Open standards body with worldwide implementation impact.
Governance / IETF
IETF
IETF governance intelligence tracks institutions, policy processes, standards activity, registry operations, accountability disputes, and implementation signals that affect internet infrastructure. BTW.
GlobalProtocol GovernanceInteroperability Risk
Protocol process and standards legitimacy.
Spec-to-implementation gap across vendors and operators.
Major standards shifts usually affect systems over 120d+ cycles.
Latest Coverage
Latest from IETF
1,098 articles
IETF
IETF’s STIR Recharter Separates the Right to Use a Number From Entity Identity
A call can carry a valid cryptographic assertion for a telephone number and still leave a basic institutional question unanswered: which entity stands behind that authority, and in what capacity? The proposed STIR recharter names that gap directly. Its value will depend on…
IETF
Tobias Fiebig and the Four DNS Reachability Receipts
A zone can display two A records, two AAAA records and a reassuring “dual stack” label while still withholding names from an IPv6-only resolver. RFC 10001 replaces that label with four bounded claims: two authoritative services must answer over IPv4 and two must answer over IPv6…
IETF
Weiqiang Cheng and the SRv6 Locator Lease That Still Needed a Route
The DHCPv6 log can show a valid Reply, a locator, an IAID and two working clocks while the route table still has nothing to say. RFC 10038 makes that gap explicit: assignment is one controlled event; reachability must be created, distributed and observed through separate systems.
IETF
The IETF ‘Believed’ Its Last Cutover Delivered Every Message. This Time It Can Prove It
On 11 September, the IETF plans to replace much of the machinery that receives, checks, rewrites and sends mail for four of its institutional domains. A one-hour delay would be tolerable. An unexplained hole in a working-group record would not. The difference cannot be…
IETF
Bas Westerbaan and the Hybrid TLS Handshake That Did Not Make the Certificate Post-Quantum
A browser can report `X25519MLKEM768`, derive a session secret from classical and post-quantum components, and still authenticate the server with a classical certificate signature. Both observations can be true in the same TLS 1.3 connection. Calling the whole service…
IETF
Daniel Fett and the QR Context That MFA Never Authenticated
The password was right, the second factor was real and the authorization server behaved as designed. The attacker still received the session, because the ceremony proved who the user was without proving whose request the user had approved.
IETF
Mike McBride and the Multicast Registry That Prevented One Kind of Collision
Two IPv6 multicast allocation methods had been told to draw identifiers from the same box. RFC 10028 divided the box before a future host protocol and an old server protocol could make the same choice—and left operators with the harder job of proving that their networks had…
IETF
Gavin Brown and the Successful Create That Did Not Yet Register a Domain
The server said the command had completed successfully. In the same breath, it said the action was still pending. RFC 8334 makes that apparent contradiction useful: an accepted application is evidence, but it is not yet a registered domain.
IETF
RADEXT’s Recharter Is Still Under Review. Seven Milestones Are Dated May or August
The proposed RADEXT charter has two clocks. Its approval clock still reads External Review. Its delivery table carries two milestones dated May 2026 and five dated August. That does not prove seven failures: some work is active, some awaits adoption, and the proposal itself is…
IETF
Russ Housley and the MAC Address a Certificate Could Name but Not Make Unique
Six bytes can fit cleanly inside a certificate. The difficult part begins after they leave it: who assigned them, what interface is using them now, who observed that use, and why a local network should permit an action.
IETF
Benoît Claise and the Augment the Base Module Could Not Name
A YANG module can list the modules it imports. It cannot, by reading itself, identify every external module that later inserts nodes into its schema tree. RFC 10035 makes that hidden direction reportable—one direct edge at a time.
IETF
Kazuho Oku and the Header That Makes Refusal Legible but Cannot Promise Streaming
An HTTP field can require a proxy that understands it to reject instead of quietly buffering. It cannot command a proxy that has never learned the field. RFC 10036 improves the evidence around incremental delivery precisely by preserving that distinction.
IETF
Aaron Parecki and the BFF That Stops Token Theft but Not Client Hijacking
Putting OAuth tokens behind a server is a material security improvement. It is not the end of the authorization story. RFC 10017 shows why: malicious browser code may be unable to steal a token and still be able to spend the user’s live session through the same Backend for…
IETF
Hannes Tschofenig and the Authority ID That Was Not the Token Signer
A measured component can name the key that signed its firmware and still say nothing about the key that signed the enclosing attestation token. RFC 10013 makes that boundary explicit. The identifier, the measurement, the EAT signature and the relying party’s decision are four…
IETF
Corey Bonnell and the CRL Signature Whose Key Was Not Authorized
A certificate revocation list can carry a flawless digital signature and still be signed by the wrong certified key. RFC 10007 closes that uncomfortable gap by requiring a version 3 CRL issuer certificate to say, explicitly, that its key may sign CRLs. The change turns a skipped…
IETF
Kireeti Kompella and the Echo Reply That Did Not Prove the Service
An MPLS Echo Reply can show that one carefully constructed probe reached a router able to account for a particular forwarding equivalence class. That is a precise and valuable result. It does not show that every equal-cost path worked, that a dormant backup was usable, that the…
IETF
Eliot Lear and the Device Policy That Was Never an Attestation
A limited-purpose device can tell a network which communications it needs without proving what the device is, who currently controls it, or whether it will behave as described. RFC 8520 makes that narrow statement useful through Manufacturer Usage Description, then leaves the…
IETF
Tero Kivinen and the New IKE SA That Inherited Live Child SAs
In IKEv2, the word “rekey” can describe two materially different successions. Replacing the protected control association creates a new IKE SA, yet the Child SAs carrying ESP or AH traffic can remain exactly the ones already in service. The distinction documented in RFC 7296…
IETF
The Old Segment Killed the New Connection: TCP's TIME-WAIT Assassination
A TCP connection can close before every copy of its packets has disappeared. TIME-WAIT is the protocol's quarantine between incarnations of the same conversation; RFC 1337 showed how an old segment could provoke the reset that ended that quarantine early.
IETF
Roy Fielding and the Method That Named an Intention, Not a Permission
An HTTP request begins with a compact public word. That word can tell a client, cache or intermediary what kind of result is being sought. It cannot say who is entitled to obtain it, whether the target will comply, or what happened after a connection failed. The architecture…
Member Unlock
Restricted Profile Intelligence
Login is required to unlock full profile briefings and deep-dive sections.
Strategic Circle Briefing
Join to unlock strategic briefings after signing in.
Join Strategic CircleLeadership Alliance Briefing
For qualified IP-asset owners and management; sign in to unlock alliance briefings.
Join Leadership Alliance