The words “blacklist” and “whitelist” get tossed around a lot in cybersecurity. But now a UK government agency has decided to retire the terminology due to the racial stereotyping the language can promote.
The UK’s National Cyber Security Centre is making the change after a customer pointed out how the words can needlessly perpetuate stigmas. “It's fairly common to say whitelisting and blacklisting to describe desirable and undesirable things in cyber security,” wrote the NCSC’s head of advice and guidance Emma W. last week.
“However, there's an issue with the terminology. It only makes sense if you equate white with 'good, permitted, safe' and black with 'bad, dangerous, forbidden',” she added. “There are some obvious problems with this. So in the name of helping to stamp out racism in cyber security, we will avoid this casually pejorative wording on our website in the future.”
To replace the terminology, NCSC has opted for the words “deny list” and “allow list,” which will now be used across its website and cybersecurity advisories. The language is not only clearer, but also more inclusive, the agency said.
“No, it's not the biggest issue in the world — but to borrow a slogan from elsewhere: every little helps,” Emma W. added. “You may not see why this matters. If you're not adversely affected by racial stereotyping yourself, then please count yourself lucky. For some of your colleagues (and potential future colleagues), this really is a change worth making.”
The move to drop blacklist/whitelist also came up last year when Google removed the two terms, and other potential offensive wordings, from the Chromium browser engine on a request from Microsoft developers.
For decades, the IT community has also had to wrestle with the computing terms “master” and “slave,” which are used to describe when one device or process controls another. The same wording can conjure up images of slavery, which prompted the programming language Python to drop the terminology, but not without some debate.
The NCSC acknowledged not everyone may agree with its decision to retire the blacklist/whitelist wording. But the agency doesn’t care to debate the matter.
Emma W. added: “Finally, a word from the NCSC's Technical Director Ian Levy (supported by the full NCSC Management Board): ‘If you’re thinking about getting in touch saying this is political correctness gone mad, don’t bother.’”
Further Reading
- US to Block Certain Foreign-Made Electrical Grid Equipment, Citing Hacking Threat
- What Is Cell Phone Contact Tracing?
- EventBot Android Malware Steals Your Banking Details, Bypasses 2FA
- Unlocking Your iPhone While Wearing a Mask Will Get Easier With Upcoming iOS Update
- More in Security
Security Reviews
- Spybot - Search & Destroy +AV Home Edition
- Kaspersky Password Manager
- Avira Free Security
- Surfshark VPN
- 1Password