quote

“The battle to one-up each other in parental controls is only going to benefit consumers,” said Chris Swenson, director of software industry analysis at the research firm the NPD Group. “There’s really no excuse now for parents not to lock down their PCs for their children.”

Walter S. Mossberg, You Have Weapons in Your Computer to Monitor Your Kids, Wall Street Journal, June 14, 2007, at B1.

Dad, It's Not Working!

Mac OS X 10.5+ (Leopard and Snow Leopard)

The Problem
Every couple of months my first-rate detective son will yell, "DAD, The Parental Controls aren't working again!"

This problem manifests itself in several fairly obvious ways.
1. Safari will allow any website.
2. Time Limits are not obeyed.
3. Application restrictions are not obeyed.
etc.

Basically the kid's account behaves as though it has no parental controls.

The Solution
Reboot holding down the X key.

This will force the OS to rebuild the kernel. I was told that the OS automatically does this every month or so, but sometimes it needs to be forced.

It took me approximately 2 hours on the phone with Apple Geniuses before we got to this solution, but I have now used it four times and it works like a charm. It has occurred on both my MacBook and the Mac Minis.

Printer Fix (Mac OSX)

In a previous post, I detailed how to remove the control of adding printers from the kids accounts. This works out fine until you need to print something from your own account. When a printer is added to system preferences it is added for all users. Leaving the kids free to print out more coloring pages from pbs.org's Super Why. This explains the mystery of why, after removing all the printers, my kids are still able to print.

Never fear, readers, I shall now present to you the penultimate solution to this problem. The first step is to make sure you have a separate account for the kids (System Preferences, Accounts). Make sure you remember what shortname you assign to the kids account.

There is a secret magic hidden and powerful set of options for your printer driver.

Open Safari, make sure the coast is clear, and navigate to the secret address:

http://localhost:631

This page may require a login. If so, use the administrator's shortname.
Once logged in, you should see a screen like this:


Click the Administration tab and then Manage Printers.


This should present a list of all printers which can be accessed by this computer.
Click on the printer you wish to restrict.
Then choose "Set Allowed Users" from the Administration drop-down menu.

Now for the final step. Allow only a set of users to print, or disallow certain accounts from printing. This requires the use of shortnames. If multiple shortnames are desired, separate them with a comma as you can see below.


Once you click the Set Allowed Users button, these accounts will no longer be able to print.

Done.
(for real this time.)

These options are on a per-computer basis, not a per-printer basis. So if there are two macs, both will need to have the options set.

Some Links

I have recently learned of some wonderful resources for parents. So let me hit you with a slew of links.

Yahoo! has some very in-depth sites to help parents.
This is their family site. which covers many issues parents face regarding technology. Their experts blog is useful too.

Somewhat related is Yahoo's security page which covers virus software and other security issues. They have a specific article regarding kids here as well.

NetFamilyNews
I have also recently found myself hanging on every word from Anne Collier's excellent blog. I cannot say enough about this blog. She raises some very interesting questions about the social web (myspace, facebook, etc.) and kids.

Downloadable Book
Also, here is a very comprehensive and free guide to parental controls

Software listing
This is a very comprehensive list of parental control software. The rest of the web site has some very useful information.

MacWorld
These three articles are fairly well written.
One
Two
Three

Why I heart Mac.

You can copy and paste parental controls from one account to another. It even works from one machine to another. *love*

Selling your children

Ok, perhaps "selling your children" is a bit harsh. However, there are commercial parental control software companies that sell your children's private conversations to their "trusted partners" It was reported by the AP today that one company in particular is gathering data from children's private online conversations and selling it for marketing purposes.

This is all part of the standard software agreement. When parents install the software and press "I accept," they agree to allow their children's online conversations to be sold to the highest bidder.

The software is developed by EchoMetrix Inc. based in Syosset, N.Y. They make several products including Sentry, Sentry Total Family Protection, Sentry Basic, Sentry Lite and FamilySafe (there is a product called SentryPC which has no affiliation with EchoMetrix) If you are using any of these products, there is a form online from which you can opt out of the data mining. The opt-out link is available through the program's control panel.

