With a little tuning, the Application restrictions were fine, except of course for the fact that I couldn’t use XCode, but I guess that developers aren’t really in the Parental Controls target audience.

I never really got into the time restrictions properly, whenever I exceeded my limits, I just typed in the admin password, and gave myself more time.  The system is entirely workable however, it just wasn’t the point of my experiment.

The Mail and I assume Chat restrictions worked quite well.  Despite the intrusive nature of the process, if we’re talking about managing a child online, then the system works exactly as I’d want it to.

Like all web filters, the content filters leave a little to be desired, I couldn’t read a page on the supposed dangers of Soy Milk, I assume, because it mentioned the effect Soy Milk is supposed to have on ones libido.  But I could successfully search for breast tattoos on google images, and get to see naked chicks, some were even goths as per my previous post.  What really let the content filtering down was it’s complete failure to handle SSL – All SSL sites are blocked by default, and the error messages and silent failures are anything but helpful.  Some more investigation is warranted here, I can’t help but think that the OS is running a transparent proxy to check the pages, which would mean that it would work with any installed browser, which would be a good thing (bring on Firefox or Opera) but makes handling SSL difficult.

Overall, the experience wasn’t nearly as bad as I expected if Apple can overcome the SSL problems, then I can see how Parental Controls could be a useful tool.  Of course, the experiment did reinforce something that I already new – It is only a tool, and no substitute for effective communication between the Parent and the Child.

Possibly Related Posts:

• Parental Controls and XCode
• Parental Controls – First Impressions
• OSX Parental Controls

I was able to create an XCode group as a member of Developer Tools and Developer Documentation.  Adding Loom at Work to that group got the XCode environment working for that user, even though the user is a managed user.

The Loom at Work account has no restrictions on aplication execution though, and that is more significant than I first realised.    I’ll go as far as saying it should have been obvious.  Loom is heavily restricted when compared to Loom at Work, so much so that even attempting to compile with XCode fails.  Loom can’t run any of the tools necessary to compile code.  Adding the tools progressively into the allowed applications list eventually gets a successful compile. But permission is needed to even run the new executable.

It seems that XCode and Application restrictions are not going to work nicely together – ever.  Like I said, it should have been obvious.

Until I can work out how to address the problem, it looks like no software development for Loom.

Possibly Related Posts:

• Parental Controls – Wrapping things up
• Parental Controls – First Impressions
• OSX Parental Controls

I expected that the process of taking away my membership of the Administrator group would lead to problems running some of my applications, I wasn’t wrong.  The two applications that I’ve run into problems with so far are Wireshark and XCode.I use Wireshark quite a lot at work, and the problems running it relate more to the fact that my recent installation of Snow Leopard changed things than to turning Parental Controls on.  On OSX, Wireshark uses the /dev/bpf* devices to enable traffic sniffing, and by default these are owned by the root:wheel use and group with only the root user being able to access them.

sudo wireshark

will get wireshark running as a standard user, but :

1. that is bad,and
2. my “Loom at Work” account isn’t in the wheel group anyway

The solution that Wireshark users on OSX adopt is to use a ChmodBPF startup item, which changes the ownership and permissions of the devices at each boot.  Normally, this would set the group for the devices to the Administrators group, in my case, I have created a wireshark group, and added both the Parent and Loom at Work users.

XCode was a bit more complicated. Pretty much everything works as a non-admin user, except for running and debugging code, for this a special permission is required.  A permission that is granted to the normally hidden “Developer Tools” group, a group which the Administrators group is, not surprisingly, a member of.

Managing Users and groups at this level with OSX’s DirectoryService is not exactly straightforward, at least it wasn’t straightforward for me initially.  Once I found the Workgroup Manager application, which is part of the OSX Server Tools, things were simple.  It appears that there are two developer related groups, Developer Tools and Developer Documentation.  My soultion was to create an XCode group, which is a member of both of those groups, and add both of my managed users to that Group.

