Internet and web numbers

RFC numbers identify documents. They run in one sequence from 1969 to the present, so the number tells you when something was written and nothing about its importance or scope.

Port numbers identify services on a host. They are an IANA registry, and the assignment is a bookkeeping decision — port 22 went to SSH because it happened to sit between telnet and ftp in the list.

Status codes identify outcomes. Unlike the other two, their values are structured: the first digit carries the meaning, which is why a client can handle an unfamiliar 4xx sensibly without knowing what it is.

Ports below 1024 require elevated privilege to bind on Unix systems. That single rule shaped decades of practice — it is why web servers historically started as root and dropped privileges afterwards, why a developer running a server as themselves reaches for 8080 instead of 80, and why container platforms had to make the restriction configurable. No other number in this hub changes what software is allowed to do.

RFC 2616 specified HTTP/1.1 in 1999 and was replaced in 2014 by six separate documents, then replaced again in 2022 by another set. It is still cited by number, because a generation of engineers learned it that way and because the number is stable in a way the document is not. The same happens to ports: 25 still carries mail between servers under rules that assume a network of cooperating operators that has not existed for twenty years.

Everything here works because independent parties agreed on a value, and the interesting failures are where agreement is incomplete. Ingress filtering has been the recommended fix for address spoofing since 2000 and is still not universally deployed. DNS over HTTPS encrypts queries and moves the question of who can see them from the network operator to the resolver operator, which is a policy disagreement rather than a technical one. The numbers are settled; what to do with them is not.