Intelligence
Latest Articles
Latest intelligence on infrastructure operators, policy decisions, market moves, and digital power shifts.
IETF
Russ Housley and the MAC Address a Certificate Could Name but Not Make Unique
Six bytes can fit cleanly inside a certificate. The difficult part begins after they leave it: who assigned them, what interface is using them now, who observed that use, and why a local network should permit an action.
History
The Fastest Path Carried the Clock. It Did Not Choose the Master: How RFC 891 Bound Routing and Time to One HELLO
In the Fuzzball network, one HELLO could change both the route to a host and the clock offset associated with that route. The economy was deliberate, but authority remained divided: measured delay selected a path, configuration named the master, and the local clock decided…
CASE FILE
SC101 Closes a Domain-Control Gap. The Transition Still Permits Two Rulebooks
A certificate authority can now point to one current set of TLS Baseline Requirements while legitimately running one of two different domain-control derivation rules. SC101 made the safer order explicit: choose the validation method, follow a permitted CNAME path, then prune…
History
The Frame Was Longer Than the Datagram: How RFC 894 Kept Ethernet Padding Out of IP
An Ethernet interface could deliver 46 data octets even when the IPv4 datagram inside it ended sooner. RFC 894 did not resolve the mismatch by stretching IP. It assigned two rulers to two layers: Ethernet supplied enough zeroes to satisfy its physical minimum, while the IP Total…
CASE FILE
The Label Named the Encoding. It Did Not Name the Schema: RFC 9996 and Authority Behind a Protobuf Payload
A gateway accepts `application/protobuf`, the decoder returns a message value, and the request enters the business system. None of those successes establishes that the receiver used the producer's intended message definition. RFC 9996 gives Protocol Buffers a proper outer label.…
Story
AFRINIC's New-Member Portal Names Three Preflight Guides. All Three Links Return the Same 404
AFRINIC's application portal is online and unusually clear about what a prospective member should read before applying. The problem is in the handoff: process, eligibility and supporting documents are presented as three separate guides, but each link depends on the same page that…
IETF
Benoît Claise and the Augment the Base Module Could Not Name
A YANG module can list the modules it imports. It cannot, by reading itself, identify every external module that later inserts nodes into its schema tree. RFC 10035 makes that hidden direction reportable—one direct edge at a time.
Europe and Middle East National Telecom Trends
A rural 4G mast is not local coverage until the operator and location match
A mast can be live, a national target can be met and a particular phone can still lack usable service at the place that matters. Local acceptance begins only after the operator, place and context are named.
History
The First Answer Was Not the Last Word: How RFC 887 Separated Discovery from Confirmation
A host in 1983 could ask an entire local network who provided a service. Yet RFC 887 refused to treat the first name it heard as final truth. Broadcast discovery, an explicit negative answer, a third-party hint and a provider’s own confirmation were four different kinds of…
CASE FILE
WebDriver May Live at Candidate Recommendation. Cite the Snapshot
W3C's proposed Browser Testing and Tools charter makes an unusual choice explicit. WebDriver and WebDriver BiDi would be developed toward Candidate Recommendation, updated through Snapshots, and not deliberately advanced to Recommendation. That can fit technology implemented…
IETF
Kazuho Oku and the Header That Makes Refusal Legible but Cannot Promise Streaming
An HTTP field can require a proxy that understands it to reject instead of quietly buffering. It cannot command a proxy that has never learned the field. RFC 10036 improves the evidence around incremental delivery precisely by preserving that distinction.
History
The List Called It Official. It Still Did Not Call It Implemented: How RFC 880 Separated Status from Running Code
One row in RFC 880 called the Gateway Gateway Protocol experimental. The same row said it was then used in the core gateways. The apparent contradiction was the point: classification, deployment and fitness were different facts, and the Internet's official catalogue kept them in…
CASE FILE
The Envelope Signed the Digest. It Did Not Deliver the Preimage: RFC 9995 and the Authority Behind a COSE Hash Envelope
A release gate receives a valid signature over the digest of an SBOM. The envelope is small, the cryptography checks out, and the signed location points to a repository. Yet the SBOM itself is absent. Nothing has been downloaded, compared, parsed or judged. RFC 9995 makes the…
CASE FILE
The Proposed WebAuthn Charter Opens Raw Signing. Scope Is Not Approval
W3C is considering a larger mandate for Web Authentication. The proposed charter would let the group work on signatures over arbitrary data, including uses associated with agentic AI and verifiable digital credentials. That sentence opens a standards room; it does not certify the…
Europe and Middle East National Telecom Trends
An NG eCall button is not a proven local safety service until the 4G/5G path is ready
A visible SOS control and an eligible registration date can establish that a vehicle may carry Next Generation eCall. They do not prove that the current UK vehicle-to-emergency-service path is ready to rely on.
AUSNOG
AusNOG Turns Conference Attendance Into Voting Power
AusNOG does more than reward people who keep showing up. Its published rules convert event attendance into membership classes, then convert those classes into different numbers of votes at general meetings.
Story
RIPE NCC Began Verifying Roughly 1,600 No-Contract Legacy Holders. Its Q3 Plan Still Describes Two-Place Updates
RIPE NCC has a sensible plan to give old resource records a clearer organisational anchor. Its own quarterly plan also reveals the awkward middle of that migration: one change may still have to be performed manually in two places. The test is not whether the campaign looks…
IETF
Aaron Parecki and the BFF That Stops Token Theft but Not Client Hijacking
Putting OAuth tokens behind a server is a material security improvement. It is not the end of the authorization story. RFC 10017 shows why: malicious browser code may be unable to steal a token and still be able to spend the user’s live session through the same Backend for…
ICANN
The Proposed Root-Server Governance Model Would Allow Suspension. It Does Not Define Reinstatement
The final proposal for governing the DNS root-server system reserves its sharpest verb for an extreme security case: the future Security Incident Reporting function could suspend a root server operator. The model is careful about how full authority would begin and how permanent…
History
The Back Door Was Not a Route: How RFC 831 Reached a Partitioned SATNET
The emergency machine was allowed to behave like a gateway, but it was forbidden to become one. That distinction carried the whole proposal in RFC 831. A multihomed host at UCL could rewrite a chosen maintenance exchange around a broken SATNET path, yet it would send no routing…