If we need a blacklist, shouldn't we just do the opposite - a whitelist? That seems safer.