Explain like I'm five · Security

What is an Allowlist?

Allowlists and blocklists, told as a story about pinning a list of who may enter on the castle gate instead of wanted posters.

WANTEDI only stop faces on the poster×on the poster → stopped?no poster → walks in!a wanted poster only stops thieves we already know

A wanted poster only stops thieves we already know.The guard only stops faces on the poster. A thief with no poster simply walks in.

WANTEDWANTEDWANTEDWANTEDWANTEDWANTEDposters are always one step behindno poster of me yet!a thief seen for the first time todayan unknown thief gets through — stopping only what you know is always late

A new thief is on no poster. Posters are always one step behind.Thieves wear a new hat every day. A list of what you know is always late against what you don't.

WHO MAY ENTERthe carpenterthe bakerthe blue-hat friendthe errand boyeveryone else: noon the list? if not, no✓on the list → in××not on the list → all stoppednot blocking the thieves we know — letting in only the people we know

An allowlist is the list of who may enter. Everyone not on it is stopped.The guard never has to recognize a thief. He only checks the list — a thief seen for the first time, or one with no poster, is stopped all the same.

Make the listonly the people who may enter
Default: nonot on the list, not coming in
Unknown thieves toono poster needed
Add and remove namesa new carpenter gets written in
not on the list yetthe new carpenteryour name isn't here, one momentWHO MAY ENTERthe carpenterthe bakerthe blue-hat friend+ new carpentera little every day — the list is workas safe as it is fiddly — forget to write a name and even a friend is locked out

Far safer, but keeping the list is work. When a new carpenter arrives, someone has to write the name in.Forget a name and even a friend is locked out. So someone owns the list and fixes it a little every day — every time the carpenter changes.

tools we may runhammer✓saw✓strange box×the castle's tool listsenders we acceptfrom east village✓from west village✓???×not on the address list → refusedname tags on doorscarpenteronly a matching tag gets inlists are all over the castle — the base of a castle that asks at every door

A tool list, a sender list, name tags on doors — lists are all over the castle.Which tools may run in the castle, which senders the gate accepts, the name tag on every door. It is the base of the castle that asks at every door.

In one breath

An allowlist = the list of who may enter; everyone else is stopped. Far safer than a blocklist that only stops known thieves — but keeping the list is work.

An allowlist (whitelist) names only what is permitted and denies everything else by default. A blocklist (blacklist) names only what to stop, so it is always late against new threats. Used for application allowlisting, IP allowlists and email senders — and because a stale list blocks normal work, it needs an owner and an update process.

When grown-ups say it

Allowlist (whitelist)
The list of who may enter. Only what is on the list passes. Everything else is stopped.
Blocklist (blacklist)
The wanted poster. Stops only known thieves; late against new ones. → the watchman with the wanted poster
Default deny
Not on the list, not coming in. The unknown is stopped first and added later. The opposite is default allow.
Application allowlisting
The tools-we-may-run list. Only the tools allowed to run in the castle. A strange box not on it never runs.
IP allowlist
The senders-we-accept list. The gate accepts letters only from listed villages. → the wall with many doors
Maintenance burden
The work of fixing the list. New carpenters, departed ones, changed tools — left alone the list locks out friends; fixed carelessly it lets thieves in.
NAC (network access control)
The name tag on every door. A list checked at every hole in the corridor. → a doorkeeper at every corridor hole
Zero Trust
The castle that asks at every door. A castle with an allowlist on every door. → the castle that asks at every door
Next story
Thief Insurance →
Want another term as a picture book? Request →