SkieShould I use an allow list or a block list for apps?
Use an allow list. In Skie an app list names the apps that may run, and everything else is hidden or removed. That is safer than chasing a block list, because new apps appear every day and you cannot name them all in advance. A short allow list is also easier to explain and audit.
A block list says 'everything except these'. It sounds convenient, but it fails open: any new game, chat app or clone that you have not heard of is allowed until you notice it. Someone has to keep the list current forever.
An allow list says 'only these'. A new app installed after setup is removed by the install guard if it is not on the list. A baseline snapshot of apps present at setup means existing apps are not wrongly removed, and essential system apps are never touched. The default state is safe without any extra work.
Skie does use blocking where it makes sense. More than fifty alternative browsers, VPN apps, proxy apps and DNS changer apps are always blocked whatever the list says. And blocking beats allowing across levels, so an organisation-level block cannot be reopened by a group. Blocks are a backstop and a fixed floor, with lists doing the daily work.
A practical way to build a list is to start from a template or a nearby class's list and add only what teachers can justify. Keep Chrome off exam and kiosk lists. Review lists each term with the where-used view. For a small business, the same logic applies to company phones: allow the work apps you name, and let the rest stay hidden.