Default Allow vs Default Deny

This topic is meant as discussion (not arguement) of the benefits of one protection philosophy over the other. In particular, why does ESET feels that a Default Allow architecture is better than the non-stream Default Deny architecture?

What can be done to improve it (the Default Allow architecture), besides what's already known (heuristics, behaviour blocker, av definitions, etc).

I'm very curious about this topic, since I have heard about both approaches to computer security.

Thanks for your input and opinions. Please keep it respectful and clean