N4L turns off web filtering

[Patrick Dunford]

I administer N4L web filtering for two schools.

 

On one of the schools the web filtering has been bypassed because an extra rule, which I can’t see in the management console, called “School Enforced Allow”, was put in that bypasses all the other rules we have configured. This rule simply lets all web traffic through and none of the other rules can have any impact.

 

This school has 2 more rules being evaluated than are actually present in the web filtering management console.

 

School #2 has 3 more rules being evaluated than are actually present in the web filtering management console, including the “School Enforced Allow” rule again.

 

At this stage I am still waiting for an explanation from N4L as to why they have inserted these extra rules into the web filtering system and why we can’t change or remove them from the system.

 

 

[Patrick Dunford]

OK small correction

 

It lets through a list of URLs that some administrator has decided schools are not allowed to block. There is no obvious reason why this would be the case.

 

For example the Google Books website is in there meaning your school cannot block anyone from accessing Google Books. The entire apple.com site is whitelisted, which makes no sense because it is not an education website (it is classified as “Computers and Internet”).

 

It makes no sense to have a global override list that schools cannot manage and which they cannot trace using the advanced web filtering (because authentication or any other policy they may have can’t be enforced on these web sites).

 

There is no transparency over how websites get into this list, since there are some there which are obviously commercial websites like accessitsoftware.com, it makes it look like N4L is selling advertising access to schools to commercial companies.

[Julian Davison]

Traditionally these lists are based on common things that many sites use ‘in the background’. Apple.com, perhaps, to allow for simplified use of Apple devices which have a variety of requirements (updates, app installs, apple-ids) that can be tricky to isolate to the minimum requirements. Or Aerohive management which means people can simply use, or not use, Aerohive hardware without having to involve N4L (to ensure the cloud management operates).

 

I’d have hoped there was a list of the whitelist content somewhere.

 

I’m not at all clear how you reached the conclusion N4L “is selling advertising access to schools” however.

 

Cheers, Julian

Julian Davison
Technical Consultant
Decision1 IT Solutions Ltd
PO Box 368
Dunedin
P 03 471 8232
F 03 471 8234
W www.decision1.co.nz
E jul...@decision1.co.nz

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

---

Note:
If you are not the intended recipient of this email, please contact the sender immediately by return email or by telephone on +64 3 4718232.  In this case please do not act in reliance on this email or any attachments, and destroy all copies of them. The views expressed in this email are those of the sender and not necessarily of Decision1 IT Solutions Ltd.

---

P Please consider the environment before printing this e-mail

---

[J B]

This is one of my big concerns with some centralized systems, we had a similar problem quite a while ago with watchdog blocking some useful sites (fixed ages ago).  It seems to come down to the providers personal preference and judgment to override the school.  If apple is completely white listed I hope the same applies to Microsoft, Ubuntu, redhat, hp, Acer etc.

Sent from my Windows Phone

---

From: Patrick Dunford
Sent: ‎8/‎19/‎2015 1:35 PM

To: techies-f...@googlegroups.com
Subject: [techies-for-schools] RE: N4L turns off web filtering

[Jonathan Webster]

That's correct Julian, 

The list is designed to cover a number of key infrastructure services which schools on the Managed Network use. There are also a number of services which do not work well, or at all through a proxy due to the way they have implemented their CDNs for example. We work with these providers when such issues arise, however we do have to ensure these services (such as Apple OS recovery) continue to function while we investigate them further.

The school enforce allow filter can be viewed by anyone with access to the N4L Web Filtering Dashboard under 'filters'.

--

Jonathan Webster 
Senior Engineer - Infrastructure, The Network for Learning Ltd

D: 09 222 2402 | M: 022 040 3300 | W: http://www.n4l.co.nz
A: Suite 306, Geyser Building, 100 Parnell Road, Parnell, Auckland 1052
P: PO Box 37118, Parnell, Auckland 1151

[Patrick Dunford]

There are commercial sites listed that aren’t classified as educational sites. The reason for them being there is unclear.

[Patrick Dunford]

The school should be able to manage the list of sites like any filter they may be able to configure. In other words it is either the last rule in the list or there is no rule, schools can make their own rule if they want to access these services.

