Ditto, and what's worse is when those white lists conflict with other requirements, such as "must work on latest Chrome version" but there's no way to test that without making a production release, because on the internal networks you're only able to use the whitelisted version, which is usually months to a year behind, and even that's an exception made specifically for devs because otherwise you should really be using IE. When pointing this out the answer typically goes like "well, try your best I guess?"

It's really something.