A blocklist has to be right about every address a URL might resolve to. An allowlist only has to be right about the ones you meant. Here's why that asymmetry decides the outcome.
Blog
Write-ups and research notes.
Techniques I've found worth writing down: exploitation chains, tooling internals and the odd rabbit hole. Lab-verified before it gets published.