Intelligence
Latest Articles
Latest intelligence on infrastructure operators, policy decisions, market moves, and digital power shifts.
History
The Retraction That Had to Travel as News: How Usenet Made Cancellation a Local Decision
One cancel article reaches three news servers. The first already holds the named post and withdraws it. The second rejects the request under local policy. The third has not yet seen the post, so it remembers the Message-ID and refuses the late arrival. Nothing in that sequence…
CASE FILE
The Client Expected a Certificate. The Library Accepted a Key: TLS Raw Public Keys and the Authority of Negotiation
The key was mathematically usable. That was precisely the problem. In June 2026, wolfSSL disclosed that an RPK-enabled build could accept an unnegotiated Raw Public Key where the peer expected X.509, bypassing certificate-chain validation. The repair did more than reject a format…
NPNOG
One week, two institutions—and two edition numbers
<!-- BTW:SLUG:one-week-two-institutions-two-edition-numbers-npnog-sanog-38 -->
History
The Delete That Waited for Goodbye: How POP3 Separated a Mark from an Irreversible Removal
The server answers `+OK message 4 deleted`. Then the cable comes out before the client says `QUIT`. On the next connection, message 4 is back. POP3 did not contradict itself: the positive reply had accepted a reversible mark inside one session, while actual removal belonged to a…
CASE FILE
The Proof Arrived After the Connection Began. It Did Not Rewrite the Past: TLS Exported Authenticators and Application Authority
At 14:03, a valid certificate proof arrived on a connection that had already carried hundreds of operations. The service upgraded every stream and relabelled five earlier minutes as authenticated by the new identity. The signature was sound. The history was not. TLS Exported…
IETF
An Expired Internet-Draft Is Not a Rejected Proposal
The standards register had only two columns: document and outcome. Beside an Internet-Draft, a reviewer had copied the Datatracker label `Expired` and entered “Rejected by the IETF.” No rejection notice was attached. There was no adoption call, consensus record, Last Call, IESG…
ICANN
A Valid Inbox Is Not a Title Deed: The Four Proofs ICANN’s Accuracy Rules Keep Separate
ICANN’s registration-data rules can test whether a field is well formed and whether somebody answers an email or telephone call. Those are useful controls. They are not the same as proving who controls the registrar account, still less deciding which person or company has the…
History
The Bytes That Had to Wait for Permission: How IMAP Literals Traded a Round Trip for a Resource Boundary
An IMAP client could finish a line with `{11}`, announce exactly how much data came next—and then stop. The eleven octets were not late, lost or flow-controlled by TCP. They were waiting for a one-character reply from the server: `+`. That pause turned a count into a permission…
CASE FILE
The Certificate Had Not Been Verified. Its Memory Claim Already Had to Be Judged: TLS Compression and the Pre-Trust Boundary
A two-kilobyte handshake message says it will become twelve megabytes after decompression. Before the receiver can inspect a name, a signature or a chain, it must decide whether that unauthenticated claim deserves memory and CPU. RFC 8879 makes certificates smaller on the wire…
History
The Checkpoint That Was Not a Byte Number: How FTP Learned to Resume a File
Midway through an FTP transfer, a reply could appear on the control connection: `110 MARK ssss = rrrr`. It did not say that a certain number of bytes had arrived. It joined one position understood by the sending system to another position understood by the receiving system—and…
IETF
An RFC MUST Without a Subject Is Not an Audit Finding
The compliance sheet looked decisive: “RFC 8200 — MUST — failed.” It named no component, packet condition, conformance profile or test. It did not say whether the cited sentence governed a sender, receiver, router or operator. A capitalized word had become the entire finding. The…
CASE FILE
The Edge Received a Key. It Did Not Receive the Certificate: TLS Delegated Credentials and the Boundary of Short-Lived Authority
A front end can finish a TLS 1.3 handshake for the certificate owner without holding the certificate’s long-term private key. What crosses that boundary is powerful but deliberately small: a signed public key, a role, an algorithm and an expiry—not the certificate, the CA…
IETF
The Packet Arrived Last. That Does Not Mean the Event Happened Last
In a wraparound test, a CoAP server sends one notification just before its Observe value rolls over and another just after. The newer datagram reaches the client first. The older one has been sleeping in a queue inside the network and arrives second. A client that sorts the two…
History
The Empty Query That Listed Everyone: How Finger Made Human Presence a Network Reply
Send no name, no password and no command word—only a carriage return and line feed—to a remote service on port 79. In the original Finger protocol, that empty line asked the host to list everyone currently using it. The exchange was tiny. The disclosure could include a room…
ICANN
Records in Escrow, No Registrar in Operation
At 09:00, a data escrow agent accepts a registrar's deposit. Its hash matches, the file opens, every required field passes validation and ICANN receives a valid-deposit report. At 09:15, imagine that the registrar's site, telephone line and customer portal stop answering. The…
CASE FILE
The Peer Requested New Keys. It Did Not Own the Epoch: TLS 1.3 KeyUpdate and the Authority to Rotate a Live Connection
One encrypted record leaves under the old key. Every later record from that sender must use the next one. The peer can authenticate the transition and ask for a reciprocal change, but it cannot see whether yesterday’s secret left memory, choose the other endpoint’s work queue, or…
CASE FILE
The Speaker Was in the Session, Not the Path: IXP Route Servers and the Authority to Broker Reachability
The BGP session was established to one system. The route began with another network's AS number. Its next hop named a third address on the exchange fabric, and the packets never crossed the machine that had delivered the UPDATE. Nothing was malformed. The apparent contradiction…
Story
LACNIC’s Election Commission Can Assign a Candidate to a Country They Are Not a Citizen Of
In 2025, LACNIC published an Electoral Commission candidate as a citizen of Uruguay and a resident of Brazil, then ruled that his long residence and economic activity meant he would occupy Brazil’s country slot. The official result and current roster continue to list him as…
History
The Second Connection Asked Who Owned the First: How IDENT Bounded a Username's Authority
A server has already accepted one TCP connection when it opens another in the opposite direction. On that second connection it sends two port numbers to the first host and asks a narrow question: which local user owns the first connection? IDENT made that answer useful for logs.…
CASE FILE
An RFC Number Does Not Mean the IETF Approved It
A compliance register that records only “RFC 8729” looks precise. It is not. The number identifies a durable document, but it conceals that this particular RFC is an IAB-stream informational statement rather than an Internet Standard. When a single column makes every RFC look…