Comments on: School filters vs. home proxies

Some schools let filter bypassers off the hook if they'll reveal how they did it. Plus: Rating professors online; and sites that may be scarier than MySpace.

[umbrae]

Geez

Its sad when a student has to teach the IT department about Proxies. Prehaps that should stop hiring administrators from the Kmart School of Tech and actually hire people that know how to do the job.

[tanis143]

No brainer

The schools can barely afford to pay the teachers wages, what makes you think they can afford an IT department that knows what its doing?

[rcrusoe]

It's not their fault

The "I.T. Department" at a lot of schools are just some users that have never used anything except Windows and know very little about computers, networks, and especially security.

It's not their fault that they got stuck with the job. You have to be at the top of your game if you expect to ride herd on a group of savvy students.

[mahurshi]

Kmart School of Tech ... haha

nice one :-)

[CaptDave86]

Running the IT Dept

When I was in HS me and my Best friend pritty much ran the IT dept. If some teacher/administrator in the school had a computer problem, they woul dcall my shop and ask for one of us. we would go down to their room, find out what was wrong with it, and fix it. If it was a hardware problem, we went to the IT dept room , got some replacement hardware for it and fixed it. If a room needed some new computers or a Touch board set up, we were the ones to do it. the IT manager only did the Schools Server and grades, everything else was left up to us. Now that we have both graduated 3 years ago, the school has gone downhill seing how no one knows or is willing to keep the computers and other hardware working.

[YourM0m]

I'm a proxy admin for a school district

This is a difficult issue. Just today I blocked around 25 more proxy sites that students were using. There are litterally thousands of proxy sites out there. There is no way to blacklist them all. I have all the ones that students have used up until this point blocked. I can search through the logs looking for proxy sites and block them as I find them. I also can actively watch the logs and grep for proxy sites as they hit them. When I find one they can get to I block it.

Recently I added some complex regular expressions that block most proxy sites even if they are not blacklisted. It's a very tricky thing to block the sites you don't want them going to but still allowying access to what they need to get to. Using a whitelist only approach would never work for us. I don't know how other districts do it.

Another thing a lot of people don't realize is how easy it is to setup a proxy bypass off of their home internet connection. If they do it properly it's almost impossible to detect.

There is no easy solution to the problem. You just have to constantly adapt to what the students figure out.

--
Steve - http://tail-f.net/

[Kinux]

Question

"Recently I added some complex regular expressions that block
most proxy sites even if they are not blacklisted."

Steve,

I work for a school district as well and it is a daily chore to block
a whole list of proxies students are using to bypass our filter.
I was curious about your complex expressions. Could you let me
know what exactly your adding to your filter to block non-
blacklisted proxies.

Thanks!

[DeusExMachina]

illusions of harm

"There is no easy solution to the problem. You just have to
constantly adapt to what the students figure out."

Why?

[School Hacker]

Sucks for you

Thanks to people like me I make your job a necessity for schools. You aren't going to come out with someone that will keep us from searching the web. I honestly don't have any reason to go to innappropriate sites during school hours. I use this for research and sometimes to have debates. There are a million websites I can use. Proxy services are everywhere, the more you block, the more creative you force us to get.

[CaptDave86]

Block Radmin too

Dont forget to block Remote Administrator too. maybe you have heard of it, mybe not, but this is an app where you set up a server or computer to run the app and allow an incoming connection to control the computer like you are right at it. the down side to this is, it uses a port, and the IP can be any range of IP's due to that it is run off the remote computer. the default port is 6899, but can be changed. this is the app i used when i was in school to get around the proxies that the school had running and to get around the fact that they were blocking public proxies too.

ref:
www.radmin.com

[eligiblebachelor]

