Why blacklist instead of whitelist? Doesn't the scanner really only support http(s) links?