I’d love to blacklist .exe, but that doesn’t seem possible? Users of my forum upload all sorts of custom file formats from various self-tracking apps, and having an inclusive list failed every time someone came up with some data dump from a new app.
Maybe an alternative would be for Discourse to display a short help text in that dialog along the lines of “Please zip any file with an extension not in this list”.