According to the Sentry press release on the subject,

[Our Software] is a proprietary software engine that reads digital content from multiple sources across the web, including: instant messages ("IM"), blogs, social environment communities, forums, and chat rooms.
...delivers the unsolicited raw conversations in real time...
...unmatched ability to get inside privileged IM chats...
...access to unfiltered and unbiased teen digital conversations...

More information can be found in the Associated Press article

Lessons Learned

After about a ream of pages printed out featuring Curious George and the man in the yellow hat, I found out the hard way that you have to pay attention to all the checkboxes in Parental Controls. To tell the truth, I thought that I had unchecked this on all the kids accounts. But I hadn't.

On one of the computers, I had left the ability for the kids to add printers. Today I had to order a new toner cartridge.


Damage Control To remove the ability for the kids to print, first remove all the printers from System Preferences. Then uncheck the box in Parental Controls allowing the kid's account to administer printers.

Instead, have your kids print to PDF. That will print to a file and it's available in every printer dialog on your Mac. Then they can give you the file and you can print it once, or maybe twice. But you will save paper and toner.

UPDATE: I'm not going crazy. I did remove them. This is not the final solution. The actual solution involves CUPS drivers and is detailed in this post

Security Tip

A simple idea.
Type your most commonly used password into your favorite search window on your machine. See if you can find instances of your password on your computer. See if your password appears in your emails. Now imagine what would happen if someone were to find out that password. Think of all the places you use that password and the numbers of people who might have access to that password.

It might be time to change your password. Especially at your bank.

It might be time to download a bit of password-remembering software like KeyPass.

This post is brought to you by a hard lesson recently learned by Twitter.

Beachballin'

One of the things that has annoyed me most about parental controls on Leopard is the logs and reporting feature. Every time I go to that screen in the Parental Controls, I get a beachball. It never comes back. And I end up having to Force Quit the System preferences.

I picked up a tip in the Apple forums some time ago, and I thought I would share it here.

Sometimes your child goes to a normal website and it has a link to something you think should be allowed. So the easy method would be to look at the logs on the parental controls to see what the most recently blocked website is. Then that site could be added and everything would theoretically run swell.


However, if you are like me and you get the beachball, you need a way around this. I have two. The first is to look in Safari at the Activity window.

But if you don't mind getting your hands dirty, I like the following method better.

Open up Terminal.

su mokidad
Password:

You will need to replace mokidad with your own shortname. The su (substitute user) command allows you to pretend to be you while logged in on the kids account.

Then copy and paste these next two commands.

cd /Library/Application\ Support/Apple/ParentalControls/

sudo sqlite3 Users/kids/events.data "SELECT datetime(ZDATE,'unixepoch','31 years','localtime'),ZPAGETITLE,ZPAGEADDRESS from ZBLOCKEDWEBSITE" sudo sqlite3 Users/kids/events.data "SELECT datetime(ZDATE,'unixepoch','31 years','localtime'),ZPAGETITLE,ZPAGEADDRESS from ZBLOCKEDWEBSITE"

Notice, there are two bold kids there. You will need to replace those with the shortname of the user you are trying to inspect. This will spew an entire history of all the blocked websites with the most recent ones being printed last. It will very quickly show you the website that was blocked. The last few lines of output for mine look something like this:


2009-08-31 20:25:46||http://1.channel29.facebook.com:80/x/670286327/false/p_100000106381638=1
2009-08-31 20:26:51||http://1.channel29.facebook.com:80/x/4098069827/false/p_100000106381638=0
2009-08-31 20:50:10||http://2.channel29.facebook.com:80/x/1785344291/true/p_100000106381638=0
2009-08-31 20:53:51||http://8.12.43.175/hotdices/game_farkle_users.php?view=week&filter=friends&filter_game=simple&fb_sig_user=100000106381638&fb_sig_session_key=2.320_VmoCnoNfm0g9nbr09Q__.86400.1251856800-100000106381638&sesid=b8guughed00thu115mvl9ovsuo06ojg3&time=1251770028734
2009-08-31 20:53:57||http://8.12.43.175/hotdices/game_farkle_data.php


I added the bold to highlight the important data. My daughter was on facebook and wanted to play the farkle game. Since it would not load, I was able to run this command and quickly isolate the server which was being blocked.



