Intelligence
Latest Articles
Latest intelligence on infrastructure operators, policy decisions, market moves, and digital power shifts.
History
The Header That Appeared Only When It Saved Bytes: How IPComp Made Compression Conditional
IPComp negotiated a common way to decompress traffic, then allowed each packet to decline the offer. If compression plus its four-byte header did not make that packet smaller, the correct wire format was the original packet with no IPComp header at all. Capability lived in the…
History
The Datagram Relay That Died with a Stream: How SOCKS5 Bound UDP to a TCP Association
A SOCKS5 relay could still be receiving perfectly formed UDP datagrams when its TCP control connection vanished. The specification nevertheless ended the association. UDP had no farewell to offer, so the protocol borrowed a lifetime from a different transport—and kept that…
History
The Key That Could Not Lock the Tunnel: How GRE Separated Flow Identity from Security
GRE called a four-byte field a Key before the specification could say what that key opened. Six years later, the standards-track repair gave it a smaller and more useful job: distinguish one logical flow inside a tunnel. The name survived. The claim of security did not.
CASE FILE
W3C Resolved to Change WCAG 3. It Did Not Freeze the Text
On 25 August, the Accessibility Guidelines Working Group adopted three resolutions that pointed editors to a conformance draft and told them to resolve the document's remaining comments before updating WCAG 3. That was a real group decision. It was not approval of every word that…
CASE FILE
The Handshake Combined Two Secrets. The Random Generator Was Still One
RFC 10024 gives TLS 1.3 a precise way to combine a traditional exchange with ML-KEM. The construction protects against the failure of one cryptographic assumption; it does not certify that the two components were executed inside independent operational failure domains.
Story
Four Counterparty Pairs Made 89% of RIPE NCC's July IPv4 Transfer Total
RIPE NCC's August member update says 5,935,616 IPv4 addresses were transferred in July, 4,159,744 more than in June. The public transfer tables reproduce both numbers exactly. They also change the meaning of the headline: four repeated from-to pairs account for 5,299,712…
CASE FILE
The Name Matched. The Key Had No Right to Revoke: RFC 10007 and the Missing `cRLSign` Proof
One certification authority gave the same named subject two different keys. Only one was meant to sign revocation lists. For years, the validation text could let the other key cross that boundary precisely because its certificate said nothing about permitted use.
History
The Pointer That Named the Bad Byte: How ICMP Made Rejection Diagnosable
A packet could be legal enough to arrive yet malformed enough that parsing had to stop. ICMP's Parameter Problem message did not rescue that packet. It did something more modest and more useful: it let the rejecting machine discard the packet while naming the byte at which its…
IETF
Peter Thomassen and the Update That Needed Every Authoritative Server
A child zone can publish a perfectly signed request for its parent to change trust or delegation data. RFC 9975 asks a harder question before the parent acts: did the request come from the delegated authoritative service as a whole, or only from the one server that happened to…
History
The First Packet Was Only a Candidate: How RTP Made Continuity Earn Trust
One packet can look perfectly respectable. Its version is right, its payload type is familiar, its length is plausible and its source number has not appeared before. RTP nevertheless refused to let that isolated packet define a stream. A receiver first had to see a relationship…
Story
APNIC Deferred Its Singapore Subsidiary. Its Public Record Still Lacks a Payment Baseline
APNIC did something institutions often find difficult: it investigated a proposed remedy and stopped when the assessed costs and risks exceeded the likely benefit. The unresolved question is not why Singapore was rejected. It is how the Member payment problems that started the…
IETF
IETF LLC Needs More Financial Signers. A Signer Still Is Not the Decision
IETF Administration LLC has identified a real resilience problem: a Treasurer's departure left one authorised signatory for both its bank and investment adviser. The proposed staff signer could help execute Board decisions. It should not blur who made them. The durable control is…
CASE FILE
The JSON Was Valid. The Trunk Still Needed an Owner: RFC 10006 and the Apply Boundary
A service provider can now describe a SIP trunk in a form an enterprise edge can discover, authenticate for and parse. The consequential question begins one step later: who is entitled to turn that description into running configuration?
Story
LACNIC’s TAL Page Shows Two URLs and Links to Two Others
LACNIC’s trust-anchor page presents two addresses as TAL downloads. A reader who clicks them reaches distinct, valid TAL files through legacy Innovaportal targets. A reader or script that copies the addresses printed on the page instead receives the same HTML application shell…
CASE FILE
The Boot Loader Identified Itself. The Relying Party Still Had to Decide
RFC 10013 gives a measured component a portable identity and sampled value inside an Entity Attestation Token. That evidence can be fresh, signed and correctly encoded while the final question — what this device may do — remains unanswered.
History
The Handle That Outlived the Path: How NFS Made Identity Opaque and Staleness Explicit
A pathname tells a client how to search a filesystem. It does not have to be the identity by which later operations reach the file. NFS built that separation into a small opaque value called a file handle, then spent successive protocol versions defining exactly how long the…
IETF
Paul Hoffman and the Root Copy That Could Answer Only Its Own Host
A recursive resolver can keep the entire DNS root zone close enough that a root query never leaves its machine. RFC 8806 permits that local execution path, then surrounds it with unusual restraints: the service cannot answer the next host, cannot invent a byte of root data…
Number Resource Society
A ROA Change Needs an Authorization-and-Withdrawal Ledger
A route can be Valid while the organization behind it has already forgotten who approved the authorization, what changed, or how to reverse it. ROA governance needs evidence that joins intent, publication, observation and withdrawal—not another screenshot of a green status.
History
The Counter That Fell While Traffic Kept Rising: How SNMP Marked a New Measurement Epoch
A link can carry traffic continuously while its byte counter suddenly becomes smaller. SNMP made that apparent contradiction manageable by separating normal numeric wrap, wider observation windows and an explicit marker for the moment a measurement history breaks.
CASE FILE
The Route Advertised 70. The Local Link Could Carry 50: RFC 10005 and Bandwidth Authority
One upstream says it has 70 units of capacity. The receiving router can reach that upstream only across a 50-unit local link, yet policy assigns it 70% of the traffic. The BGP UPDATE is valid, every session remains established, and congestion is still the expected result. RFC…