[Julian Davison]

You can’t put it as the last rule when rules are evaluated top-to-bottom. They tend to be included because their requirements are minimal – that is to say, they have minimal interference.

 

If you would like the rule removed they might be able to do that. Then you can attempt to recreate it’s effect by hand, as necessary.

 

From a technical perspective, knowing that my site, when it gains N4L isn’t going to suddenly find large chunks of their system fail is supremely useful. Additionally knowing that I (or the school) can adjust the rules, even to be wholly broken, and similarly the Aerohive wireless isn’t going to suddenly fail is brilliant.

If you are concerned about the default list of things that can be accessed through your N4L link but that you may not have explicitly mentioned, I presume you went through the standard N4L firewall rules and requested that they be further limited?

[Julian Davison]

Then ask for the rationale. In the absence of having it explained to you leaping to “N4L is selling advertising access to schools” is wholly unreasonable and unfair.

[Mike Etheridge]

TBF, I have found N4Ls dealings so far characterised by decisions made and actions taken by them with no consultation or explanation, or sometimes a bland statement along the lines of “technical improvements” or “technical problems". A tad patronising and high-handed. This contrasts with our previous ISP who kept us fully informed and gave us all of the technical explanations we requested. So I understand Patrick’s concerns. On the other hand, dealings with individual engineers and technicians at N4L have been completely satisfactory, once they understood our needs.

Mike

[Julian Davison]

I understand Patrick’s concerns as well. As a general principle I have found the flow of information out of N4L slow, at best (though improving) and there is a lack of transparency in various places – Patrick clearly was not made aware of the default whitelist, which ideally he would have been. N4L is not as proactive as other providers in the ISP arena, but it is improving, in my experience.

However, there is a vast jump between “there’s stuff going on that I didn’t know about” and “N4L are selling advertising access”. The former is a valid concern and needs to be raised. The latter is, given it was proposed without having had the former explained, counter-productive conjecture. To get things changed we need to focus on *actual* issues and experiences, not tangential leaps of thought that could be quite inflammatory – or worse, if taken out of context and promoted as accurate.

 

Cheers, Julian

Julian Davison
Technical Consultant
Decision1 IT Solutions Ltd
PO Box 368
Dunedin
P 03 471 8232
F 03 471 8234
W www.decision1.co.nz
E jul...@decision1.co.nz

 

From: techies-f...@googlegroups.com [mailto:techies-f...@googlegroups.com] On Behalf Of Mike Etheridge

Sent: Wednesday, 19 August 2015 3:33 p.m.
To: techies-f...@googlegroups.com

[Jeremy Nees]

Hey All,

Not meant to be any nefarious intent here (i.e. selling advertising). As Jonathan said the list is there to prevent some issues we observe affecting schools across the network, and to prevent every school from having to be notified and apply these individually. An example of this was dexv3.minedu.govt.nz, which was preventing ENROL integration from working from SMS's. We use these rule as little as possible, and prune it as much as possible. You can view the list through the filtering dashboard, so it's not hidden away, but accept Julian's point that this is not necessarily well known.

In terms of the comments about flow of information, this may be an unintended consequence of most of our comms being more designed for teachers and principals. If there are specific examples where you think we can improve in this area, feel free to flick me an email or give me a call to discuss.

We have recently put a Managed Network section in Pond, so if you are associated with a school, you will be able to see graphs from the router at that school (we are still doing some testing so haven't heavily promoted its existence yet). This is just a starting point to establish a place where we can start providing more information around your school's connection - ref https://www.pond.co.nz/managed-network note: you will need to be logged in with a Pond account related to a school. The point of this is to start to establish more transparency, but respect that schools may not want their connection information shared with everyone, hence why it is authenticated through Pond.

The Web Filtering Dashboard is also available, and we encourage schools to use this for modifying their filtering policies. For schools who do not wish to self-administer their filtering our help desk is available to make changes.

