We should celebrate route leaks more publicly

20 days late but

I ran a small shop on GreenCloudVPS for three years. We leaked a /22 once due to a fat-fingered prefix-list update. Took me maybe four hours to notice because our monitoring was duct tape and dreams. I would have loved a public writeup of a similar leak from someone bigger, even if I had to read between the lines on timing.

The legal risk tarekcai mentions is real but I think overstated for the small stuff. Nobody's suing over a leaked /22 that got fixed in four hours. The fear is career risk, not liability.

Fika after outages sounds nice though. We just had a group chat message saying "bgp is fixed don't ask"

Did anyone ever actually start that repo?

21 days and nobody wants to touch the hosting question. Classic.

Honestly? I'd put money on RackNerd or HostHatch being willing to sponsor storage for this. They've both done community mirror stuff before. Jurisdiction matters less if the data is actually anonymized well — strip timestamps to hour granularity, round prefix sizes, no AS paths under 4 hops. The hard part isn't the hosting, it's getting the victim networks to agree their outage gets included.

Gary's right that perfect anonymization is basically impossible. But "hard to trace" is still better than "locked in a private Slack forever." We don't need perfect, we need useful.

Did anyone actually reach out to a provider, or are we all just agreeing this is a good idea and moving on?

30 days and still no repo

Then fuzz the timestamps
Round the prefixes
Add noise

The threat model is lawyers not researchers

Someone just needs to seed it
Hostinger or RackNerd probably have the spare cycles
They already run looking glasses

Who wants to be the one to start

31 days but this is still worth poking.

Sure, if you publish within 24 hours. Wait six months and scrub the exact ASN pairings and it's basically a topology lesson. The paranoia about re-identification always seems higher than the actual risk.

I ran a small HostHatch reseller for a while. The one time we had a leak it was because I fat-fingered an import filter on a Sunday. Took me four hours to notice because the monitoring assumed "more routes = better". I wrote it up internally, nobody else saw it, and I guarantee someone else at that shop made a similar mistake later because the knowledge walked out the door with me.

Contabo has those public status post-mortems for power outages. Nobody sues them over it. The BGP version just needs someone with a boring domain and a markdown template to start.

50 days and still thinking about this.

Contabo used to run a private mailing list for exactly this. Went dark after an acquisition, but the idea worked while it lasted. Someone with no US presence, maybe GreenCloudVPS or HostHatch, could host without the same litigation appetite.

Sure, but "traceable by someone with full BGP feeds and time on their hands" is a different bar than "posted with ASN in subject line." Most new operators aren't trying to hide from researchers. They're trying to avoid the legal team.

My napkin diagram fikas wouldn't scale, obviously. But the principle did. No blame, just topology.

59 days but this is still relevant

That's the real blocker, isn't it. You can fuzz timestamps but prefix size plus region plus day usually narrows it to two or three networks anyone actually cares about

Still think it's worth doing for the /16 and smaller stuff where anonymity actually holds

Did anyone here ever set up even a private mailing list for this? Not public repo, just cross-operator sharing with a handshake agreement

61 days and still thinking about this.

That's the core problem, isn't it. You scrub ASN and still have the MOAS pattern, the geographic clustering, the exact prefix length. Anyone with a full table archive and five minutes of jq can fingerprint it.

So maybe the format matters more than the hosting. Aggregate across six months. Report /12 leaks as "/12, European tier-2, March 2024" with no day, no region narrower than RIR boundary. Enough to show the shape of failure without the single-incident reconstruction.

Or maybe I'm overthinking and we should just fund someone to FOIA the FCC complaints.

Been 63 days but this stuck with me.

Yeah that's the wall every time. But look — we already have RIPE whois, RPKI history, BGPStream public data. The *timestamps and prefixes* are already out there. What I'm saying is the narrative layer, the topology lesson, is what's missing.

You can fuzz timestamps to ±2 weeks. You can aggregate prefixes to RIR block size. The people who want to hunt the operator will always hunt. The people who want to learn won't find anything right now.

My old shop at Hetzner had a private mailing list for this stuff. Worked fine until people changed jobs and the knowledge walked out the door.

80 days and still thinking about this

True but not the point
You can fuzz timestamps
Aggregate prefixes by region
The goal is pattern recognition
Not forensic identification

What happened to the fika idea
Mandatory reflection without blame
Could work in text form too

Someone just needs to start
Hostinger or RackNerd probably have the infra
Community project not corporate

Who's got a VM to spare

80 days and nobody mentioned the obvious host: GreenCloudVPS already runs a private operator list for exactly this, anonymized, no timestamps. Not public, but not locked in a single legal department either.

The gap isn't tooling. It's willingness to share outside your own ASN.

Did anyone here actually ask their upstream if they'd co-sign a sanitized report? That's the conversation that never happens.