[deploy][M1] Arm mitigation with safety rails #167

New issue

Open

opened 2026-07-11 13:44:17 +00:00 by vxfemboy · 0 comments

vxfemboy commented

2026-07-11 13:44:17 +00:00

(Migrated from github.com)

Milestone tracker. Flip shadow → live for RTBH/FlowSpec, only behind verified upstream propagation, RPKI, caps/disarm, and anycast self-protection. Gate: verify each transit/IXP actually honors the blackhole communities/FlowSpec (ops research); prove the self-protection interlock in a drill.

Features:

#10 Single disarm + blast-radius caps (caps partial; add audited disarm)
#4 Per-upstream blackhole-community map (gated on upstream-honoring verification)
#5 RPKI/ROA cross-check (Routinator already running on the box)
#17 Anycast health → auto-withdraw (don't blackhole yourself)

Milestone tracker. Flip shadow → live for RTBH/FlowSpec, only behind verified upstream propagation, RPKI, caps/disarm, and anycast self-protection. **Gate:** verify each transit/IXP actually honors the blackhole communities/FlowSpec (ops research); prove the self-protection interlock in a drill. **Features:** - [ ] #10 Single disarm + blast-radius caps (caps partial; add audited disarm) - [ ] #4 Per-upstream blackhole-community map (gated on upstream-honoring verification) - [ ] #5 RPKI/ROA cross-check (Routinator already running on the box) - [ ] #17 Anycast health → auto-withdraw (don't blackhole yourself)