Intelligence
Latest Articles
Latest intelligence on infrastructure operators, policy decisions, market moves, and digital power shifts.
CASE FILE
The Handshake Combined Two Secrets. The Random Generator Was Still One
RFC 10024 gives TLS 1.3 a precise way to combine a traditional exchange with ML-KEM. The construction protects against the failure of one cryptographic assumption; it does not certify that the two components were executed inside independent operational failure domains.
Story
Four Counterparty Pairs Made 89% of RIPE NCC's July IPv4 Transfer Total
RIPE NCC's August member update says 5,935,616 IPv4 addresses were transferred in July, 4,159,744 more than in June. The public transfer tables reproduce both numbers exactly. They also change the meaning of the headline: four repeated from-to pairs account for 5,299,712…
CASE FILE
The Name Matched. The Key Had No Right to Revoke: RFC 10007 and the Missing `cRLSign` Proof
One certification authority gave the same named subject two different keys. Only one was meant to sign revocation lists. For years, the validation text could let the other key cross that boundary precisely because its certificate said nothing about permitted use.
History
The Pointer That Named the Bad Byte: How ICMP Made Rejection Diagnosable
A packet could be legal enough to arrive yet malformed enough that parsing had to stop. ICMP's Parameter Problem message did not rescue that packet. It did something more modest and more useful: it let the rejecting machine discard the packet while naming the byte at which its…
IETF
Peter Thomassen and the Update That Needed Every Authoritative Server
A child zone can publish a perfectly signed request for its parent to change trust or delegation data. RFC 9975 asks a harder question before the parent acts: did the request come from the delegated authoritative service as a whole, or only from the one server that happened to…
History
The First Packet Was Only a Candidate: How RTP Made Continuity Earn Trust
One packet can look perfectly respectable. Its version is right, its payload type is familiar, its length is plausible and its source number has not appeared before. RTP nevertheless refused to let that isolated packet define a stream. A receiver first had to see a relationship…
Story
APNIC Deferred Its Singapore Subsidiary. Its Public Record Still Lacks a Payment Baseline
APNIC did something institutions often find difficult: it investigated a proposed remedy and stopped when the assessed costs and risks exceeded the likely benefit. The unresolved question is not why Singapore was rejected. It is how the Member payment problems that started the…
IETF
IETF LLC Needs More Financial Signers. A Signer Still Is Not the Decision
IETF Administration LLC has identified a real resilience problem: a Treasurer's departure left one authorised signatory for both its bank and investment adviser. The proposed staff signer could help execute Board decisions. It should not blur who made them. The durable control is…
CASE FILE
The JSON Was Valid. The Trunk Still Needed an Owner: RFC 10006 and the Apply Boundary
A service provider can now describe a SIP trunk in a form an enterprise edge can discover, authenticate for and parse. The consequential question begins one step later: who is entitled to turn that description into running configuration?
Story
LACNIC’s TAL Page Shows Two URLs and Links to Two Others
LACNIC’s trust-anchor page presents two addresses as TAL downloads. A reader who clicks them reaches distinct, valid TAL files through legacy Innovaportal targets. A reader or script that copies the addresses printed on the page instead receives the same HTML application shell…
CASE FILE
The Boot Loader Identified Itself. The Relying Party Still Had to Decide
RFC 10013 gives a measured component a portable identity and sampled value inside an Entity Attestation Token. That evidence can be fresh, signed and correctly encoded while the final question — what this device may do — remains unanswered.
History
The Handle That Outlived the Path: How NFS Made Identity Opaque and Staleness Explicit
A pathname tells a client how to search a filesystem. It does not have to be the identity by which later operations reach the file. NFS built that separation into a small opaque value called a file handle, then spent successive protocol versions defining exactly how long the…
IETF
Paul Hoffman and the Root Copy That Could Answer Only Its Own Host
A recursive resolver can keep the entire DNS root zone close enough that a root query never leaves its machine. RFC 8806 permits that local execution path, then surrounds it with unusual restraints: the service cannot answer the next host, cannot invent a byte of root data…
Number Resource Society
A ROA Change Needs an Authorization-and-Withdrawal Ledger
A route can be Valid while the organization behind it has already forgotten who approved the authorization, what changed, or how to reverse it. ROA governance needs evidence that joins intent, publication, observation and withdrawal—not another screenshot of a green status.
History
The Counter That Fell While Traffic Kept Rising: How SNMP Marked a New Measurement Epoch
A link can carry traffic continuously while its byte counter suddenly becomes smaller. SNMP made that apparent contradiction manageable by separating normal numeric wrap, wider observation windows and an explicit marker for the moment a measurement history breaks.
CASE FILE
The Route Advertised 70. The Local Link Could Carry 50: RFC 10005 and Bandwidth Authority
One upstream says it has 70 units of capacity. The receiving router can reach that upstream only across a 50-unit local link, yet policy assigns it 70% of the traffic. The BGP UPDATE is valid, every session remains established, and congestion is still the expected result. RFC…
Europe and Middle East Regional ISP Trends
A tenant's fibre request is not an operator's right to enter the building
The installer has an order number, a coil of fibre and a resident waiting upstairs. The riser door is locked. The work pack says the customer has requested service, but it contains no signed access agreement, no completed notice chain and no court order. A simple phrase begins to…
Story
RIPE NCC’s Two Voting Codes Need a Credential Map
RIPE NCC tells October’s voters to expect two codes in two emails. That is a useful instruction, but it is not yet an account of the control. The names “Code 1” and “Code 2” describe a user journey; they do not show what each credential proves, who can recreate it, or when a…
Story
ARIN’s 29 August Stats Pair Split Across Two 2023 Filenames
ARIN’s public statistics directory contained a small but unusually legible publishing error on 29 August. The current data and checksum were available under their correct 2026 names, yet current-period artifacts also appeared through two extra paths dated 2023—and those two paths…
Story
AFRINIC Is Shrinking Its Data-Centre Footprint. Recovery Now Crosses a Cloud Boundary
AFRINIC's 2025 infrastructure report describes a sensible modernisation: retire obsolete equipment, use a smaller physical estate, place backups off site and test restoration every quarter. The harder question begins after the backup succeeds. Can the registry show that an…