Intelligence
Latest Articles
Latest intelligence on infrastructure operators, policy decisions, market moves, and digital power shifts.
History
The Name TLS Had to Hear Before It Could Hide It: How SNI Made Shared HTTPS Possible
At a shared address, a TLS server had to choose a certificate before it could decrypt the HTTP request that named the intended site. Server Name Indication resolved that ordering problem by putting the name in the ClientHello—making virtual HTTPS practical while leaving the…
IETF
Final Review Is Not a Second Standards Vote
The release register showed an approved Internet-Draft, an open pull request and several author approvals still outstanding. Its operator compressed those facts into one alarming note: “the standard has been reopened for another vote.” The public record showed something more…
CASE FILE
Two paths, one hot link: governing BGP multipath
Two routes can be equally eligible, present in the forwarding table and still fail to share capacity in the way an operator expects. Multipath is permission to use a set of paths—not a promise about what the traffic inside that set will do.
CASE FILE
The Header Said DKIM Passed. It Did Not Say Who Ran the Test: Authentication-Results and the Authority of a Trust Boundary
Two messages arrive with the same line near the top: `Authentication-Results: mx.example; dkim=pass`. One line was written by the receiver after it checked the signature. The other was supplied by the sender before the SMTP connection began. A downstream rule sees identical…
History
The Row That Existed Before It Was Ready
An SNMP manager can write `createAndWait`, yet it can never read `createAndWait` back. What returns may be `notReady`: the row now exists, but the device cannot yet attempt to use it. That asymmetry turned a request into an action and incompleteness into an observable fact.
History
The Memory the Server Sealed for Later: How TLS Session Tickets Made State Client-Carried
A TLS server learned to put its own resumable memory into a sealed entity and ask the client to bring it back. The arrangement saved per-client storage, but it did not abolish state: it concentrated acceptance in ticket keys, expiry rules and a fallback the server still…
CASE FILE
The Certificate Was the Same. The Service Name Was Not: DANE TLSA and the Authority of a Port-Bound Assertion
The certificate chain was identical on two listeners. One DANE-aware client accepted it; the other rejected it. Nothing cryptographic had changed inside the certificate. The selected service had changed, and the DNS assertion was never written for that second port.
CASE FILE
BGP’s quiet instruction: who gets to prefer an exit?
LOCAL_PREF can send traffic towards a longer path without telling an external neighbour why. Its power lies in the local policy behind the number—and in whether that policy survives the journey from a border router to actual packets.
History
Two Registrations, One Phone
The edge proxy had already crashed and restarted. The incoming call had already reached the service. The phone, however, had not yet learned that its old return path was gone. SIP Outbound was designed for precisely this interval—and for the harder question that followed: when…
IETF
Eric Vyncke and the Probe Label That Could Not Confer Trust
An unsolicited packet arrives before its explanation does. Eric Vyncke’s work on RFC 9511 asks whether a measurement sender can make that first encounter less opaque without demanding a new protocol, a central registry or automatic trust—and answers by drawing a hard line between…
North America Regional ISP Trends
The Dollar Before the Splice: Lumen’s Prepaid Fibre Test
At Lumen Technologies, customer cash can arrive while a long-haul network is still an unfinished physical system: before the final splice is made, before optics are commissioned across the route, and before service has satisfied the conditions needed for customer delivery and…
History
The Server Carried the Proof: How OCSP Stapling Moved Evidence, Not Authority
A website could hand a visitor a signed answer about its own certificate without becoming entitled to write that answer. OCSP stapling made that separation useful—and left a less visible bargain over freshness, silence and who must keep the evidence available.
Leaders
Aidan Casey and the Operational Burden Hidden Inside Managed IT
ARIN lists one executive in five network roles, exposing hidden managed-IT work without proving sole control, resilience or customer outcomes.
Story
LACNIC’s RDAP Last Changed Event Dates the Registry Record, Not the Network Handover
A timestamp in a registration record can anchor an investigation, but it cannot substitute for the event the investigator actually needs to prove. LACNIC’s live RDAP data makes that boundary unusually visible: a network entity and the entities embedded inside it carry different…
ICANN
The Domain Name Became the Defendant: Porsche.net and the ACPA's In Rem Route
A lawsuit that began by naming 128 domain names exposed a precise legal control problem: when a registrant cannot be reached through an ordinary personal action, what lets a federal court take authority over the registration itself—and when is it too late to challenge that route?
Global Cloud Services
Datadog’s Observability Pipelines Move the Cost Cut Upstream
Datadog offers a way to reduce telemetry volume before it leaves a customer’s environment. That can lower a downstream bill, but it also moves the authority to discard operational evidence to a point where a later search cannot recover it.
Global Cloud Services
A DDoS Scrubbing Contract Must Say Who Delivers the Clean Gigabit
A mitigation cloud can absorb an attack measured in terabits and still leave one customer's legitimate traffic dependent on a much smaller circuit, tunnel and router. The purchase decision is therefore not only how much hostile traffic the provider can discard. It is what clean…
IETF
The Timer the Peer Could Hear: TCP User Timeout Without Negotiated Patience
One TCP endpoint could decide how long unanswered data was worth keeping, but the other endpoint could not hear that decision. RFC 5482 put the timeout on the wire as advice. The difficult part was preserving the distinction between a useful warning and a promise neither side had…
Global Cloud Services Trends
A Certificate Transparency Receipt Is Not Browser Acceptance Until the Log Set Is Reconciled
A certificate authority can return a certificate carrying several valid log receipts and still leave an operator with a failed browser handshake. Certificate Transparency becomes operational evidence only when the receipt is reconciled with the policy and log set used by the…
Africa National Telecom
A Tower Sale Does Not Sell the Power Bill
Selling passive mobile infrastructure can release capital and move steel, shelters and site operations to a tower company. It does not answer who pays when diesel rises, a generator burns too much fuel, a ground lease lapses or an uptime target is missed. Those outcomes live in…