Thanks

Jeremy Nees 
CTO, The Network for Learning Ltd

D: +64 9 972 1676 | M: +64 21 919 220 | W: http://www.n4l.co.nz/

A: Suite 306, Geyser Building, 100 Parnell Road, Parnell, Auckland 1052
P: PO Box 37118, Parnell, Auckland 1151

Jeremy Nees 
CTO, The Network for Learning Ltd

D: +64 9 972 1676 | M: +64 21 919 220 | W: http://www.n4l.co.nz/

A: Suite 306, Geyser Building, 100 Parnell Road, Parnell, Auckland 1052
P: PO Box 37118, Parnell, Auckland 1151

[Patrick Dunford]

Perhaps you have not encountered a situation where we have been asked to block students access to internet. This system means we cannot do that. That does happen here from time to time and it will just leave me in a position where I will have to be explaining to the school management that we actually can’t totally block internet access.

 

--
Patrick Dunford

[Andrew Godfrey]

This is where a two level filtering system might help. In the days of Watchdog we used to use Watchdog as a broad filter and an on site solution to provide finer grained control.

Not sure how you would get around sites that N4L block outright though if they do that.

[Tim Kong]

Evening,

In the webinar tomorrow - http://info.n4l.co.nz/Web-Filtering-Training-Registration.html - I'll be spending a bit of time going over this rule that you're referring to Patrick.

These two rules,  'Master - School - Enforced ALLOW and 'Master - School - Enforced Block', have been designed as Jeremy has outlined, and I'll explain the logic of them. 

On Wednesday, August 19, 2015 at 5:41:57 PM UTC+12, Patrick Dunford wrote:

Perhaps you have not encountered a situation where we have been asked to block students access to internet. This system means we cannot do that. That does happen here from time to time and it will just leave me in a position where I will have to be explaining to the school management that we actually can’t totally block internet access.

Do you mean that you will need to specifically block access to those sites listed in the Master - Enforced ALLOW rule? If so - then yes, students that you need to block can still access those sites, because of this ALLOW rule.

But if you need to setup a group of students who require more restricted access - that can be done by creating your school defined rules. Which includes applying access by IP range, and for certain periods of time. Obviously the more complex your needs, the more complex your setup.

If you need to totally block student access to the internet - in my experience in the classroom, we did that by removing their access to devices, including 3G capable ones. But that was an extreme situation, that no filtering system was really designed to resolve.

Regards,

Tim

 

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

---

Note:
If you are not the intended recipient of this email, please contact the sender immediately by return email or by telephone on +64 3 4718232.  In this case please do not act in reliance on this email or any attachments, and destroy all copies of them. The views expressed in this email are those of the sender and not necessarily of Decision1 IT Solutions Ltd.

---

P Please consider the environment before printing this e-mail

---

-- 
You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

-- 
You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

---

Note:
If you are not the intended recipient of this email, please contact the sender immediately by return email or by telephone on +64 3 4718232.  In this case please do not act in reliance on this email or any attachments, and destroy all copies of them. The views expressed in this email are those of the sender and not necessarily of Decision1 IT Solutions Ltd.

---

P Please consider the environment before printing this e-mail

---

 

-- 
You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

 

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to

...

[trevor storr]

Interestingly, as a GAFE school, even the students we want to block from the internet are still allowed to access *google.com and a few limited educational sites.  I don't really consider being able to access the internet per se a privilege any more.  Even the students we put in G-NOINTERNET for our ldap filtering will still be doing stuff on their phones.

Educating our learners to be wise users has to be the key these days.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

---

Note:
If you are not the intended recipient of this email, please contact the sender immediately by return email or by telephone on +64 3 4718232.  In this case please do not act in reliance on this email or any attachments, and destroy all copies of them. The views expressed in this email are those of the sender and not necessarily of Decision1 IT Solutions Ltd.

---

P Please consider the environment before printing this e-mail

---

-- 
You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

-- 
You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

---

Note:
If you are not the intended recipient of this email, please contact the sender immediately by return email or by telephone on +64 3 4718232.  In this case please do not act in reliance on this email or any attachments, and destroy all copies of them. The views expressed in this email are those of the sender and not necessarily of Decision1 IT Solutions Ltd.

---

P Please consider the environment before printing this e-mail

---

 

-- 
You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

 

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to

...

