Intelligence

Latest Articles

Latest intelligence on infrastructure operators, policy decisions, market moves, and digital power shifts.

A rural fibre construction manager reviews project paperwork beside cable reels while a crew works along the roadside.

North America Regional ISP Trends

BEAD awards do not become project cash until reimbursement clears

A fibre crew can finish a week's work while the contractor's payroll and the supplier's invoice fall due before the state has accepted the next BEAD payment trigger. The award may be valid, the construction eligible and the project economic, yet the subgrantee still has to…

An unlabeled network module waits in one transparent cradle beside an empty transfer cradle in a registry operations room.

Story

At LACNIC, the Most Valuable IPv4 Option Is Waiting

At LACNIC, the Most Valuable IPv4 Option Is Waiting intelligence summary explains the development, the public evidence available to readers, the organisations involved, the regional context, market exposure, and the infrastructure consequences that may follow. The Story…

Editorial illustration of a dual-stack client racing separate IPv6 and IPv4 paths to one server

IETF

The quarter-second bargain behind Happy Eyeballs

Happy Eyeballs turned dual-stack connection setup into a managed race. Its success lies in making path failure less visible to users; its cost is that the same success can make broken paths less urgent to repair.

A persistent grey address token remains on an interface while a preferred teal temporary token gains a successor, turns amber when deprecated and finally dissolves after its valid lifetime.

History

The Address That Expired to Protect Its User: IPv6 Temporary Addresses

IPv6 privacy extensions did not make an address secret. They changed which address a host would prefer for its next conversation, how long that preference lasted, and when the identifier finally had to leave the interface.

One receiver selects a single amber source path through a branching glass multicast network while two other sources remain outside the admitted channel.

IETF

Joining the group is no longer enough: SSM makes the receiver name the sender

Source-Specific Multicast turns a multicast join into a choice: the receiver must identify both the group it wants and the source it is willing to hear.

Anonymous domain records pass through a mechanical difference engine and three permission gates toward phone, mail and email channels.

ICANN

The Public Query Became a Private Lead Machine: Register.com v. Verio

A daily list of newly registered domains looked like public infrastructure until Verio connected it to automated WHOIS queries and rapid sales calls. The resulting case is less a monument to web-contract doctrine than a practical warning about layered permission: public data, a…

An engineer uses a console laptop at a roadside fibre cabinet while a separate cable reaches an independent radio link at a remote network site.

Global Regional ISP Trends

Put the recovery circuit outside the failure it must repair

A network site is not locally controllable merely because its equipment is nearby. Control exists only if the people expected to restore the site can still reach, authenticate to, understand and change it after the production path has failed.

An abstract DNS evidence junction routes verified signals toward different mitigation paths while a larger legitimate network remains active.

ICANN

When a DNS-Abuse Report Becomes Actionable—and What the Contract Still Does Not Order

The decisive step in ICANN's DNS-abuse regime is not the arrival of an allegation. It is the moment when available evidence supports a reasonable finding, after which a registrar or registry must act promptly—but still choose a remedy that fits its role, the harm and the risk to…

A certificate chain crosses an amber timestamp boundary; certificates before the cutoff remain blue and trusted, while a later certificate is isolated behind a red browser-trust barrier.

CASE FILE

The Certificates Did Not Expire: Chrome's Entrust Cutoff Turned Trust Into an Operating Licence

The decisive field was not the expiry date printed inside a TLS certificate. It was the timestamp proving when that certificate entered the public record—and whether Chrome still accepted the authority behind it at that moment.

Two wide endpoint gauges flank a narrower middle gauge with a larger ivory slab before the restriction and a smaller slab beyond it

History

Eight Bytes the Endpoints Could Not Negotiate Away

A PPPoE session could open successfully without carrying the packet size that justified opening it. The extension that addressed this problem separated permission, negotiation and a size-sensitive fallback. Its historical importance lay in a broadband migration: when the session…

Two engineers in a small Latin American ISP network room review an IPv6-first design with a limited IPv4 segment.

