A blocklist has to be right about every address a URL might resolve to. An allowlist only has to be right about the ones you meant. Here's why that asymmetry decides the outcome.
// Blog
Write-ups and research notes.
Techniques I've found worth writing down: exploitation chains, tooling internals, and the odd rabbit hole. Lab-verified before it gets published.