--

You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

cheers

Trevor

Trevor Storr
Director of eLearning, CantaNET http://educo.vln.school.nz
Waimate High School
Waimate
New Zealand

[Tim Kong]

On Wednesday, August 19, 2015 at 6:52:56 PM UTC+12, Andrew Godfrey wrote:

This is where a two level filtering system might help. In the days of Watchdog we used to use Watchdog as a broad filter and an on site solution to provide finer grained control.

Not sure how you would get around sites that N4L block outright though if they do that.

And you are entitled to do that.

A number of schools are using other products inside the N4L connection to apply filtering. 

In the webinar, I'm happy to show the "Master - BLOCK" filter, and what sites are blocked, and hopefully, the logic behind those blocks will be self-explanatory.

To speak to what Mike and Julian have said - the aim of these webinars is to be transparent and upfront about the N4L filtering. That is something we know we can improve on, and I'm aiming to do so.

If we can do that, and school leaders and technicians in schools can understand what the N4L filtering allows - then the school can make useful and judicious decisions about how best to utilise it, based on your specific needs. 

We are also able to disable the N4L filtering entirely - and schools are allowed to do so at their discretion, and manage their own filtering solution, using products of their own choice.

The reality is that building a centrally provisioned service means by definition we will not be able to meet the wants of every single school. But I believe we're doing our best to meet the needs of the majority. 

Many of you in this group are outliers (and I mean that in a positive sense) who have built and know your systems very well. However, for every Patrick, or Mike, or Tim Harper - there are dozens of schools who don't have access to these skillsets, and for them if N4L can support them by managing the technical complexity of filtering - they can then get on with the myriad of other aspects of being in a school - and making a difference with students.

All of that said - our aim is to make a difference for each school - so as Jeremy has said, please be in touch with specific issues that are affecting yours. This forum's useful - but the contacting us via the details in the signature is better.

Regards,

Tim Kong 

School Training Lead, The Network for Learning Ltd

D: 04 333 0017 ext 714 | M: +64 21 835 664 | W: www.n4l.co.nz 

A: Level 9, Bayleys Building, 36 Brandon Street, Wellington Central, Wellington 6011
P: PO Box 11487, Manners Street, Wellington 6142

[Patrick Dunford]

Enforced block includes weapons (presumably that is supposed to include firearms)

Enforced allow includes the Google Books website

So even if the school wants to block Google books they can’t

Now I can go to Google Books and search for firearms and get to see book previews that contain info about firearms

I can see books for hacking

Maybe some of the other blocked categories (haven’t tried any others)

 

Is there something I’m missing here?

 

From: Tim Kong

Sent: Wednesday, August 19, 2015 8:39 PM

To: Techies for schools

Subject: Re: [techies-for-schools] N4L turns off web filtering

 

--

[Julian Davison]

Historically, almost all instances of students that are to be ‘entirely banned’ from the internet involve a collection of class teachers (in a high school, with multiple subjects) extremely frustrated because the student is unable to take part in various aspects of their course. The result tended to be the concept of a ‘restricted student’ – whereas by default students could visit things that weren’t blocked, restricted students could only visit sites that had been explicitly allowed. Which at least provided a mechanism whereby a student could lose privilege for inappropriate use, but not be excluded from the actual learning process that they were there for.

There are exceptions, but it’s fairly uncommon for computer use to be okay, but zero internet access permitted (before you concern yourself with students ‘sharing’ passwords/accounts).

 

Cheers, Julian

Julian Davison
Technical Consultant
Decision1 IT Solutions Ltd
PO Box 368
Dunedin
P 03 471 8232
F 03 471 8234
W www.decision1.co.nz
E jul...@decision1.co.nz

 

[Peter Mancer]

Andrew

I prefer the term "In the previous days of Watchdog"  as we are still around but looking after hundreds of schools that have not yet changed over and providing a much broader range of IT services in the New Days of Watchdog.

We can still provide a two level filtering system if required no matter what connection a school has and I'm happy to have that conversation off forum.