Problem is deeper than proxies

Being about a year out of high school which had really bad websense filters I hope I can add a little to the issue at hand. I personally used proxies on more than i should have had to and by that i mean school projects that needed the web to research for blocked nearly every relevant search result known to man. By this I mean for example my health class had a unit on drugs and side effects why we shouldn't do them etc. well if you do a search for crack, smack, pcp and any other drug out there your search is blocked. Every student better hope that you also aren't needed to research the issues like God in the Constitution or how Muslim terrorists bombed the United States. These are nearly all blocked for terrorism and also that awful religion word....In short the way I saw it and still see it the only sites worthy of blocking are that of pornographic nature and sites that just kill time like game sites (I do not mean game review sites as this would surely conflict with sites needed for debate classes on how violence in video games affects reviews and the desire for young people to have them and things like that)this is because by limiting information at school students will only do projects on the status quo and well...who wants that?

[ralahinn1]

Schools have weird blocks on things

I know of a student who had to do an assignment for class only to find that google was blocked. I know a library that uses websence to "block" sites, yet they recently blocked a friend of mine's site(it was about video games and anime, and din't have anything naughty) yet still allowed a site with pictures of "beastiality"0_0 which I never saw before. The blocks arent perfect. parental and personal teacher supervision is still the best way to go, and people should cut the teens some slack once in a while and let them go to"harmless" sites sometimes

[Carusk]

the more walls you build, the more the need to get through them

im a senior high school student and inmy earlier years i used to do anything to get past any restrictions i could, its all part of this rebellious feeling growing up. if theres something stopping me, i gota find a way around it. we even accessed the schools students medical records once. we only got caught for having programs like putty and a few other tools, which we only had to pay the overtime it took the techies to trace it to us.

[gefitz]

Four words: Filters Won't Ever Work.

The problem is that people have this expectation that blocking "the bad" and allowing "the good" is easy and maintainable in the long run.

To keep up with this issue, you need a full-time employee monitoring the network at all times. Libraries can't afford books, schools can't afford teachers, but society expects them both to be "proxy parents".

Good luck with that. I'll watch what my kids do, show them right from wrong, like my parents did for me and theirs for them. Too bad most parents don't see the need for that effort.

[zxocuteboy]

what 2 do

I think my lil sitster might be a cutter... but i don't really know what to do...

[sonicdivx]

one word: cellphones

Umm, so what happens when cellphone internet drops in price. Forget the school network, lets use the cellphone.

[aabcdefghij987654321]

Re: Cellphones: Problem Solved

If they all did that, then the problem would be solved, as the issue would not be inappropriate use of school resources anymore.

[lewissalem]

Good observation...

..reminds me of my Dad who once said that he hated kids with cellphones. Now everybody has them. I think perhaps what he hated about them is that kids could communicate without any control from the parents. Is this really such a bad thing?

[School Hacker]

Correct

I have the internet on my Verizon Razr. I can go to any site I want and have connection anywhere. What are teachers going to do next? Demand that we put our cell phones in a box at the beginning of the period.

[yen2ken]

School filters quash motivation to learn

Today's public education system seems more concerned with attendance than with learning. It's foolish to put more effort into ways to keep students from illegitimate activity than into ways to reward successful efforts to learn. Invisible internet fences snuff out innovative impulses in some kids and totally confuse other kids who can conclude "the Internet isn't useful." Teachers need to encourage and reward curiosity, motivation, and initiative whenever it appears in young minds. In doing their jobs, administrators and teachers must always chose between enabling and constraining their students. Better to demand that kids learn to do quick and discriminating web searches than to force them to paw thru library books to find answers to easily graded test questions. Better to task kids to find ways to validate web "information" than to prevent them from using the web during school hours. If they have time in school to play, give them more and better learning assignments, don't lock them out of the electronic library. And if protecting sensitive young minds from web-smut is the aim, better to leave the web doors open, then identify and track the kids whose PCs get dirty, and punish those offenders appropriately for partaking, than to implement fences that prevent kids from developing self-control and good judgement.