To enable Farkle on Facebook you will need to add access to
http://apps.facebook.com
http://8.12.43.175

Basics

This video from Apple demonstrates the basics in setting up parental controls in Leopard and Snow Leopard.

Mac passwords

TIP FOR: Mac OSX Tiger (10.4.x) and earlier

This tip is a bit on the technical side, but it is a glaring hole in the security of Macs. Basically, it is this: any user on your system can determine the administrator's password with a bit of knowhow. It has improved with Tiger and seems to be completely fixed with Leopard, but it is still possible. There is an excellent article about cracking Mac passwords here.

If however, you just want to plug the hole and fix this, here are the instructions:

Open Terminal.

Type this in:

sudo chmod 700 /usr/bin/nidump

Enter the administrator password when prompted.

This does not do anything in Leopard as Apple has removed nidump alltogether.

It's operating system season

and there are so many operating systems ripe for the harvest. Coming this week is the next incarnation of large feline -Mac OSX Snow Leopard. Then in another few weeks, Microsoft will be releasing Windows 7. A new version of Ubuntu is also coming very soon. My house is full of Macs and I will be getting the latest because at $49 for a 5 user license, why shouldn't I?

I am most excited to see what they do with parental controls. However as each day passes, I am less and less hopeful that anything will happen. Apple released a lot of literature today about Snow Leopard today and there is not one mention of parental controls.

Microsoft, on the other hand, has a very detailed blog post with all the "enhancements" they are about to make to parental controls in Windows 7.

However, it seems that Windows 7 will be taking a step backwards in parental controls. They have removed web filtering and reporting from the operating system alltogether. Relying on third party software to do it for them.

/Epic fail

Gimp

Gimp is a free image manipulation program. Think Photoshop for cheapos. Photoshop for cheapos that don't want to Torrent Photoshop. It's a great and very powerful program that does more than most people would ever need from image editing software.

Tonight I tried to install the latest version on OSX Leopard for the kids. This was not easy.

Not only do you have to enable Gimp as an application that is allowed, you also have to install and allow X11. X11 is a free program that is on your Leopard install disk. It is not normally installed with OSX, but is easy enough to install with your original disk.

If that were all it would be okay.

The other steps involved are these:
Open Gimp on the administrator account. Make sure it installed correctly.

Next Open Parental Controls and allow the application for the kids. I have two in my list.
Also make sure to allow X11 (under Utilities)
The last step is the hardest.

Open Gimp on the kid's account.

Sounds easy, however, due to the fact that Gimp is ported to OSX from other platforms, it has about 50 different applications that need to be allowed for the kids. These do not show up in parental controls for whatever reason. So they must be allowed individually. This means

Open Gimp.
Allow whatever application it needs to use (gimp-helper, set-fontsize, etc)
Close Gimp (and possibly X11)
Repeat.

Eventually it will work. And it is worth it! The kids can create some amazing things with Gimp. It just takes some parental patience in the beginning.

Firefox

Just a reminder to my OSX readers.

Firefox does not obey parental controls. You can lock down whatever you want, but if you allow Firefox, Opera, IE, Google Chrome or any other browser, then your safetynet has a large gaping hole. To disallow Firefox, go to Parental Controls | System.

Check the box for "Only allow selected applications"

And do not allow things which you do not want.

Lock it up

A good practice on any computer is to lock the screen when you leave. There are several ways to do this:

First, set up your screen saver to require a password to get back in. This way if you forget to lock the screen it will automatically lock after a few minutes.

OSX
In System Preferences | Security
Check "Require password to wake this computer from sleep or screen saver."

Windows
Display Properties | Screen Saver
Check "On resume, password protect my computer"

Second, make a habit of locking your screen every time you get up

In OSX, you will need a shortcut to start the screensaver. I use the hot-corners function so that when I place my mouse in the top corner, the computer locks. You could also enable "Show Status in Menu Bar"

In Windows, you can press the windows key and the L key at the same time. This will lock the computer.

