My point is that if you are going to design a system to identify bad websites it better be fail safe otherwise it is going to cause a lot of hurt.
The message shown in the browser for a phishing warning is the same as when a website has an invalid SSL certificate. The first is vaguely accurate, the latter is 100% accurate and no one is going to argue if the warning is needed. Both show the mind chilling warning no sane user will click through.
I am more interested in removing the phishing filter than in writing a phishing filter.
Anyways, with a 'closed' server component also in the mix, what option is there to provide any implementation.
IMHO, I think that doing things for the 'benefit of most' will lead to eroded freedoms for all over time.
PS: 'Supply a better implementation' is not an answer to writing poor code and hoisting on the world.