[lazarus_vendetta]

Apperently Not

Lol did you read the article? These kids are putting a major effort towards circumventing the schools filter. Seems to me they are motivated, at least to break the security.

[The Red Herring]

Old Computer + Debian + Tinyproxy

Old p3 I found in the garbage + Debian 3.1 + Tinyproxy

Its free, and nearly impossible for admins to block.

Is it morally right? Should I have it?
Yes and yes
I'm not doing anythign illegal with it, I have logs to prove it, I just hate being told what I can and can't see on the internet.

Have a nice life admins,
Nerds will always win.

[stacksmasher]

Nerds will always win.

Nerds will always win!


And I make more money than you!

[1337 haxor]

of course we will always win...

we will always win because of many reasons
1. you cant teach an ond IT new tricks (easly)
2. if we cant find a way around something we write our own

3. the world relys on us to supply them with the technology that they cant live with out
4. kids in Highschool are alot more comp savvy than most IT's in their district buildings
5. there are more but i dont have time to post them

XD i am proud to say that i am one of them

[Jeff419]

De-Sensitizing Kids To Internet Control

I am totally against censorship. It goes against every principle America stands for. What truly concerns me is that our children are getting used to having certain websites blocked because they are deemed "inappropiate" by someone in authority. What gives these people the right to make that kind of decision? When you consider this and the net neutrality battles currently being waged it leads me truly question the direction we are going as a society.

There are also the stories about cell phone companies selling a tracking service so parents can monitor their kids movements and also set certain areas off-limits. It's not that parents shouldn't be able to tell their kids where they can go, that's very reasonable. What bothers me is that these kids are being trained that it's okay, even normal, for their every move to be tracked.

All in all any campaign being sold with the goal of protecting children scares me. Why? Because it's so easy to defend ridiculous policy. All they have to do is say that their opposition is against protecting children and the general public, being easily controlled sheep, will automatically swallow this like they swallow everything else their TV tells them.

But then again maybe I'm just paranoid. Believe me, I'd love to be proven wrong, but in this I don't see that happening.

[CaptDave86]

Tracking Kids by Cellphones

Parents shouldnt HAVE to use tracking to see where their kids are, but the parents that do, do it, must have a good reason. One, if their kid gets kidnapped, they can find out where they are, mostlikely, faster than just by looking for them. Two, they cant trust their kid to stay where they are told to stay, IE within a few blocks or miles of the house, and the kid wants to try and be a rebble and go to the next state. Three, they are yuppie 15 and 16 year olds that mommy and daddy are paranoid about and little junior hates them.

personaly I dont think a 15 or 16 year old should have a cell phone any way. One it just causes more problems at school, and little junior is going to get pissed at the teacher for taking away their 500$ cell phone and mommy and daddy will have to go get it from the princible. I didn't even own a Cell phone till I was 19, if I needed one, and on rare occasion, I borrowed my pratens one. By the time I was 19 I was moved out and on my own in the military, where you are requred to have one.

[davaal]

key log

in my labs, i key log. its draconian, but every child - from the lowliest 1st grader to the snartest 5th grader - has a login/password and an assigned seat. they dont know it, but i log every key stroke. then i can search for phrases 'time' and 'station' stamped key words. i can pull reports to see who's logged as what.

punishment is ruthelss and is absolute. whenever someone is caught, i ban them from all school computers. i let them know that i read every email they send or receive in my lab.

if they wanna bypass security, they can do it on a another teacher's computers or in the 'other' school lab.

because of 2 kids, i recently blocked all webmail. the kids know that if youre sitting at a machine that comes up 'mail.google' or 'mail.yahoo', youre finished.

[davaal]

key log

in my labs, i key log. its draconian, but every child - from the lowliest 1st grader to the snartest 5th grader - has a login/password and an assigned seat. they dont know it, but i log every key stroke. then i can search for phrases 'time' and 'station' stamped key words. i can pull reports to see who's logged as what.

punishment is ruthelss and is absolute. whenever someone is caught, i ban them from all school computers. i let them know that i read every email they send or receive in my lab.

if they wanna bypass security, they can do it on a another teacher's computers or in the 'other' school lab.

because of 2 kids, i recently blocked all webmail. the kids know that if youre sitting at a machine that comes up 'mail.google' or 'mail.yahoo', youre finished.

[lpcustom]

False Sense of Security

I hope you don't believe that will stop someone from doing something you don't expect. Your smartest 5th grader is probably reading your email and you don't have a clue. Your false sense of security is why admins like the one's in this CNET story have to have a kid explain something to them. They thought they were pros and they didn't expect someone was better than them. You represent the same attitude with your "key log" statement. Do you know what a live cd is??? I doubt it. A live cd is just one way of getting around your "key logger." All it requires is booting from a CD. With it the student would have full network access and would even be able to remove the keylogger from the machine completely.

[lytfyre]

WELL DONE!

Just what those kids need, a fear of unnecisarily draconian authority!

I must admit though, i am impressed with your commitment to this. I am sitting here writing this from a computer at my highschool, which *I* setup, from the BIOS passwords to the OS. Its an OSX10.4 box, and I am root.

Im a student.

When the teachers are "having computer troubles" I help. When the school board sent some techs in over the easter break to change our school to DHCP , and missed many boxes, cutting them off the network with our main computer teacher chaperoning the Easter trip, I had to go around and change machines. when for whatever reason the server decides that someone doesnt need a homespace, I give peers access to my FTP server.

I carry live CDs. I have a home webserver setup as a proxy, along with a number of mini versions of a number of apps. (putty, opera, etc.)

And you know what? through doing it I have learned TONS of information about how to run FreeBSD, I have learnt how to more effectively manage a network, secure an OS, setup backup utilities. I have saved teachers time and trouble, and I have developed a great interest in technology.

If you scan for mail.google and the like, what a pitty that i will be loging into my home server (which runs qmail) using telnet.

If I care about content, I will be typing sentences that wont trip your lists and copying and pasting them into the form they need to be in for my message.

and when you try to throw me off the system, there i will be, using my laptop and spoofing the MAC address of one of your precious boxes, using a VPN to avoid packet scanning. Sofar it has never hurt anyone. Because kids are always going to find ways around you. there are one of you and many off us, and we are better motivated. We will always find ways around your restrictions. Does it do anygood o stop me accessing a site because it is containing information about a topic the school finds politically incorrect?

welcome to the real world Mr. Anderson, everything can be considered offensive. Actually, according to my religeon (Reborn Fundamenalist Anarchism) it is essential to my religeous beliefs that no restrictions be placed on any access to any information, and that taking actions against anyone who was acting in the pursuit of knowledge is a crime against God. Looks like your keylogger is grounds for me to sue for religeous discrimination.

[School Hacker]

Your a joke

That is pretty funny. Your Key Logger is nice yet very easy to make sure you are won't be able to do it for a while. First off, I highly doubt you are a teacher due to your inability to use proper grammar and punctuation. For one second lets assume you are. Do you know how easy it is to shut you down? All the computers are connected on the network, I bring in my own lap top one day and log onto your network. Then, I send you a little file and oh no. Nothing is working anymore. I could probably use something as simple as a batch file.

[DeusExMachina]

You're kidding?

?right? Do you honestly believe that your attempt at control via
key logging stops anyone who it truly motivated? In addition to
the other methods mentioned to trivially bypass such
foolishness, simple key replace apps make these attempts
useless. This is not to even mention such silliness as teh 1337
and other such 514/\/9. Do you even know what that is? DO you
REALLY hope to know what kids are saying using key loggers?!

Jeeze. Even with no technical know-how, if I really wanted to get
around your stupid system, all I would have to do is type the
numbers 0-9 and a period, then cut and paste them as needed
into the IP address line of my browser. Similarly, I could use the
full alphabet if I only knew the URL. Your key-logger would be
deaf and blind to this simple hack.

None of this even mentions how this harms an educational
environment by stifling thought.
Congratulations for sharing the "worst educator of the year"
award.

[gdawg23]

Oh come on man. What could fifth graders be doing thats so bad? You probably just dont want them to find those pictures of you on the front page of yahoo from when you were released from prison as a pedophile. Stop creeping on little kids and reading their personal thoughts....oh and pull your head out of your ass... i heard it good for your health.

[cammears]

Sounds like me...

That sounds alot like me...

I am a Senior in High School. At our school we have a "one to one" laptop program, every high school student is issued a laptop for them to take home.

On our laptops we have restrictions to where we can install programs (AIM, FireFox). But that doesnt mean that we cant run them. Our district network has Websense for internet filtering (that doesnt stop me).

At my house I have setup a proxy server that also has VPN and Remote Desktop. The VPN support allows me to transfer files to and from my home servers. The Proxy server that I have setup allows me, and other students to get passed the school network. I currently have around 50 accounts setup , one for each user on the proxy.

I dont go around and spred my proxy around the school, but I do give it to people durig class that need it. Even though this is my last year here I still plan on keeping the proxy running for a couple more years.

At my house I currently have DSL, but within the month I will be getting FIOS, which should speed up the connection alot. I am running the proxy off of a HP Netserver that I picked up from a local business. So the only money out of pocket is paying for the internet connection.

[lewissalem]

That's great...

..good to hear that you've gotten around these wacky restrictions. "Here you go, here's a laptop, now don't do anything bad with it."

[thedreaming]

What's funny...

...is that these kids are proving that they are smarter than we think they are, but we only see them breaking rules that we setup for their protection. The internet isn't a clean place, so we have to stop them from wandering to the wrong website and reading something they shouldnt know about until they are older and can understand what they are reading.

[DeusExMachina]

That's funny

protection from what, exactly?

what exactly is a "wrong website" and why do I need to be
protected from it? What, pray tell, is "something they shouldn't (be
reading?)"

Seems to me that the ones who have trouble understanding things
are the ones demanding content-based censorship. (Bandwidth
usage is another matter.)

[lewissalem]

Myspace is "scary" now?

Ok, so there's some pervs that are on myspace. There are pervs that are on every social networking site. But to call myspace "scary" is a little irresponsible.

Myspace is over anyways. The second somebody puts a patrolman to watch over a bunch of kids, its over. The only thing you can hope to do is to help your children make the right decisions. It's a scary world, but you have to let go sometimes.

[School Hacker]

It is so easy to get around these school blocks

My school uses the St. Bernard Filter Service to try and keep us off of innappropriate sites. Not only have some friends and I set up some programs that allow us around them, if they block these we just enter the network as admins and change it back. The schools really need to get better IT people to protect the networks. I could have hacked these back in 7th grade.

[stephanie241989]

I totally agree

see what teachers and principals dont understand is that us kids will alwayse find a way to get past what they try to stop us from doing. I mean ya they think they can stop us but really all they are doing is makeing us think even harder into how we can get past their sensoring. Honestly they should just give up because this is not a battle that they can win.

[ghettofreek]

dans gaurdian

at our school we have dans gaurdian how can we get around this
our it is pretty good any tips would be appreciated
thanks alot

Jayme

[Diannnnnne]

Please Help

Im pretty sure that there are some very computer
literate people here that can help me. I want to be able to get around the blocks they post at school. I am not going to pornographic or otherwise dangerous sites, i just want to get through. Please post a response, and soon!!!!

[tonycb]

Kids are funny...

Wait til you set foot in the real world. Try this crap from a company's network and see how fast your ass is escorted out by security. I've seen it many times. You don't follow our rules, get the hell out. Terminated on the spot. Try to cry censorship and they'll laugh in your face.

