generally whitelisting is good, but won't we have a situation similar to UA whitelist?