Blacklist (computing)
In computing, a blacklist, disallowlist, blocklist, or denylist is a basic access control mechanism that allows through all elements (email addresses, users, passwords, URLs, IP addresses, domain names, file hashes, etc.), except those explicitly mentioned. Those items on the list are denied access. The opposite is a whitelist, allowlist, or passlist, in which only items on the list are let through whatever gate is being used. A greylist contains items that are temporarily blocked (or temporarily allowed) until an additional step is performed.
"Blocklist" redirects here. For the song by Lil Durk, see Blocklist (song).
Blacklists can be applied at various points in a security architecture, such as a host, web proxy, DNS servers, email server, firewall, directory servers or application authentication gateways. The type of element blocked is influenced by the access control location.[1] DNS servers may be well-suited to block domain names, for example, but not URLs. A firewall is well-suited for blocking IP addresses, but less so for blocking malicious files or passwords.
Example uses include a company that might prevent a list of software from running on its network, a school that might prevent access to a list of websites from its computers, or a business that wants to ensure their computer users are not choosing easily guessed, poor passwords.
Distribution methods[edit]
Blacklists are distributed in a variety of ways. Some use simple mailing lists. A DNSBL is a common distribution method that leverages the DNS itself. Some lists make use of rsync for high-volume exchanges of data.[6] Web-server functions may be used; either simple GET requests may be used or more complicated interfaces such as a RESTful API.
Usage considerations[edit]
As expressed in a recent conference paper focusing on blacklists of domain names and IP addresses used for Internet security, "these lists generally do not intersect. Therefore, it appears that these lists do not converge on one set of malicious indicators."[8][9] This concern combined with an economic model[10] means that, while blacklists are an essential part of network defense, they need to be used in concert with whitelists and greylists.
In 2018, a journal commentary on a report on predatory publishing[11] was released which claimed that "white" and "black" are racially-charged terms that need to be avoided in instances such as "whitelist" and "blacklist", and that the first recorded usage of "blacklist" was during "the time of mass enslavement and forced deportation of Africans to work in European-held colonies in the Americas". The article hit mainstream in Summer 2020 following the George Floyd protests in America.[12]
A number of technology companies replaced "whitelist" and "blacklist" with new alternatives such as "allow list" and "deny list", alongside similar terminology changes regarding the terms "Master" and "Slave".[13] For example, in August 2018, Ruby on Rails changed all occurrences of "blacklist" and "whitelist" to "restricted list" and "permitted list".[14] Other companies responded to this controversy in June and July 2020:
ZDNet reports that the list of technology companies making such decisions "includes Twitter, GitHub, Microsoft, LinkedIn, Ansible, Red Hat, Splunk, Android, Go, MySQL, PHPUnit, Curl, OpenZFS, Rust, JP Morgan, and others."[20]
The issue and subsequent changes caused controversy in the computing industry, where "whitelist" and "blacklist" are prevalent (e.g. IP whitelisting[21]). Those that oppose these changes question the term's attribution to race, claiming that the term "blacklist" arose from he practice of using black books in medieval England.[13]