[kiennt048]

Answers issue #79 (feeds part). Docs only; Emily implements the code side.

D-92: drop abusech-sslbl, no replacement

• abuse.ch deprecated the SSLBL C2 IP list on 2025-01-03: the file only holds the header, with no rows.
• Why not Feodo Tracker (Emily's option b): it is already the built-in abusech-feodo.
• Why not abuse.ch's other live lists: ThreatFox and URLhaus need an Auth-Key and a paid plan for commercial use (abuse.ch Terms of Use §4), so they stay BYOK.
• Why not SSLBL's SHA-1 certificate list: it is still updated, but Vedette never sees TLS certificates, so it could not match anything.
• RouterOS scripts and IPFire also dropped SSLBL without a replacement.
• In one commit, per rules/legal: code, mock, PRIVACY flow 1 + the Settings → Privacy string (host sslbl.abuse.ch), THIRD_PARTY_NOTICES, the DATA_MODEL id list and DATA_PIPELINE §2b.
• Built-in rows that are no longer in code are deleted at start-up, together with their history and IOCs.

S-FEED-1 criterion

Home never says "0" when the real answer is "unknown":

• KEV never loaded: "The CISA list could not be fetched yet: . See Settings → Feeds."
• KEV turned off: "The CISA list is turned off. See Settings → Feeds."
• Loaded at least once: keep the count and "updated at".

DATA_MODEL

feeds_source.answered_by (D-91, migration 0003 of feeds).

Local checks

Docs only: make check runs nothing.

Refs #79.

🤖 Generated with Claude Code