[developer2]

There is simply too much trial and error caused by initially denying a connection, only to discover that it's a mandatory connection to allow the app to function properly. A ridiculous amount of time is spent changing an initial deny to an accept.

>> your decisions about what to block and when, are different from my decisions about what to block and when

It really would not be hard to offer sensible default presets per application. "Spotify is attempting to make its first connection. Would you like to a) block all connections, b) allow all connections, c) allow all connections required for standard operation only, or d) ask me for each connection (manual management)". Nobody is going to fine-tune every phone-home or analytics call; people who want them blocked will block them all, and people who don't mind won't block any of them.

The only reason it's a tough job is that applications can change frequently. Every time any app (ex: Spotify) releases a new version, it needs to be reviewed again to see if the "firewall database" needs updating. It would be useless to have a database of known connections if updates aren't disseminated to users within 1-2 days of a new release.