Location, location, location

Computer placement is essential to the operability of any parental controls software. Place the computers in a centrally located area of the home. Your kids are less likely to try to find holes in the software when Dad and Mom are right there.

This blog is more dedicated to the technical aspects of parental controls software and I want to stay away from psychological discussions, however, the other essential ingredient to the success of parental controls software is to open up a dialog with your children about why the controls are in place.

Choosing the right software

Parental control software is a daunting category. On Amazon.com, there are currently 66 results for "parental control software."

However I have the magnet to help find the needle in the haystack. I have been a Software Engineer for sixteen years and I can unequivocally tell you that parental controls should be a function of the operating system. All other parental controls are band-aids and kids are smart. There are plenty of ways to skirt around parental control software. These can easily be found with a quick search on Google or Yahoo.

Today there are options for parental control software which are built-in to the operating system. There are two software packages that I recommend:

1. Apple's OSX 10.5 (Leopard)
   10.4 (Tiger) has a good level of parental controls but they are vastly improved in 10.5
2. Microsoft's Windows Vista Home
   Note that other versions of Vista (Business and Executive) do NOT have parental controls.

These two are far from perfect, and are in desperate need of some of the features which have been available for years in other software packages. However the strength of Vista and Leopard lies in their user account management system. When set up correctly, the only way to bypass parental controls is to know the administrator password.

JellyTelly

Jelly Telly is a hit in my house. My kids get a huge kick out of the Fabulous Bently Brothers and Buck Denver. Recently, We tried ice cream with cereal because, as Buck Denver says

What is the difference in putting milk and sugar on your Cheerios vs. putting ice cream on your Cheerios? Isn't ice cream just milk and sugar?*

Personally, I love imitating Dr. Schniffenhousen's accent in so many different situations.

When I first turned on parental controls, however, my kids missed a few days of JellyTelly. This is due to the fact that you need to add two servers to your parental controls in order to get JellyTelly.com working

http://jellytelly.com
http://ooyala.com

Ooyala is the video delivery service that JellyTelly uses to host video content.

* Family Verdict: The reason ice cream and cereal do not work is the Crunch™. Cereal is designed to need some of the liquid that the milk provides. The cereal is just a bit too crunchy without the milk. And by the time your ice cream melts enough to sog up the cereal then you have kind of missed the point.

Webkinz

Setting up parental controls to work with Webkinz™ should be easy. Webkinz is a wonderful site for kids (and parents). You buy a stuffed animal which comes with a secret code. The secret code unlocks a virtual character that can interact with the Webkinz world.

However, for being such a child-centric site, Webkinz does not play well with Parental Control Software. If a parent were to unlock www.webkinz.com by itself then they would not get past the login screen. Forever wondering what could be beyond the magical flashing W promising that something is "Loading..."

Ganz, the makers of Webkinz, has a list of servers in their FAQ that need to be unlocked, but due to their immense popularity they have added many servers to handle their loads and yet they have not updated their list. So many parents (including myself) were stuck watching the flashing W.

I believe, through some searching, some surmising, and some determination, I have compiled a list of all of the IP addresses that need to be added to your parental control software in order to get Webkinz working again. These need to be allowed individually in your parental control software. There are several ways to do this which I will cover in future posts.

Here is the list


66.48.69.98
66.48.69.99
66.48.69.100
66.48.69.101
66.48.69.102
66.48.69.103
66.48.69.104
66.48.69.105
66.48.69.106
66.48.69.115
66.48.69.116
66.48.69.117
66.48.69.118
66.48.69.123
66.48.69.124
66.48.83.130
66.48.83.131
66.48.83.132
66.48.83.133
66.48.83.134
66.48.69.158
66.48.69.159
66.48.69.160
66.48.69.164
66.48.69.165
66.48.83.158
66.48.83.159
66.48.83.160
66.48.83.161
66.48.83.162
66.48.83.163
66.48.83.164
66.48.83.165
66.48.83.210
66.48.83.211
66.48.83.212
66.48.83.213
66.48.83.214
66.48.83.216
66.48.83.218