OBIE – Open Ban Intelligence Exchange
A decentralised, federated security mesh: autonomous nodes exchange cryptographically signed attacker signals without surrendering control of their own firewall to a central authority. Reputation-weighted consensus, evidence over authority, no leaders.
“NEIGHBOURHOOD WATCH, NOT POLICE STATE”
The problem: the centralisation trap
Distributed attacks are defended today with centralised intelligence. That is efficient and has four failure modes, all of which happen regularly:
- A single point of failure
An outage or compromise at the central provider leaves every connected system unprotected at once.
- Commercial choke points
Good threat data sits behind paywalls – a security divide between large enterprises and small operators.
- Opaque decisions
Whoever centrally decides what counts as a threat can quietly turn a security feed into something else.
- Latency
What is decided in the provider's data centre often reaches the edge too late against automated attacks.
Threat model first
A leaderless mesh has an obvious attacker: the node that feeds in false signals. OBIE meets it with mechanism, not trust:
- Evidence over authority
Every signal is Ed25519-signed and carries hashes of the evidence – log excerpts, honeypot hits, event counts. Trust comes from verifiable data, not badges.
- Locally computed, weighted consensus
No node follows a signal blindly. Each computes a confidence from its peers' accuracy, stability, transparency and penalty history – a single compromised node poisons no firewall.
- Correctable mistakes
Reputation is observable, appeals run over direct RPC channels, false positives cost reputation. A mistake must be reversible, or the system is a weapon.
- Failure is the normal case
Nodes disappear, keys rotate. The mesh must degrade, not fail.
What OBIE does not do
The limits are in the manifesto, not in a footnote:
- No retaliation, no hunting
OBIE does not punish and does not strike back. It increases friction for attackers – that is the entire mission.
- No identities, no raw logs
What is shared are indicators – IP addresses, ASNs, TLS and SSH fingerprints, file hashes – never user data.
- No central switch, no tokens
There is no oracle, no kill switch and no economic token. The incentive is mutual defence.
- Not production-ready yet
Version 0.1 is being built in the open and is not meant for production firewalls yet. There is no running public mesh, and therefore no numbers. What the code does today is listed under “Status” on obie.cloudwerks.de.
The ask: read the spec and try to break it.
Not join, not subscribe, not star. Where does reputation-weighted consensus fail? Which poisoning strategy does the threat model miss? An hour of critique from someone who means it is worth more than a hundred subscribers.