The Workgroup Manager application gives me a lot more insight into exactly how flexible OSX can be when it comes to account restrictions.  It seems to me that the standard “Parental Controls” feature is actually just a wrapper for a much more complete user management system.

With that housekeeping aside, I was free to move on to appreciating the experience of being a “Manager User’.  Keep in mind that , as this is a closed process, I control all three of the Loom, Loom at Work and Parent accounts.

The following observations relate specifically to the Loom account.

Application Restrictions

The default set of restricted applications suggested by OSX is reasonably sane.  In addition to the default set, I had  given myself access to Photoshop, Corel PhotoPaint and a couple of other imaging related applications right from the start.  No access to the Preferences panel is annoying, but on a well set up machine, it shouldn’t be a problem.

After less than an hour of  doing “stuff” under these restrictions, I found that I needed – really needed – access to Terminal, playing with *nix based devices will do that do you.

The other  thing that I can’t live without is SecondLife, but that’s just me.

Content restrictions

Initially, web access was not very successful.  As I mentioned in my previous post, https is a problem, and not only because it needs parental approval every time you visit a new site.  Normally, when the content filter decides I can’t see a page, I get a nice message telling me that that is the case.  Seraching for “Naked Goth Chicks” on google images results in the following.

I can click the Add Website and get Parent to let me keep browsing,  Parent can choose to let me through just once, or anytime I like.

When I try to connect to https://www.google.com, I get this result instead

Not nearly as helpful.  Parent needs to add the https://google.com to the approved sites list using the Parental Controls preferences pane.

If that was the end of the problem, it wouldn’t be so bad.  www.secondlife.com is an example of the difficulty that can come from this limitation.  The SecondLife portal allows a user to login and perform various account management.  the portal itself is all HTTP, but much of the traffic is HTTPS traffic.  Only, the traffic doesn’t go to www.secondlife.com, it instead goes somewhere like https://load-balancer18.lindenlab.com.   This conversation silently fails, and since the user gets no feedback about what failed, it is very hard to fix easily.  The load-balancer18.lindenlab.com will turn up in the blocked sites log – more on that later – but simply adding it to the allowed sites list from there doesn’t help, since next time, it could be a different machine in the load balancer pool.  The solution is to add https://lindenlab.com to the allowed sites list, since this allows access to all of the sub-domains as well.  There are a lot of sites that use SSL only for important parts of a session, and serve static content from entirely different servers and domains.

Despite these hiccups, the system isn’t too bad, it hasn’t really hampered my day to day browsing.  I have already had a few experiences of being  allowed access to one page in a site, while being blocked from a page that it links to.  In each case that this has occurred, checking the logs and viewing the blocked content using Parent has led to pages containing some sort of adult content.  Of course, we are relying here on someone else’s definition of adult here, which is a subjective thing.  The ability to easily grant access to blocked content on a case by case basis does a good job of negating the effect of this subjectivity.

Email/iChat

I haven’t been able to use iChat at all since I switched Parental controls on.  I used to use iChat connected to a Messenger account through a Jabber gateway.  The Parental Controls don’t support Jabber, and so, I have no messaging.  Microsoft Messenger is installed on my MacBook, and although I haven’t tried it, I’m guessing that I could use it unfiltered to chat with people, if only my Parent would let me.  The Parental Controls for iChat only support MobileMe, Mac.com and AIM accounts. I expect that the experience is similar to using Mail.

I deliberately opted for a clean slate approach when I switched on the email Parental Controls.  Mail and iChat are both limited to approved contacts only, and I left the initial contacts list empty.  I did switch on the approval mechanism though.  Every email with a non-approved email address (and I assume iChat contact) received by Loom triggers an email to Parent.  The email sent includes the full text of the email received.  Trying to send an email to a non-approved address prompts Loom to “Request Permission” first.  The  emails received by the Parent present a toolbar allowing Parent to approve (or dis-approve) of the contact for Loom.  When approved, the mail which was previously hidden from Loom is visible on the next mail refresh.

