3

Given the recent move away from the loaded meanings of "white" and "black", and that organisations are moving away from the terms "whitelist" and "blacklist", should we do the same in our tags?

All we would need to do is to create a tag alias.

Would it cause confusion? Do we want to wait until the move is more commonplace?

List of important orgs making this change:

I'm not suggesting that we do this for marketing purposes or to jump on a bandwagon, but to reflect the changes happening in our industry. I'm also not suggesting that we delete the existing tags, just to create an alias.

3
  • 10
    Is there any evidence that black people are actually offended by words like blacklist, blackhat or master/slave? Or is it just something that "organizations" are deciding to do for marketing purposes?
    – reed
    Jul 14, 2020 at 12:39
  • 1
    @reed I don't think that the NCSC is doing this for marketing purposes
    – schroeder Mod
    Jul 14, 2020 at 13:45
  • @reed yes, there is evidence - I'm also not sure how that relates to my question
    – schroeder Mod
    Jul 15, 2020 at 7:23

2 Answers 2

Reset to default
11

I'm against that change, because frankly, I think it doesn't improve anything. I think it's virtue signalling at best, showing "we're doing something" without actually doing anything substantial or impactful.

If you have a look at the systemic problems that black people in the US and elsewhere face, the words "blacklist" are so far down the list, it's absurdly comical. Sure, you will still be racially profiled, you're still culturally associated with a criminal lifestyle, you're still herded together into ghettos where drug- and gang-related crimes run rampant.

But at least you have the option of using the tag now!

7
  • 2
    This isn't about race or virtual signalling or systemic problems with a particular race. I'm talking about updating the tags to reflect a change in terminology that is happening in a lot of places. This isn't about raising a social justice issue or any of the wider issues at play.
    – schroeder Mod
    Jul 14, 2020 at 18:48
  • 1
    The underlying reasons why these changes are happening are however based on exactly these reasons. I don't think it's good to pretend that they are not.
    – user163495
    Jul 14, 2020 at 18:49
  • 2
    So, let me get this straight. I ask if we should align the tag terminology with these changes now or when they are more commonplace, and you are suggesting that we shouldn't, ever, based on principle?
    – schroeder Mod
    Jul 14, 2020 at 18:51
  • 4
    If "deny list" and "allow list" ever become the standard, then they should of course be adopted. But they are not the standard, at least not for now. And I criticize the intentions behind changing said standard.
    – user163495
    Jul 14, 2020 at 18:54
  • 3
    Are you aware that NIST is updating their publications? This is becoming the standard. Quite literally.
    – schroeder Mod
    Jul 14, 2020 at 18:59
  • 4
    That depends quite on what you see as "standard". If you want to count a NIST publication as "the standard", then be it so. If you count how the words are used in practice, the picture is quite different. For example, if you google "whitelist", you see a ton of articles about whitelists. If you google "allowlist", you see a ton of discussion about how "whitelist" should be changed to "allowlist".
    – user163495
    Jul 14, 2020 at 19:04
  • 6
    I agree with @MechMK1. Let's keep the tags as is until people know what an allowlist is, and they are more commonplace. For now, it's just endless discussion.
    – ThoriumBR
    Jul 14, 2020 at 19:10
4

I think every network device I ever worked with used the words permit or allow and deny or reject. I'd call them highly commonplace substitutes.

4
  • So are you suggesting permitlist/allowlist or denylist/rejectlist? perrmit/allow or deny/reject are not clear enough on their own.
    – Conor Mancone
    Jul 14, 2020 at 12:14
  • 2
    Chromium is using allowlist and blocklist. NCSC is using 'allow list' and 'deny list'
    – schroeder Mod
    Jul 14, 2020 at 13:47
  • @ConorMancone yes, those are always followed by "list"
    – Jeff Ferland Mod
    Jul 14, 2020 at 17:09
  • Agreed, as @schroeder said allowlist/blocklist - these are commonly accepted, especially in OWASP and rest of appsec world.
    – AviD Mod
    Jul 21, 2020 at 20:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .