Interesting, thanks.

Why does the syntax suck? "ipset add blackhole 192.168.3.4" is far easier to remember than "nft add element ip filter blackhole { 192.168.3.4 }"

As far as I can tell, all the authors of new networking tools on Linux just loooooove Cisco's IOS. All these new commands look like they'd be perfectly at home there, and seem very alien to me on Linux.

The latter look hideous