Seen all the attacks and what AI allows for bad guys, I'm beginning to think that running my own DNS and null routing hundreds of thousands of domains (including variations of domains I use regularly, for which I automatically generated hundred of thousands of alternate names: to fight phishing) ain't enough.

I also block every single domain whose name contains non-ASCII character (no Unicode domain names for me / no punnycode: just get lost).

So maybe, maybe, maybe that after all I'll be moving to whitelisting domains. I know some do it and I know it's hard to do right. But some do just that.

It may be time for companies to give the list of all the domains we need to whitelist for their site to function.

Better yet: it may be time for companies to use as few domains as possible.

I don't care about your ads partners. I don't care about your surveillance (pardon, telemetry) partners.

It's too early to tell but a mindset shift may be coming.