Story

At LACNIC, a New ISP Must Prove Need Before It Can Pay $8,000 for IPv4

LACNIC’s rules ask a first-time operator to show that customers and equipment already justify an address block. Exhaustion then sends that approved need into a private market. The rule is neutral on paper; the sequence is not neutral between a network starting from zero and one…

Three conference microphones stand apart from an organised production desk in a quiet Pokhara meeting room.

NPNOG

Who opens the room? What npNOG-10's welcome order can—and cannot—prove

The first twenty minutes of a conference can reveal institutional relationships. They cannot, without supporting records, tell us who held the decisive authority.

Fifteen tokens in three groups feed a transparent review and reversible implementation system

Story

AFRINIC’s petition proposal needs a receipt for every step from Board silence to implementation

AFRINIC’s Draft01 responds to a real institutional failure: a registry cannot leave policy work frozen whenever its Board cannot act. But its alternative route—from fifteen supporters to a new staff analysis and then deemed ratification—still lacks the evidence controls that…

Editorial illustration showing DNS root priming: an aging root-hints card sends one query to the DNS root, whose current authoritative records replace the hint in a resolver cache.

History

The Hint That Had to Be Replaced by an Answer: DNS Root Priming

A recursive resolver begins with an awkward form of knowledge: enough addresses to reach the DNS root, but no current root data in its cache. Priming is the small exchange that turns that inherited hint into an authoritative, expiring answer.

An incoming ivory slab carries three colored tiles; a divided report tray preserves the bare slab and an identical ordered tile stack in separate compartments

History

The Forwarding Evidence an IP Error Left Out

The router removed the labels before it prepared the error. What remained could identify the original IP conversation while omitting the state that had governed its passage through the network. Adding that state to ICMP made a report more useful. It did not make the report a…

A public outer network message carrying a luminous encrypted inner message through a shared gateway toward one of several backend servers.

IETF

The secret server name still needs a public front door: ECH’s new privacy boundary

Encrypted ClientHello gives a TLS connection two introductions: one the network may see, and one only the service can open. That is a real privacy gain, but it is not disappearance. The destination’s protection now depends on DNS configuration, a shared front door, key rotation…

A small illuminated registry tile and a much larger translucent slab jointly cover a framed address range while separate fibre lights remain outside the registry plane.

Story

ARIN’s RDAP Bottom Search Is a Coverage Answer, Not a Leaf List

One query for a `/21` returns a direct `/22` allocation and an administrative `/8`. The result looks upside down only if `rdap-bottom` is mistaken for a list of descendants; its real job is to account for registry coverage.

A cloud-exit planning table with a €0 invoice, data archives, identity key, network map, monitoring instrument and deletion envelope.

Europe and Middle East Cloud Services Trends

The Zero-Egress Invoice Is Not the Cost of Leaving Scaleway

A cloud bill can show nothing for moving the bytes and still conceal most of the work required to leave. The useful question is not whether egress is free, but whether the organisation can reproduce the service, prove the transition and close the old estate without losing…

A central request hub routes access tokens to separate registry approval vaults, with only accepted requests producing bounded zone-data copies.

ICANN

One Portal, No Clock: Who Actually Grants Zone-File Access?

CZDS lets a researcher ask many generic top-level-domain registries for zone files from one place. The common doorway is easy to mistake for a common decision. It is neither automatic access nor a single permission desk.

A forged paper instruction enters a registry console as a domain-control token crosses from a verified blue lane to an amber lane beside a broken confirmation link and a visible restoration path.

ICANN

The Forged Letter That Moved Sex.com: Kremen v. Cohen and Network Solutions

A forged instruction did not move a physical entity. It changed the authoritative registration record for a domain name—and forced a federal appellate court to ask what, exactly, the registrant controlled.