If you're talking about Websense Web Security, it's category based. "Uncategorized sites" is one of the categories, and the admin can block or allow it the same as any other category. So whether it uses a blacklist or a whitelist is entirely up to the admin. You can also make exceptions - maybe someone decided there was a really good reason to allow Amazon and TDWTF. It's not the software's fault if the admin gives it a crazy policy to implement.