You can whitelist but it isn't easy for non-technical users and becomes a huge chore.

And this story is 100% accurate. I'll try and find it.