[sathackr]

DNS blackholing is playing whack-a-mole. I can blackhole scontent.xx.fbcdn.net today, and I have no assurance or confidence that they won't use scontent.xx.fbcdn2.net tomorrow.

DNS/FW whitelist is the only way to have even a little confidence that egress is controlled at this point.

[viraptor]

I meant blackholing as a technique. It can be either a blacklist or a whitelist, and yeah... whitelist seems more secure here