[oblio]

Yeah, that was my point, default deny vs default allow.

If you can default deny, then you're good. It's kind of a junior sysadmin mistake, otherwise, I would say.

[bugtodiffer]

There are usecases like SSRF where I want to allow any IP, except for my internal network. They promise they can do that, but they cant.