Kind regards

Peter

_____________________________
Peter Mancer
CEO & CTO
Watchdog Corporation Ltd
Watchdog International Ltd
Watchdog IT Support Ltd
PO Box 314 008
Orewa 
Auckland 0946
New Zealand

Ph +64 (0)9 426 1101 x797
Fax +64 (0)9 426 1102
Mobile +64 (0)21 366 469

www.watchdog.net.nz
www.watchdoginternational.net

peter....@watchdog.net.nz

Skype: pmancer

This email is confidential.  If you received it in error, please notify the sender and delete the email.


Smarter IT Management

[Andrew Godfrey]

On 20 August 2015 at 09:10, Julian Davison <Jul...@decision1.co.nz> wrote:

fairly uncommon for computer use to be okay, but zero internet access permitted

This does happen for some assessments at Burnside. Staff run a script which disables the students' standard account (therefore no internet access through Linewize or access to files on the school server) and enables their corresponding exam login (which can access the staff shared files and printing gets charged to the department assessment account rather than individual students).

_______________________________________

 

Andrew Godfrey  |  Network Manager

[Mike Etheridge]

…or turning on a wireless hotspot on their phone and visiting any site they like…

[Julian Davison]

I have watched the N4L train for a while now. It was, as all centrally provisioned systems are, never going to be a perfect fit for everyone.

While the staff aren’t new to their job areas, N4L itself was a very new entity and suffered as all new providers do as it streamlined internal processes, external processes and the liaison between them.

Personally I have found some aspects of the various processes extremely frustrating. Or rather, I did. As a general principal I raise issues with the appropriate people as I find them. In the case of N4L this has always resulted in quick response and resolution and pretty much always a very satisfying resolution. I don’t expect N4L to have everything ready at once. It’s difficult to predict the information that people will need, or the webinars that will be useful to run – but N4L have always given me the impression that they are very keen and willing to provide the things their customers desire. So people do need to tell them. Directly.

I’d also opt for mentioning things in places like this, because the more information that’s available the better. But in real terms, how many schools are actually represented here?

 

Overall I’m quite positive about N4L. It deploys a cookie-cutter solution into sites that, realistically, will be fine for a huge number of sites. But you can talk to them. They can and will change things to accommodate the schools needs. It’s not set in stone.

 

Cheers, Julian

Julian Davison
Technical Consultant
Decision1 IT Solutions Ltd
PO Box 368
Dunedin
P 03 471 8232
F 03 471 8234
W www.decision1.co.nz
E jul...@decision1.co.nz

 

From: techies-f...@googlegroups.com [mailto:techies-f...@googlegroups.com] On Behalf Of Tim Kong
Sent: Wednesday, 19 August 2015 8:39 p.m.
To: Techies for schools <techies-f...@googlegroups.com>
Subject: Re: [techies-for-schools] N4L turns off web filtering

 

--

You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Julian Davison]

I’ve always liked the ‘dual-login’ approach for assessments. I keep waiting to encounter an assessment where limited internet access is required J

 

Cheers, Julian

Julian Davison
Technical Consultant
Decision1 IT Solutions Ltd
PO Box 368
Dunedin
P 03 471 8232
F 03 471 8234
W www.decision1.co.nz
E jul...@decision1.co.nz

 

From: techies-f...@googlegroups.com [mailto:techies-f...@googlegroups.com] On Behalf Of Andrew Godfrey
Sent: Thursday, 20 August 2015 9:21 a.m.
To: techies-f...@googlegroups.com
Subject: Re: [techies-for-schools] N4L turns off web filtering

 

 

On 20 August 2015 at 09:10, Julian Davison <Jul...@decision1.co.nz> wrote:

--

You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Andrew Godfrey]

On 20 August 2015 at 09:15, Peter Mancer <peter....@watchdog.net.nz> wrote:

I prefer the term "In the previous days of Watchdog"  as we are still around but looking after hundreds of schools that have not yet changed over and providing a much broader range of IT services

Sorry about that Peter. Maybe I should have said "when we used to use Watchdog for filtering" which worked great during the NEN trial as well as many years previous to that and I know that you still help many schools with more than just filtering (including us).

[Patrick Dunford]

It’s normally at the request of the parents.