diff --git a/doc/todo/Provide_a_way_to_white_list_local_networks___40__not_just_specific_IPs__41__/comment_4_620fd718bd2c97a6fa4ce775e311a2d6._comment b/doc/todo/Provide_a_way_to_white_list_local_networks___40__not_just_specific_IPs__41__/comment_4_620fd718bd2c97a6fa4ce775e311a2d6._comment
new file mode 100644
index 0000000000..af1d3ba05a
--- /dev/null
+++ b/doc/todo/Provide_a_way_to_white_list_local_networks___40__not_just_specific_IPs__41__/comment_4_620fd718bd2c97a6fa4ce775e311a2d6._comment
@@ -0,0 +1,17 @@
+[[!comment format=mdwn
+ username="joey"
+ subject="""comment 4"""
+ date="2020-02-25T19:46:02Z"
+ content="""
+Back to the proxy question, I suppose if you have multiple internal 
+networks and the proxy can only access one of them (eg your DMZ),
+then allowing access to the proxy is not as bad as "all".
+
+And then DMZ/24 makes explicit that git-annex can access everything in that
+network.
+
+Nor am I opposed to that syntax generally (although as I user, I consider
+it pretty opaque TBH, not being in the habit of counting bits in my head).
+The only haskell implementation I can find is in the `ip` package,
+which would be a new dependency for git-annex.
+"""]]