4 ms·

UK NCSC to stop using 'whitelist' and 'blacklist' due to racial stereotyping

hypertexthero 6y ago
Computer programmers: Please take care in choosing words for your code that don’t exacerbate racial stereotypes. For example: missionAllowlist[] = {}; ...Or: missionYeslist[] = {}; Instead of: missionWhitelist[] = {};
zzo38computer 6y ago
The terms "whitelist" and "blacklist" are words of colours and words of colours are not only for racism; a lot of words that might have one connotation in one context has a very different meaning in a different context. Nevertheless, "allow list" and "deny list" are better descriptions of what they are doing than the words "whitelist" and "blacklist" are, anyways. (If your allow/deny lists include people (which, depending on what they are being used for, it might), then the allow list might include both white people and black people (even though people aren't really as white or black as white or black things, because your skin colour is not like #FFFFFF and #000000), and so might the deny list; I think "allow list" and "deny list" would be less confusing here. And if it includes documents with colours, well, you can still see the similar confusion, I suppose.) So, yes, use "allow list" and "deny list", just because they are better words than "whitelist" and "blacklist"; racism isn't the reason of it. (It is good to avoid being racist, but not at the expense of being meaningful. Of course, when you achieve a better meaning in a way that is not construed as being racist, as is the case here, then it is win win situation, isn't it?) However, I do not think existing APIs and commands should need to be changed, although the documentation for them can be changed, if the words "whitelist" and "blacklist" are not the names of commands. (The Apache HTTP configuration already uses the words "allow" and "deny", so that is good.)
ColinWright 6y ago
I'm fully on board with changing these terms, both because of the racial aspects, but also because "AllowList" and "DenyList" are more descriptive. I've already changed much of my cryptography masterclass slides and code, but I'm looking for good replacements for "White Hat Hacker" and "Black Hat Hacker". Suggestions? I'm drawing a blank ...
- hypertexthero 6y ago
  Here’s one suggestion, including for Grey Hat Hacker: Virtuous Hacker Pragmatic Hacker Malicious Hacker More information on this subject: * Terminology, Power and Oppressive Language: https://tools.ietf.org/id/draft-knodel-terminology-00.html#rfc.section.1.2 https://tools.ietf.org/id/draft-knodel-terminology-00.html#r... * A Class Divided - https://www.youtube.com/watch?v=1mcCLm_LwpE https://www.youtube.com/watch?v=1mcCLm_LwpE I hope one day we don’t have to think about these things any longer but given our history I think it is worth keeping them in mind.
- robocat 6y ago
  > replacements for "White Hat Hacker" and "Black Hat Hacker". There are context dependant replacements. A security researcher is always white hat. A black hat is called an attacker or threat actor etc. I presume “white hat” and “black hat” come from https://en.wikipedia.org/wiki/Spy_vs._Spy https://en.wikipedia.org/wiki/Spy_vs._Spy so it isn’t black and white whether removing those terms is just whitewashing. The term black hat usually implies a security context. A “black hat hacker” is a confused usage, and should not be in any training materials IMHO. Depending on your social circle (or context) hacking may be always good (hacker news) where you might use cracker or attacker for the bad sense, or the popular usage of hacker where they are always bad (and white hat would be an alien term to that crowd). I re-edited this comment for clarity.
salawat 6y ago
Oh for Christ's sake, not this again. I will not call slaved drives minions. Those drives have work delegated to them by a drive specially configured with authority over the writing process for the group. The word fits. I will not change the meaning of whitelist (implicit deny, conditional allow) and blacklist(implicit allow, conditional deny) because of the political hot potato of the month. The white and black in white list and blacklist are there to contest the opposition of the mechanism. The fact particular people to whom everything comes back down to race issues can't help but project their favorite topic of discussion where there is quite literally no tangible place for it is not my problem. It's theirs. Same with white hat and black hat. Nothing to do with race. It comes from the habit in old Westerns whereby "the good guys" could be identified by their wearing of white or light hats, and "the evil guy" always ended up with a black hat on. No race issue. No dog whistling; and the only ones who see any type of racial undertones are ironically the ones who think they're fighting racists. Take your agendas elsewhere. We don't need to be rejustifying fundamental cultural concepts in terms of neutral and weak phraseology. We have plenty of history to build on, and frankly if you're a practitioner in the field you should be ashamed for even allowing this notional type of "virtue signaling" to pop up. It would be like a woodworker's apprentice walking in demanding that everyone stop calling a screw a screw because it offends their sensibilities to so closely associate the name of a penetrative fastener to a euphemism for sex. The problem is not the rest of the industry in question. Given the limited amount of time we all have on Earth to get something substantive done, why don't we actually focus on doing something rather than trying to manufacture old conflicts in new times. This damn argument has been had 1000 times before and will likely be had 1000 thence from this outburst. Stop pretending that someone has a point when people take your jargon out of context and apply some agenda favoring connotation to it. To do so is to let yourself and your work be colored as something else than it fundamentally is. >To do so is to let yourself and your work be colored as something else than it fundamentally is. ... Nice slip up there Mr. Racis... I'll write you a stern letter of disapproval for intellectual disingenuity if you finish that. You know damned well what I intended to say, and I'd do it only reluctantly and might not at all if in the end all it would accomplish is giving you the satisfaction of pretending I just somehow indirectly admitted you (note the use of the Royal you) had a point. No one who follows this asinine attempt at trying to look sympathetic and "emotionally in touch with the struggles of People of Color" does. For once, check your 'ism's' at the door. Life is hard enough without people going out of their way to race bait.

