Two opposite default postures for the exact same question: should this be allowed to run — and who has to prove it first?
Every filtering control — an application allow-list, a firewall rule set, a spam filter, an antivirus engine — has to answer one structural question before it evaluates a single item: what happens by default, before any list is even consulted? Blacklisting (denylisting) answers "allow it," and blocks only what's specifically named as bad. Whitelisting (allowlisting) answers "block it," and allows only what's specifically named as good. That single flipped default changes almost everything downstream — what gets stopped, what gets through, and how much administrative work the control demands to keep working correctly.