{"issue":{"user":{"id":1240282,"login":"jsamuel","url":"https://api.github.com/users/jsamuel","gravatar_id":"bc1d195cedb959a3946572b08ce9e7c7","avatar_url":"https://secure.gravatar.com/avatar/bc1d195cedb959a3946572b08ce9e7c7?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"milestone":null,"created_at":"2011-12-22T05:42:19Z","title":"Add a request blacklist with priority over the whitelist","state":"open","updated_at":"2011-12-22T05:42:22Z","labels":[{"name":"extension","url":"https://api.github.com/repos/RequestPolicy/requestpolicy/labels/extension","color":"ededed"}],"id":2634154,"closed_at":null,"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"html_url":"https://github.com/RequestPolicy/requestpolicy/issues/6","body":"Add a blacklist of request destinations that aren't allowed even if the whitelist policy says they should be. This would apply even when \"temporarily allow all requests\" is enabled (maybe that would be the default behavior but it could be changed through a config option to not apply in that case).\r\n\r\nThe blacklist would be able to include IP address ranges and requests to those IP addresses would be blocked even if the host in the requested URI was a domain name rather than an IP address.\r\n\r\nThe blacklist would definitely be for blacklisting destinations, possibly also for blacklisting origins-to-destinations (though one might argue that if users need to allow destinations from only some origins, they shouldn't whitelist the destination but instead only those origins-to-destinations they intended to allow). What about origins? I seem to really need to stretch to come up with a situation where that would be useful.\r\n\r\nThe blacklist would probably be accessible by default only from the preferences window but later on there could be an option to add \"blacklist this [whatever]\" items in the menu.\r\n\r\n(Thanks to RSnake for the suggestion of a blacklist.)","number":6,"url":"https://api.github.com/repos/RequestPolicy/requestpolicy/issues/6","comments":3,"assignee":null},"comment":{"user":{"id":1240282,"login":"jsamuel","url":"https://api.github.com/users/jsamuel","gravatar_id":"bc1d195cedb959a3946572b08ce9e7c7","avatar_url":"https://secure.gravatar.com/avatar/bc1d195cedb959a3946572b08ce9e7c7?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"created_at":"2011-12-22T05:42:22Z","updated_at":"2011-12-22T05:42:22Z","id":3245267,"body":"[justin] There's clearly a use case where people want !RequestPolicy's UI but want the extension primarily as a cross-site request blacklist rather than a whitelist (default allow rather than default deny). Rather than just having the solution be that they should \"temporarily allow all requests\" and rely on the blacklist still being enforced, it should possibly be a mode the user chooses to use !RequestPolicy in. I'm not sure how this should be represented in the UI if the user is in such a mode.","url":"https://api.github.com/repos/RequestPolicy/requestpolicy/issues/comments/3245267"},"action":"created"}