Secondary School - iPad onsite and offsite filtering + alerting

[Brax]

To put it bluntly, the staff don't have a clue.

My staff user base are about 5 to 10 % competent power users, the rest just surf the web not having a clue what browser they are using or any of its main features.

 

If anything, iPads are the only Apple product in use within the school so using Safari competently and saving bookmarks etc... would have no benefit off device as they use Windows PC with MS Edge and Entra accounts where their bookmarks are all cloud synced so they would be better off having Edge over Safari on the iPad purely for the cloud synced features being compatible with PC's or replace every PC in the school with a Mac to utilise iCloud sync.

 

The same logic applies to the Apple mail app and when I first started I left it on iPads and made Outlook available for ease and whoever wanted it. After having so many issues with the native mail app and shared mailboxes being a PITA I removed that when it became available as option and forced Outlook mail app on iPads which is a breeze to use in comparison when using Office365 mailboxes.

 

My big concern with using a third party browser is how does that tie in with the likes of JamF teacher or even Apple Classroom apps as they offer URL blocking / Allow options and does that only translate to Safari or does it translate to any browser on an iPad as teachers do use those options on a class by class basis for control with misbehaving kids and trust me there are A LOT of those in Secondary schools.

 

Again, this is where extensive testing comes into play.

 

The smartest department in Apple is not their technology department but their marketing department. They do a fantastic job of making everyone want an Apple product and the latest one but people have no idea how to use all the functionality in them and when they also pitch their school marketing about how great for education they are but when you look at what Apple themselves offer for education in terms of controls, management, document sharing and even blocking of simple features its abysmal and left to third parties to try and clean up the mess with what little access Apple allow to iPads as they advertise them as being able to do everything and more but they are simply not a full blown computer replacement. Yes, I'm looking at you Airplane mode that you can't restrict so kids just flip this on to kill WiFi and Bluetooth so teachers can't manage them, you can individually block WiFi on/off and Bluetooth but not Airplane mode! Or even background image change, you can restrict that but then they released Focus mode which can then circumvent that. It's a nightmare.

 

Remember iPads just work! Don’t get me started on the focus mode. So many tickets and incidents because they were changing the wallpaper… I think Jamf do have a fix for that now though.

[Tefters]

Remember iPads just work! Don’t get me started on the focus mode. So many tickets and incidents because they were changing the wallpaper… I think Jamf do have a fix for that now though.

 

Ow, do you happen to know what/where the fix is?

 

I'm about to go diving into JamF restriction settings again but cannot find anything on a quick knowledgebase search.

[Brimstone]

To put it bluntly, the staff don't have a clue.

My staff user base are about 5 to 10 % competent power users, the rest just surf the web not having a clue what browser they are using or any of its main features.

 

If anything, iPads are the only Apple product in use within the school so using Safari competently and saving bookmarks etc... would have no benefit off device as they use Windows PC with MS Edge and Entra accounts where their bookmarks are all cloud synced so they would be better off having Edge over Safari on the iPad purely for the cloud synced features being compatible with PC's or replace every PC in the school with a Mac to utilise iCloud sync.

Sounds like not a single teacher got any CPD when you rolled out the iPads to them...Do you have a long term CPD plan for teachers> Have they been enrolled into Apple's free online teacher CPD, Apple Teacher at all?

 

 

My big concern with using a third party browser is how does that tie in with the likes of JamF teacher or even Apple Classroom apps as they offer URL blocking / Allow options and does that only translate to Safari or does it translate to any browser on an iPad as teachers do use those options on a class by class basis for control with misbehaving kids and trust me there are A LOT of those in Secondary schools.

 

The third party browser will not work with either Jamf Teacher or Classroom..

[Brax]

Ow, do you happen to know what/where the fix is?

 

I'm about to go diving into JamF restriction settings again but cannot find anything on a quick knowledgebase search.

 

I don’t have access to Jamf in my new role so can’t recall if we enabled anything else but you’ll need to update them all to latest iOS if you haven’t already and then pretty much everywhere on the student profile for the background change it to the one you want. They can still use focus mode but the wallpaper shouldn’t change now.Apple fixed this in iOS 17.5.1.

[Brimstone]

Ow, do you happen to know what/where the fix is?

 

I'm about to go diving into JamF restriction settings again but cannot find anything on a quick knowledgebase search.

Is this Jamf Pro or Jamf School?

[Tefters]

School.

 

I was also looking today out of curiosity to see if there was a feature for locking or blocking iPads between certain out of hours but couldn't find an option.

 

I'm sure there used to be one but I might be wrong.

Maybe this is now a JamF pro feature and school is too basic for our needs?

 

At time of original purchase the only advantage pro had over school was Mac management which we don't have any of except a caching server.

 

Also, cheers @Brax so looks like it's just a general feature fix to the original blocking background restriction then as I cannot find any new options but in all fairness have not tested this on an iPad either due to time.

Edited November 6, 2024 by Tefters

[Synkrox]

Sorry to interrupt - your setup is similar to mine, but I haven;t got that far yet as only our staff machines go offsite.

Is this something you push out to your ipads, or are you referring to the proxy settings in windows?

I thought a PAC file was generally handed out via DHCP, so would not be applicable when offsite?

Are you making your proxy publicly available (with auth) rather than using a background VPN then?

Can chat over PM if easier

Thanks!

Chris

[Tefters]

Sorry to interrupt - your setup is similar to mine, but I haven;t got that far yet as only our staff machines go offsite.

