# Blacklist vs whitelist onebox
**URL:** https://meta.discourse.org/t/blacklist-vs-whitelist-onebox/21811
**Category:** Feature
**Created:** [November 4, 2014, 11:48am UTC](https://meta.discourse.org/t/blacklist-vs-whitelist-onebox/21811 "2014-11-04T11:48:57Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@evantill](https://meta.discourse.org/u/evantill)
#### Post date: [November 4, 2014, 11:48am UTC](https://meta.discourse.org/t/blacklist-vs-whitelist-onebox/21811/1 "2014-11-04T11:48:57Z")
Continuing the discussion from [Auto-discoverable oneboxer-able links based on whitelist configurable by admin](https://meta.discourse.org/t/auto-discoverable-oneboxer-able-links-based-on-whitelist-configurable-by-admin/9068/5):
> [@krainboltgreene](#):
>
> Hey, onebox gem “team lead” here. I’ve got an open issue for whitelist/blacklist functionality here: [Whitelist/blacklist certain domains · Issue #124 · discourse/onebox · GitHub](https://github.com/dysania/onebox/issues/124)
I would like to enable onebox for every site that support `oEmbed` or `Open Graph` and be able to blacklist some sites in case of improper usage.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [November 4, 2014, 10:36pm UTC](https://meta.discourse.org/t/blacklist-vs-whitelist-onebox/21811/2 "2014-11-04T22:36:12Z")
This currently isn’t possible. You’d need to make changes to the onebox gem.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [November 4, 2014, 11:55pm UTC](https://meta.discourse.org/t/blacklist-vs-whitelist-onebox/21811/3 "2014-11-04T23:55:08Z")
Any implementation of this will likely result in your Discourse instance making spurious calls to non-existent websites while someone is typing, which is a bit wasteful.
The client already makes a lot of calls to `/onebox`, maybe they should be debounced.
---
### Author:  [@evantill](https://meta.discourse.org/u/evantill)
#### Post date: [November 5, 2014, 9:03am UTC](https://meta.discourse.org/t/blacklist-vs-whitelist-onebox/21811/4 "2014-11-05T09:03:18Z")
and would it be possible to create a plugin to enable OEmbed discovery ?
like this plugin for wordpress [Enable oEmbed Discovery – WordPress plugin | WordPress.org](https://wordpress.org/plugins/enable-oembed-discovery/)
see [oEmbed](http://oembed.com/#section4)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 17, 2016, 5:25am UTC](https://meta.discourse.org/t/blacklist-vs-whitelist-onebox/21811/5 "2016-06-17T05:25:44Z")
I just hit this exact issue again today, this is something I would also like build.
In particular for internal Discourse instances there is zero reason to blacklist any sites. In general, I am not really sure what the value is of the whitelist approach. Facebook and Twitter seem to be coping just fine with a blacklist approach.
I guess the big question is:
What kind of abuse does the onebox whitelist only approach prevent? Honestly I am struggling really hard to think of any.
@eviltrout ? @codinghorror ?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [June 17, 2016, 5:32am UTC](https://meta.discourse.org/t/blacklist-vs-whitelist-onebox/21811/6 "2016-06-17T05:32:04Z")
The idea was to be safe by default but relax it over time, as opengraph and oembed become more common on the web. I would still prefer to see mini oneboxer implemented before we do that though.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 17, 2016, 6:08am UTC](https://meta.discourse.org/t/blacklist-vs-whitelist-onebox/21811/7 "2016-06-17T06:08:12Z")
> [@codinghorror](#):
>
> The idea was to be safe by default but relax it over time,
That is what I am struggling with, what is “insecure” opening the open-graph floodgates? I just can’t think of anything really, we already download images from arbitrary sources in our pipeline which is far more risky.
Not at all against mini-onebox, in fact this would tie in to mini-onebox work. Just struggling real hard to figure out what we are protecting against here.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [June 17, 2016, 6:00pm UTC](https://meta.discourse.org/t/blacklist-vs-whitelist-onebox/21811/9 "2016-06-17T18:00:32Z")
For the record I always thought it should be blacklist, not whitelist, but I also had no problem erring on the side of security. In early discussions I believe @codinghorror insisted it should be whitelist.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [June 18, 2016, 12:41am UTC](https://meta.discourse.org/t/blacklist-vs-whitelist-onebox/21811/10 "2016-06-18T00:41:44Z")
Yeah I think only oEmbed needs whitelisting, and even then most of the oEmbed returns are unusable due to `