Computer programmers: Please take care in choosing words for your code that don’t exacerbate racial stereotypes. For example: missionAllowlist[] = {}; ...Or: missionYeslist[] = {}; Instead of: missionWhitelist[] = {};

zzo38computer 6y ago

The terms "whitelist" and "blacklist" are words of colours and words of colours are not only for racism; a lot of words that might have one connotation in one context has a very different meaning in a different context. Nevertheless, "allow list" and "deny list" are better descriptions of what they are doing than the words "whitelist" and "blacklist" are, anyways. (If your allow/deny lists include people (which, depending on what they are being used for, it might), then the allow list might include both white people and black people (even though people aren't really as white or black as white or black things, because your skin colour is not like #FFFFFF and #000000), and so might the deny list; I think "allow list" and "deny list" would be less confusing here. And if it includes documents with colours, well, you can still see the similar confusion, I suppose.) So, yes, use "allow list" and "deny list", just because they are better words than "whitelist" and "blacklist"; racism isn't the reason of it. (It is good to avoid being racist, but not at the expense of being meaningful. Of course, when you achieve a better meaning in a way that is not construed as being racist, as is the case here, then it is win win situation, isn't it?) However, I do not think existing APIs and commands should need to be changed, although the documentation for them can be changed, if the words "whitelist" and "blacklist" are not the names of commands. (The Apache HTTP configuration already uses the words "allow" and "deny", so that is good.)

ColinWright 6y ago

I'm fully on board with changing these terms, both because of the racial aspects, but also because "AllowList" and "DenyList" are more descriptive. I've already changed much of my cryptography masterclass slides and code, but I'm looking for good replacements for "White Hat Hacker" and "Black Hat Hacker". Suggestions? I'm drawing a blank ...

hypertexthero 6y ago
Here’s one suggestion, including for Grey Hat Hacker: Virtuous Hacker Pragmatic Hacker Malicious Hacker More information on this subject: * Terminology, Power and Oppressive Language: https://tools.ietf.org/id/draft-knodel-terminology-00.html#rfc.section.1.2 https://tools.ietf.org/id/draft-knodel-terminology-00.html#r... * A Class Divided - https://www.youtube.com/watch?v=1mcCLm_LwpE https://www.youtube.com/watch?v=1mcCLm_LwpE I hope one day we don’t have to think about these things any longer but given our history I think it is worth keeping them in mind.
robocat 6y ago
> replacements for "White Hat Hacker" and "Black Hat Hacker". There are context dependant replacements. A security researcher is always white hat. A black hat is called an attacker or threat actor etc. I presume “white hat” and “black hat” come from https://en.wikipedia.org/wiki/Spy_vs._Spy https://en.wikipedia.org/wiki/Spy_vs._Spy so it isn’t black and white whether removing those terms is just whitewashing. The term black hat usually implies a security context. A “black hat hacker” is a confused usage, and should not be in any training materials IMHO. Depending on your social circle (or context) hacking may be always good (hacker news) where you might use cracker or attacker for the bad sense, or the popular usage of hacker where they are always bad (and white hat would be an alien term to that crowd). I re-edited this comment for clarity.

salawat 6y ago

Oh for Christ's sake, not this again. I will not call slaved drives minions. Those drives have work delegated to them by a drive specially configured with authority over the writing process for the group. The word fits. I will not change the meaning of whitelist (implicit deny, conditional allow) and blacklist(implicit allow, conditional deny) because of the political hot potato of the month. The white and black in white list and blacklist are there to contest the opposition of the mechanism. The fact particular people to whom everything comes back down to race issues can't help but project their favorite topic of discussion where there is quite literally no tangible place for it is not my problem. It's theirs. Same with white hat and black hat. Nothing to do with race. It comes from the habit in old Westerns whereby "the good guys" could be identified by their wearing of white or light hats, and "the evil guy" always ended up with a black hat on. No race issue. No dog whistling; and the only ones who see any type of racial undertones are ironically the ones who think they're fighting racists. Take your agendas elsewhere. We don't need to be rejustifying fundamental cultural concepts in terms of neutral and weak phraseology. We have plenty of history to build on, and frankly if you're a practitioner in the field you should be ashamed for even allowing this notional type of "virtue signaling" to pop up. It would be like a woodworker's apprentice walking in demanding that everyone stop calling a screw a screw because it offends their sensibilities to so closely associate the name of a penetrative fastener to a euphemism for sex. The problem is not the rest of the industry in question. Given the limited amount of time we all have on Earth to get something substantive done, why don't we actually focus on doing something rather than trying to manufacture old conflicts in new times. This damn argument has been had 1000 times before and will likely be had 1000 thence from this outburst. Stop pretending that someone has a point when people take your jargon out of context and apply some agenda favoring connotation to it. To do so is to let yourself and your work be colored as something else than it fundamentally is. >To do so is to let yourself and your work be colored as something else than it fundamentally is. ... Nice slip up there Mr. Racis... I'll write you a stern letter of disapproval for intellectual disingenuity if you finish that. You know damned well what I intended to say, and I'd do it only reluctantly and might not at all if in the end all it would accomplish is giving you the satisfaction of pretending I just somehow indirectly admitted you (note the use of the Royal you) had a point. No one who follows this asinine attempt at trying to look sympathetic and "emotionally in touch with the struggles of People of Color" does. For once, check your 'ism's' at the door. Life is hard enough without people going out of their way to race bait.