Hacker News Reader

Many: OS detection (ICMP, IGMP, ARP, TCP, etc.), topology disclosure (ICMP), DoS (many early protocols did not perceive resource exhaustion in their threat model; a prominent example being SYN floods / TCP half-open), etc.

When these things come up, what usually happens is implementations stop following the spec as written.

Many issues can be handled with minimal coordination, but some things work much better with consensus and you see flag day campaigns. Ipv6 flag day had very limited impact on that day, but may restarted the process and actually got things moving. DNS flag days have been successful.

Yes, lots. Early spdy was vulnerable to CRIME attacks and so was TLS1.0 (and to bunch of other attacks). Kaminsky DNS cache poisoning is another one that comes to mind