# The edge feed

**Free, keyless, no account. Typed data planes about IP addresses, a small policy language over them, and modules for nginx, Apache and LiteSpeed that answer from memory. It blocks only what it can cite, and it says what it does not know.**

This is the Markdown twin of [whisper.online/edge/](https://whisper.online/edge/). Anything that does not ask for HTML gets the plain-text index of the files there instead: `curl https://whisper.online/edge/`.

## What is in it, now

The planes below are read from the signed manifest this node is serving, at the moment the page was requested. Nothing in this section is typed by hand.

The signed manifest at generation 1792479602, built at 2026-10-20T07:00:00Z.

| plane | state | rebuilt every | ranges | valid until |
|---|---|---|---|---|
| reputation | live | hour | 1000 IPv4, 35 IPv6 | 2026-10-21T07:00:00Z |
| routing | withheld\: BGP\_CLOCK\_UNKNOWN\, UNPINNED\, VRP\_SPLIT\_DATASET\, VRP\_CAP\_UNSET\, BGP\_PUBLISH\_OFF |  |  |  |
| rpki\-unreachable | withheld\: BGP\_CLOCK\_UNKNOWN\, UNPINNED\, VRP\_SPLIT\_DATASET\, VRP\_CAP\_UNSET\, BGP\_PUBLISH\_OFF |  |  |  |
| tor | withheld\: LOW\_RECALL\, IPV6\_NOT\_STATED |  |  |  |

Where each plane's data comes from, how often it is rebuilt, what it covers and what keeps a withheld plane withheld: [DATA.md](https://whisper.online/edge/DATA.md).

## Write a policy

A policy is a short list of rules over the planes. The rules are ordered and the first one that matches decides. A rule that reads a plane which is stale or not installed sees `unknown`, never a guess: a rule fires only when its condition is definitely true, and the compiler refuses a deny that an outage alone could fire. A policy the compiler refuses is a configuration error, reported with the rule, the line, the column and a fix.

The whole language, every refusal the compiler can give and every limit it enforces: [POLICY.md](https://whisper.online/edge/POLICY.md). Installing the modules and the feed: [README.md](https://whisper.online/edge/README.md).

## Check it

Every file is checkable four ways, and they are not the same check: the digest says the bytes were not corrupted, the transport says they came from us when you asked, the transparency ledger says we published exactly those bytes and cannot quietly rewrite the claim, and the signature still works when the file reaches you from somewhere else. The commands and their real output are in [Audit us rather than trust us](https://whisper.online/docs/edge-blocking.md).

## The numbers

Per lookup, from the bench record measured for release 0\.223\.3 (a development measurement) on aarch64, compiled with gcc 13\.3\.0 and \-std\=c11 \-O2 \-Wall \-Wextra \-Werror, over synthetic data. The bounds are properties of the file layout and come out the same on any machine; the mean is information about that one machine and is not a figure to quote.

| layout | ranges | widest window | max probes | depth | mean ns (information) |
|---|---|---|---|---|---|
| f1 unindexed | 1500000 | 1500000 | 21 | 0 | 196.2 |
| f1 radix\-16 | 1500000 | 60 | 6 | 0 | 73.2 |
| f2 radix\-12 | 1500000 | 764 | 10 | 0 | 95.0 |
| f2 radix\-16 | 1500000 | 60 | 6 | 0 | 112.7 |
| f2 radix\-18 | 1500000 | 21 | 5 | 0 | 41.9 |
| f2 rank\-64 | 1500000 | 63 | 6 | 4 | 176.2 |

The policy compiler's refusal list has 56 phrases. The generated test cases make 55 of them fire; the one left is reachable only by the program verifier, by design. The committed refusal corpus holds 50 hand-written cases.

## Honest limits

- **It fails open.** No code path denies a request on missing or bad data: an absent plane allows, a corrupt one is refused at load and the previous one keeps serving, and an expired one stops enforcing.
- **Routing state is not yet stated.** Route origin validation is a property of a route as some collectors saw it, and the graph cannot yet name those collectors, so the routing planes stay withheld until it can.
- **A withheld plane says why.** The reasons above are the builder's own, and [DATA.md](https://whisper.online/edge/DATA.md) says what lifts each one.
- **On a resolver, BIND does not rewrite answers for clients that ask for DNSSEC** unless you set `break-dnssec`, and then a rewritten answer cannot validate.
- **A policy zone blocks a whole name.** If one of a name's addresses is listed, the name goes dark for a resolver applying the zone, where a web-server module would only have judged the one address that connected.

The full list, with the mechanism behind each: [README.md](https://whisper.online/edge/README.md).

## Everything else

- [README.md](https://whisper.online/edge/README.md), the operator's guide
- [POLICY.md](https://whisper.online/edge/POLICY.md), the policy language
- [DATA.md](https://whisper.online/edge/DATA.md), every data plane
- [ARCHITECTURE.md](https://whisper.online/edge/ARCHITECTURE.md), how the feed is built, signed and served
- [Edge reputation blocking](https://whisper.online/docs/edge-blocking.md), the guide to the modules
- [The signed manifest](https://whisper.online/edge/manifest.json) and [the policy zone](https://whisper.online/edge/rpz.zone)
- [This page as HTML](https://whisper.online/edge/)