Anyone that thinks a school doesn't have the right to limit what you do on THEIR computer on THEIR network, needs a wakeup call. The real world and a real company could be just that.


You put a companies data at risk, they won't take it lightly, trust me.

You kiddies be careful or you might see yourself in front of judge.

It's rediculous to think that most kids are by passing filters because they want to get to legitimate education websites. Even if a few are We all know, for most the reason is to check personal email, myspace, porn etc, etc. It's a joke. And our youth doesn't need yet another distraction.

Good luck admins. I know it's gotta suck to have to deal with snot nose brats all day.

[M!keMcG]

My school blocked Wikipedia

"It's rediculous to think that most kids are by passing filters because they want to get to legitimate education websites."

I find it funny that you say that. It just so happens that we were in the lab for Geo doing research on ecological footprints and I decided to good ol' Wikipedia to help me out. Turns out good ol' Wikipedia was blocked by my school.

I have lots of friends who talk about this ("Dude, Wikipedia's blocked! ***?") and it pisses me off.

[Tomcat Adam]

O Rly?

I've been blocked from educational resources an unbelievable amount of times by filters and IP bans (lazy proxy bans, IMO). So have a lot of people I know. Realistically, most blocks I see occure when students around me are trying to access material during class FOR class.

Luckily for me, historical Wikipedia articles aren't all blocked.
--------------------------

I've seen tons of sites and employee blogs where they go on and on about how they check email, watch videos, and similar, all during their work. Please don't feed us this "Do that at work and You'll be fired" BS.

[xharold]

Have people forgot about ping?

ping www.myspace.com from Terminal or command prompt. It's not hard. I'm glad I'm one of the only tech savvy kids in my school. Sometimes being tech savvy comes with some sacrifices, teachers automatically assume you use Windows at home. Not me. If people used Linux in their schools, they could just block out hosts. It's not hard, you know. It's just a matter of editing a file with roota ccess. Just make sure you don't allow password reset when GRUB comes up (if you use it..)

[xharold]

Have people forgot about ping?

ping www.myspace.com from Terminal or command prompt. It's not hard. I'm glad I'm one of the only tech savvy kids in my school. Sometimes being tech savvy comes with some sacrifices, teachers automatically assume you use Windows at home. Not me. If people used Linux in their schools, they could just block out hosts. It's not hard, you know. It's just a matter of editing a file with roota ccess. Just make sure you don't allow password reset when GRUB comes up (if you use it..)

63.208.226.42 Go myspace!

[CaptDave86]

Have you forgotten...

...how the internet works? a ping is compeatly different than a HTTP request. A ping just goes to see if the site and or server acctually exists, where as a HTTP request(from IE or mozilla or whatever you use) fetches the information from that site. The information on the site is what is blocked not the IP in most cases. So your so called Ping work around isnt even a work around, its just lack of knowledge.

PS thats not the only IP for myspace, its also a complete waste of resources and one of many places for yuppies to congregate.

[bladesmith]

Not just content filtering

While content filtering and bandwidth management are parts of the school filtering equation, don't forget about virused websites, websites with spyware, virused emails, drive by spyware infections, phishing attacks, etc...

One of the last things a school admin wants to worry about is cleaning up dozens or hundreds of workstations each day because users (students or staff) visited infected websites, either inadvertantly or deliberately.

Most students couldn't care less about protecting their school computer from infection and care even less about preserving network resources for their fellow students.

Website filtering helps preserve internet access by filtering out bandwidth hogging activity.
It preserves computing resources by preventing the infection of school workstations.

Some school filtering solutions have override features. Our school district allows this for school purposes.
If a student needs to access sites that are blocked (for whatever reason), they ask their teacher. If it's for a school project, it's allowed.

If they're caught abusing the privilege, they get a date with the school principal.

If the students are worried about their privacy, forget it. Privacy in a publicly funded school district isn't a right or entitlement. They may as well get used to it.