> What are the odds of something like this becoming core to how the IETF writes it's recommendations? This is a document mandating just that. Status-wise, thi

> What are the odds of something like this becoming core to how the IETF writes it's recommendations? This is a document mandating just that. Status-wise, this is a BCP (Best Current Practice) document, so it's as senior and authoritative as IETF documents get. BCPs are on the same top tier as IETF's Standards Track documents, they go through a heavy (as far as IETF goes) process involving IESG approval etc. This means that specs have to take this BCP into account in their (mandatory) security considerations sections, and spec reviewers are required to take issue if a spec isn't doing that. Like rules in general, this is subject to gaming on various levels, so if a working group is manned by snooping enthusiasts they can conspire to do this weakly. But it's still something!