Intelligence
Latest Articles
Latest intelligence on infrastructure operators, policy decisions, market moves, and digital power shifts.
History
The Success That Ended Its Own Stream: How XMPP Restarted After TLS and SASL
In XMPP, a successful security negotiation did not authorize the old XML stream to continue. It made that stream obsolete. The parties kept the same TCP connection, discarded context that no longer deserved trust, exchanged new stream headers and learned again which features were…
History
The Characters the Checksum Never Saw: How PPP Filtered the Serial Path Before Trusting the Frame
PPP did not ask its checksum to remember every character that crossed a serial path. It first defined which bytes belonged to the frame, which were temporary disguises, and which low control characters intervening equipment might have inserted. Only after the receiver reversed…
CASE FILE
The Tree Was Active. One Leaf Still Had No Packet: RFC 10018 and the P2MP Closeout Boundary
The Tree Was Active. One Leaf Still Had No Packet: RFC 10018 and the P2MP Closeout Boundary intelligence summary explains the development, the public evidence available to readers, the organisations involved, the regional context, market exposure, and the infrastructure…
CASE FILE
The Endpoint Still Spoke TLS 1.2. Its Old Handshake Had to Go: RFC 10015 and the Retirement Boundary
RFC 10015 does not switch TLS 1.2 off. It makes a more exacting intervention: keep the protocol version where it is still needed, but remove the finite-field Diffie-Hellman and RSA key-exchange paths whose risk can no longer be justified. The hard part begins after that sentence…
History
The Header That Appeared Only When It Saved Bytes: How IPComp Made Compression Conditional
IPComp negotiated a common way to decompress traffic, then allowed each packet to decline the offer. If compression plus its four-byte header did not make that packet smaller, the correct wire format was the original packet with no IPComp header at all. Capability lived in the…
History
The Datagram Relay That Died with a Stream: How SOCKS5 Bound UDP to a TCP Association
A SOCKS5 relay could still be receiving perfectly formed UDP datagrams when its TCP control connection vanished. The specification nevertheless ended the association. UDP had no farewell to offer, so the protocol borrowed a lifetime from a different transport—and kept that…
History
The Key That Could Not Lock the Tunnel: How GRE Separated Flow Identity from Security
GRE called a four-byte field a Key before the specification could say what that key opened. Six years later, the standards-track repair gave it a smaller and more useful job: distinguish one logical flow inside a tunnel. The name survived. The claim of security did not.
CASE FILE
W3C Resolved to Change WCAG 3. It Did Not Freeze the Text
On 25 August, the Accessibility Guidelines Working Group adopted three resolutions that pointed editors to a conformance draft and told them to resolve the document's remaining comments before updating WCAG 3. That was a real group decision. It was not approval of every word that…
CASE FILE
The Handshake Combined Two Secrets. The Random Generator Was Still One
RFC 10024 gives TLS 1.3 a precise way to combine a traditional exchange with ML-KEM. The construction protects against the failure of one cryptographic assumption; it does not certify that the two components were executed inside independent operational failure domains.
Story
Four Counterparty Pairs Made 89% of RIPE NCC's July IPv4 Transfer Total
RIPE NCC's August member update says 5,935,616 IPv4 addresses were transferred in July, 4,159,744 more than in June. The public transfer tables reproduce both numbers exactly. They also change the meaning of the headline: four repeated from-to pairs account for 5,299,712…
CASE FILE
The Name Matched. The Key Had No Right to Revoke: RFC 10007 and the Missing `cRLSign` Proof
One certification authority gave the same named subject two different keys. Only one was meant to sign revocation lists. For years, the validation text could let the other key cross that boundary precisely because its certificate said nothing about permitted use.
History
The Pointer That Named the Bad Byte: How ICMP Made Rejection Diagnosable
A packet could be legal enough to arrive yet malformed enough that parsing had to stop. ICMP's Parameter Problem message did not rescue that packet. It did something more modest and more useful: it let the rejecting machine discard the packet while naming the byte at which its…
IETF
Peter Thomassen and the Update That Needed Every Authoritative Server
A child zone can publish a perfectly signed request for its parent to change trust or delegation data. RFC 9975 asks a harder question before the parent acts: did the request come from the delegated authoritative service as a whole, or only from the one server that happened to…
History
The First Packet Was Only a Candidate: How RTP Made Continuity Earn Trust
One packet can look perfectly respectable. Its version is right, its payload type is familiar, its length is plausible and its source number has not appeared before. RTP nevertheless refused to let that isolated packet define a stream. A receiver first had to see a relationship…
Story
APNIC Deferred Its Singapore Subsidiary. Its Public Record Still Lacks a Payment Baseline
APNIC did something institutions often find difficult: it investigated a proposed remedy and stopped when the assessed costs and risks exceeded the likely benefit. The unresolved question is not why Singapore was rejected. It is how the Member payment problems that started the…
IETF
IETF LLC Needs More Financial Signers. A Signer Still Is Not the Decision
IETF Administration LLC has identified a real resilience problem: a Treasurer's departure left one authorised signatory for both its bank and investment adviser. The proposed staff signer could help execute Board decisions. It should not blur who made them. The durable control is…
CASE FILE
The JSON Was Valid. The Trunk Still Needed an Owner: RFC 10006 and the Apply Boundary
A service provider can now describe a SIP trunk in a form an enterprise edge can discover, authenticate for and parse. The consequential question begins one step later: who is entitled to turn that description into running configuration?
Story
LACNIC’s TAL Page Shows Two URLs and Links to Two Others
LACNIC’s trust-anchor page presents two addresses as TAL downloads. A reader who clicks them reaches distinct, valid TAL files through legacy Innovaportal targets. A reader or script that copies the addresses printed on the page instead receives the same HTML application shell…
CASE FILE
The Boot Loader Identified Itself. The Relying Party Still Had to Decide
RFC 10013 gives a measured component a portable identity and sampled value inside an Entity Attestation Token. That evidence can be fresh, signed and correctly encoded while the final question — what this device may do — remains unanswered.
History
The Handle That Outlived the Path: How NFS Made Identity Opaque and Staleness Explicit
A pathname tells a client how to search a filesystem. It does not have to be the identity by which later operations reach the file. NFS built that separation into a small opaque value called a file handle, then spent successive protocol versions defining exactly how long the…