I’m not sure how the process work work with another mail client tough – say Outlook – the approval messages seem to use custom Apple headers.

Even though I am both Loom and Parent, I can’t begin to explain how invasive the process feels to me.  Even though Parent only sees the first email received from any given contact, the fact that they see even that email bothers me.  As a parent, I can see how important this is, and would like to see an “Approve this eMail” button in there next to the “Approve Contact” button.  Clearly a dialog between Parent and Loom needs to occur here.

The other benefit to the Parental Controls is that all of the Junk eMail rules get processed by Parent‘s mail account, and the Loom will only ever get parentally-approved spam.

Time restrictions

Initially, I thought that the time restrictions that I imposed were quite reasonable – for me at least.  3 hours a day on weekdays, seemed like plenty.  The 10pm cut-off seemed reasonable.

15 minutes before time runs out, either total time on the computer, or the curfew kicks in, Loom is prompted to add more time.  Naturally, the Parent needs to enter a password here to allow a time extension.  It is important to note that time logged seems to be what counts here, so even if only a screen-saver is running, I am still using my allocated time.  I need to do some testing to confirm this however.  In the meantime, I have set a 15 minute automatic logout to minimise time loss when I wander away for an hour or two.

I have found myself repeatedly adding time to Loom‘s session, and allowing myself to remain logged in past curfew, explaining to my inner Parent – quite successfully – that I am in th middle of something important, last night, it was reconfiguring my asterisk box.

The time extensions aside, I have found that these self-imposed limits are changing the way I use the computer – I am forced to prioritise my time.  I am planning to stop arbitrarily awarding myself more time – likely to be a failed plan – after I extend my weekend time allocation out to 7 or 8 hours.

Logging

OSX Parental Controls logs activity into four categories :

• Websites Visited,
• Websites Blocked,
• Applications and
• iChat

They track exactly what the names imply.  The Websites visited log gives a mechanism to block future access to a site, and the Websites Blocked log allows a site to be approved.  Both logs can be sorted by date or site, and filtered by time.  Any of the visited pages can be easily opened Parent.  The Applications log can be similarly sorted and filtered, and simply records how many times an application was used and how much time was spent using that application.  I can see potential for application level time restrictions here.  Until I work out how I’m going to test the iChat filters, I can’t report on how the logging works.

I’m a little surprised that there isn’t some kind of Mail log as well, detailing how many messages were sent to which contacts, possibly showing the content of those messages.

Like the Mail contact approval process, the website logs can be incredibly invasive.  Everything that I have looked at, including my failed searches for Naked  Goth Chicks are logged there.  That is of course the point.  Like all of these tools, they will only work well if they are part of a dialog between Parent and the Loom.

As Parent the logs give me enough information to talk to Loom about what it is that I am doing on the web, what Parent doesn’t get to see is what Loom actually looked at on Facebook.

Even more Parental Controls

My current obsession with Parental Controls and OSX led me to a search for more information on the subject.  So far I have found two more applications which include additional controls.

• the DVD Player and
• iTunes

The DVD player has a per account Parental Control option which requires an Administrator password to activate and deactivate.  Once active, Parent needs to approve each DVD to be viewed by Loom.  Approval can be granted for all future uses of that DVD or for a single session only.  Whilst I have activated this feature, since I don’t watch many DVD’s on my MacBook, it probably won’t affect me greatly.

iTunes allows access to Various types of media to be restricted, and also enables content filtering on the iTunes Store.  I have allowed all content types for Loom, but restricted iTunes store access to explicit material, and filtered Movies, TV shows and Applications to Australian  PG, PG and 12+ respectively.  I can only see the explicit content block and the restriction on iPhone applications actually affecting me since I have never used the other services.  Interestingly, the settings appear to have no effect on the iPhone Apps that I have already downloaded, or on the music already in my library.

