked for Every Track. The Token Covered Only Some.
MoQ's new Privacy Pass draft has a blunt answer for broad media requests: the credential must cover the whole branch, or the relay must keep every item it sends inside the smaller grant.
IETF
The Attestation Trigger Lost Its Own Registry Label
An IETF draft has cut its proposed EDHOC remote-attestation labels from four to two. The trigger now travels under the same label as the evidence it requests, making message position and value do the distinguishing work.
IETF
The Authorization Server Delivers the Token. Who Gets the Trail?
An ACE draft shortens the route from permission to device. Its 2 November revision adds an operational ledger—and asks where a useful audit record becomes a map of clients.
IETF
One MLS Leaf Can Hide Several Devices. One Stolen Device Can Speak for All.
The latest MLS virtual-client draft offers a smaller, quieter group tree. Its bill comes due when a device is lost: every group behind the shared identity needs fresh keys.
IETF
A BGP Rule Can Name Packet Bytes. A Blind Box Must Refuse the Whole Filter.
An IETF working-group draft lets FlowSpec describe a fixed byte pattern inside traffic. The hard rule is what happens when a device cannot inspect it: the remaining, broader filter must stay off.
IETF
The Registry May Move the Door. Your Credentials Do Not Follow Automatically.
An IETF working-group draft gives domain provisioning a controlled detour: the request can move to a new server, but the registrar must decide separately where its credentials belong.
IETF
The Quantum-Safe Password Still Introduces You in Plain Sight
A new experimental EAP proposal protects a recorded password exchange against future quantum attacks. Its first message still tells an observer who is talking, and its server keeps a verifier that becomes dangerous when stolen.
Member Unlock
Restricted Profile Intelligence
Login is required to unlock full profile briefings and deep-dive sections.
Leadership Alliance Briefing
For IP-asset owners and leadership teams: alliance briefings, private reports and direct analyst support.
Join Leadership Alliance