diff --git a/doc/TODO b/doc/TODO
index 38366fad71..9159e86811 100644
--- a/doc/TODO
+++ b/doc/TODO
@@ -188,6 +188,9 @@ N - Code cleanup
       sent across sockets, not number sent inside TLS stream.
   - Hidden service improvements
     - Investigate hidden service performance/reliability
+  - Add private:* alias in exit policies to make it easier to ban all the
+    fiddly little 192.168.foo addresses.
+
 
   No
   - choose entry node to be one you're already connected to?