Next Steps

I am still using Parent fairly regularly,  fine tuning Loom‘s web access, and approving contacts.  I expect that things will settle down on that front in the next few days.  It is the feeling that everything I do is being monitored that I am having trouble getting used to.

As nonsensical as the statement is – there is absolutely nothing that I do on my MacBook that I disapprove of – I still feel as if I need to change my behavior because someone is constantly looking over my shoulder.

Possibly Related Posts:

• Parental Controls – Wrapping things up
• Parental Controls and XCode
• OSX Parental Controls

The Australian governments recent Clean Feed internet trials have also got me thinking about exactly how the tools that are supposed to be there for users actually are.

Like many workplaces, mine implements web and spam filtering software and firewalls which very rarely actually get in the way of me doing my job.  Of course, I also know how to completely bypass them when they won’t let me look at www.2600.com because it’s a hacking site.  Or spend more than an hour on other sites because the filter thinks that they aren’t work related.

The plan

About four months ago, I switched from a Linux based laptop to a MacBook – that is probably the subject of a blog post in itself – suffice it to say that I am now happily using OS X 10.7 which happens to include what appears to be a decent set of parental controls.  Today I decided to switch them on, and subject myself to “Parental Control”

Of course, it isn’t as easy as simply turning the controls on, setting the defaults and leaving it at that.  Aside from seeing what it is like to live in a restricted environment, I still need to be able to do work at work – and while that doesn’t necessarily mean a local admin account on OSX, it does mean I can’t use some of the more interesting Parental Control features.

The setup

With the above in mind, I have set up 3 accounts.  My original “Loom” account, a “Loom at Work” and a “Parent”.  I have also created a dedicated email address for the Parent account, and configured Mail accordingly.  The “Parent” account is the only member of the Administrators group, and is used to manage Parental Controls for the other accounts.  The “Loom at Work” account is standard user account that is restricted to logging in between the hours of 7am and 6pm Monday to Friday.

The “Loom” account is much more restricted :

• The set of usable applications is limited to Parental Controls default
• The dictionary profanity filter is turned on
• The automatic adult website filter is turned on (I tried the restrict to a limited set option, but it was too painful)
• Mail and iChat are both limited to approved contacts only.
• I am limited to 3 hours per day computer time on weekdays and 4 hours per day on weekends
• “Bedtime” is set to 10pm-7am for “school-nights” and midnight-7am for weekends

Since I also have the password to the Administrator account, it is easy for me to change these settings if I want to, my intent is to change them only if I need to.

Using applications

If something is on the approved list, it will run, if not, I get prompted to allow it to run once, or to be permanently added to the allowed applications list.  My intent is to use “Allow Once…” the first time I receive this message for an application and “Always Allow…” should I receive them regularly.  I expect that the list of approved applications should settle down after a few days.

Mail and iChat approval

The list of approved contacts is empty to begin with.  Every time an email is sent to or received from an address not on the list, an email is sent to the admin account to request approval.  This email includes the full text of the one to be sent or received.  Again, I intend to approve all contacts.  I’m only bothering to do this to get a feel for the process.

Time Extensions

There is provision for the Parent to allow logins beyond the imposed time restrictions.  At this stage I am not planning to allow any activity outside of the restrictions, the exception will be allowing the “Loom at Work” account to log in if needed.

The experience so far

After 3 hours, the only issue I have found is that the content filter blocks all https traffic to domains which aren’t explicitly added to the whitelist. When the domains in question are embedded in other pages, the popup “get an administrator to approve this” button doesn’t work, and the preferences pane is needed.

More significantly though, the idea of blocking all secure traffic because it is secure bothers me.

Where to next

A day is hardly enough time to draw conclusions, I hope to have more to report in a day or two.

Possibly Related Posts:

• Parental Controls – Wrapping things up
• Parental Controls and XCode
• Parental Controls – First Impressions