Open standards body with worldwide implementation impact.
Governance / IETF
IETF
IETF governance intelligence tracks institutions, policy processes, standards activity, registry operations, accountability disputes, and implementation signals that affect internet infrastructure. BTW.
GlobalProtocol GovernanceInteroperability Risk
Protocol process and standards legitimacy.
Spec-to-implementation gap across vendors and operators.
Major standards shifts usually affect systems over 120d+ cycles.
Latest Coverage
Latest from IETF
1,256 articles
IETF
RFC 9925 Made an X.509 Certificate Unsigned. Its Trust Must Arrive Elsewhere
RFC 9925 defines a certificate-shaped entity whose signature value is deliberately empty. Its issuer field may even repeat the subject for compatibility, yet the document says the value is only a placeholder: the entity has no issuer and is neither self-signed nor self-issued.…
IETF
Christopher A. Wood and the Privacy Boundary No One Operator Should Hold
Oblivious HTTP does not ask an operator to forget what it can see. It rearranges the transaction so that one operator can see where a request came from and another can see what the request says—then makes the absence of a single complete view the privacy control.
IETF
IETF Wants to Promote RFC 7405. Its Deployment Proof Is Still Aggregate
The IETF has opened a four-week Last Call on moving a four-page grammar extension from Proposed Standard to Internet Standard. The extension is old, useful and widely cited. The harder question is not whether `%s"text"` is convenient. It is whether a public count of…
IETF
Martin Thomson and the Key Log That Could Decrypt a Session but Not Prove It
The incident package looked decisive: a packet capture, a small text file and a screenshot of readable TLS traffic. The decryption had worked. Yet the file did not say who enabled logging, which endpoint produced the secret, when it was collected or whether the alleged session…
IETF
Todd Herr and the DMARC Pass That Did Not Make the Message Safe
The green word `pass` can be perfectly correct and dangerously misunderstood. In DMARC it certifies a narrow relationship between domains. It does not certify the person in the display name, the proposition in the message, the attachment behind the button or the wisdom of putting…
IETF
Adrian Farrel and the Implementation Receipt That Disappeared Before Publication
One of the most useful sections in an Internet-Draft is written with an expiry condition. It can name the code, version, coverage, licence, test contact and interoperability evidence that made a proposal real. Then, if the proposal becomes an RFC, the section is supposed to…
IETF
Qin Wu and the Registry Rule That Had to Catch Up With Practice
The same YANG module name appears three times in IANA’s register, attached to three dates and one XML namespace. That is not a uniqueness failure. It is the evidence needed to distinguish a stable identity from the revisions that change inside it.
IETF
IETF Declined the AUDIT BoF. Its New List Is a Venue, Not a Working Group
On 31 August, the IETF opened a mailing list for a possible effort to make AI-agent actions auditable. That was a useful institutional step. It was not approval of the effort that proponents had requested: the public BoF record remains Declined, the list is explicitly non-WG, and…
IETF
Daniel Eggert and the Message Batch That Was Not a Stable Page
A UID range can divide a mailbox into manageable work without freezing that mailbox, enumerating its messages or making each unit equally expensive. RFC 10022 gives clients a partition. It does not give them pagination certainty.
IETF
Pradosh Mohapatra and the Bandwidth Value That Was Not Available Capacity
A route can advertise a perfectly valid bandwidth number while the usable path behind it is smaller, older or defined by an entirely different rule. RFC 10005 makes the number portable. It does not make it a measurement of capacity now available to traffic.
IETF
Hooman Bidgoli and the Leaf Set That Was Not a Delivered Multicast Service
The control plane can produce an orderly list of intended receivers while the data plane is still divided across controller state, replication segments, service context and receivers that have not seen a packet. RFC 10018 makes the list useful. It does not make the list a…
IETF
Carlos Pignataro and the Watt Reading That Did Not Prove a Greener Network
A power meter can report a precise number while leaving the environmental claim undecided. Turning that number into energy, emissions or permission to switch off spare capacity requires separate evidence—and a record of who accepted the trade.
IETF
IETF Marks Two Capture Controls Incomplete. Their Q4 Proof Needs a Public Map
One line in the IETF Administration LLC’s 2026 Risk Register names the institutional failure that open technical organizations are often least comfortable naming: “The IETF, or a key part of it, is captured.” The same line says two controls are complete and two remain unfinished…
IETF
Sean Turner and the Private-Key Proof That Did Not Authorize a Certificate
A certification request can carry a valid signature and still have no right to become the certificate it asks for. The signature answers a narrow question about a key; identity, namespace entitlement, intermediary action and issuance remain separate decisions.
IETF
Lukasz Kondrad and the RTP Group That Was Not Yet a Reconstructed Scene
A session description can place an atlas, occupancy, geometry and colour stream inside one V3C group. That is a precise statement about membership—not evidence that a receiver rebuilt the same three-dimensional scene.
IETF
IETF Tools Kept Every-Line Review for AI Code. Its Next Boundary Is Still Unwritten
The IETF Tools Team has named a genuine capacity problem: AI can produce ambitious pull requests faster than maintainers can safely absorb them. Yet the contribution guide it actually adopted in August still puts every submitted line in front of a human maintainer. That is a…
IETF
Panos Kampanakis and the SSH Session with Three Different Security Receipts
An SSH client can negotiate a hybrid ML-KEM key exchange, verify the server through a conventional host key, and admit a user through a still separate credential. The session is one connection; the evidence is not one claim.
IETF
Cullen Jennings and the Capability Document That Was Not a Live SIP Trunk
An enterprise edge device can discover the right URL, pass TLS and OAuth, receive HTTP 200 and parse a valid provider capability document while no production call can cross the trunk. RFC 10006 makes configuration exchange easier; it does not collapse retrieval, activation…
IETF
IETF’s STIR Recharter Separates the Right to Use a Number From Entity Identity
A call can carry a valid cryptographic assertion for a telephone number and still leave a basic institutional question unanswered: which entity stands behind that authority, and in what capacity? The proposed STIR recharter names that gap directly. Its value will depend on…
IETF
Tobias Fiebig and the Four DNS Reachability Receipts
A zone can display two A records, two AAAA records and a reassuring “dual stack” label while still withholding names from an IPv6-only resolver. RFC 10001 replaces that label with four bounded claims: two authoritative services must answer over IPv4 and two must answer over IPv6…
Member Unlock
Restricted Profile Intelligence
Login is required to unlock full profile briefings and deep-dive sections.
Strategic Circle Briefing
Join to unlock strategic briefings after signing in.
Join Strategic CircleLeadership Alliance Briefing
For qualified IP-asset owners and management; sign in to unlock alliance briefings.
Join Leadership Alliance