Blacklist vs whitelist onebox

[codinghorror (Jeff Atwood)]

The idea was to be safe by default but relax it over time, as opengraph and oembed become more common on the web. I would still prefer to see mini oneboxer implemented before we do that though.