Is this something you push out to your ipads, or are you referring to the proxy settings in windows?

I thought a PAC file was generally handed out via DHCP, so would not be applicable when offsite?

Are you making your proxy publicly available (with auth) rather than using a background VPN then?

Can chat over PM if easier

Thanks!

Chris

Sounds like you're talking about a completely different scenario.

 

I'm talking about cloud filtering proxies with PAC files being deployed via MDM to iPads along with active word monitoring.

 

Not that I'm thinking about it that much but can you push out a PAC file via DHCP and if so how does that work when your not on the network that gives out the PAC file and at home? That's why you use a deployment app method or management solution to push the settings out to the device.

[Synkrox]

Sorry my fault - I thought I had replied to RLRs post - as they use Fortigate and Fastvue as I do. Out of context my post makes no sense.

[johbreaking]

Currently looking at options for monitoring and iPads is the hot topic in one of our schools, does lightspeed or securly send a screenshot if a pupil was to type something "risk to life"?

[Tefters]

Currently looking at options for monitoring and iPads is the hot topic in one of our schools, does lightspeed or securly send a screenshot if a pupil was to type something "risk to life"?

 

I would avoid Lightspeed like the plague when it comes to safeguard alerting / monitoring and iPads.

 

As I've mentioned previously, cant speak for their PC / Mac options which are probably pretty good due to agent installs but for iPads please do not do it, it is not fit for purpose on iPads.

[johbreaking]

I would avoid Lightspeed like the plague when it comes to safeguard alerting / monitoring and iPads.

 

As I've mentioned previously, cant speak for their PC / Mac options which are probably pretty good due to agent installs but for iPads please do not do it, it is not fit for purpose on iPads.

 

Sorry just looking for confimation does Lightspeed or Securly do the screenshots? Can you explain why not fit for purpose?

[Tefters]

Sorry just looking for confimation does Lightspeed or Securly do the screenshots? Can you explain why not fit for purpose?

Look through my previous posts in this thread about the porn incident earlier this week, that was a failure on their filtering.

 

As for the monitoring, look at my profile for previous threads and you will find one from about a year ago where I did screenshots, tests and updates on their safeguard monitoring and how cr#p it was and still is.

 

However, I have said it several times and will say it again for a disclaimer: I am talking safeguard monitoring and alerting on IPADS only, I have not tried the solution on Windows or Mac as my specific use case is IPADS and the solution probably works hell of a lot better on the other devices due to being able to install a software agent.

 

Again just for reference, iPads iPads iPads.

Edited November 8, 2024 by Tefters

[Tefters]

Well it's been a month and after numerous phone calls, conference calls and trials I am stuck between a rock and a hard place again trying to find an actual "working as advertised" solution.

 

My current supplier, Lightspeed, are threatening to pull the plug tomorrow unless we pay after promises back in August 2023 by the head of their EMEA division on a conference call with myself, our business manager along with the head of their UK tech support and the 3rd party seller we originally brought through saying that we did not have to pay until the solution is fixed along with constant communication, roadmaps and end user testing with ourselves of which we received 0 communication from them until a month ago demanding payment again.

 

At some point tomorrow I will do a full blown update on my journey over the last 4 weeks which will be rather long (warning: I won't be sugar coating my views!).

 

Anyone following or referring to this post in the future can hopefully head the warnings from my pain and detest for iPads and a full cloud based filtering and monitoring solution.

Edited December 12, 2024 by Tefters

[Brax]

Well it's been a month and after numerous phone calls, conference calls and trials I am stuck between a rock and a hard place again trying to find an actual "working as advertised" solution.

 

My current supplier, Lightspeed, are threatening to pull the plug tomorrow unless we pay after promises back in August 2023 by the head of their EMEA division on a conference call with myself, our business manager along with the head of their UK tech support and the 3rd party seller we originally brought through saying that we did not have to pay until the solution is fixed along with constant communication, roadmaps and end user testing with ourselves of which we received 0 communication from them until a month ago demanding payment again.

 

At some point tomorrow I will do a full blown update on my journey over the last 4 weeks which will be rather long (warning: I won't be sugar coating my views!).

 

Anyone following or referring to this post in the future can hopefully head the warnings from my pain and detest for iPads and a full cloud based filtering and monitoring solution.

I don't have to deal with them anymore thankfully but I'm looking forward to your side as iPads and filtering drove me mad!

[Tefters]

I have just spent all morning collecting information on a word document and passed to the currently supplier I am trialling, enjoy the read yourselves, this is now the second supplier I have experienced these sorts of issues with and my moral compass is shot having to reluctantly bend the knee and renew with Lightspeed and their faulty system.

 

What i can't understand is how I am discovering these things and no-one else is in testing?!?! I cannot be the first person using iPads and wanting them covered by a cloud only filtering and monitoring solution...

 

https://1drv.ms/w/c/697e035583340a21/Ee1Qv1pftN1NjVnQU6dcLosBvZRsqIISN4C4TXiYxOmFPg?e=itzXH8

@tom_newton Would love your view on this.

Edited December 13, 2024 by Tefters

[tom_newton]

Sorry - got caught up in the xmas break. Drop me an email - [email protected] and lets talk it through, and we can post our conclusions here?

[sigma]

I have a different filtering provider, but have some of the same issues.

 

Where knives/blades are used as part of the curriculum, (food tech, resistant materials, textiles, science), we wouldn't expect them to be blocked online where they directly relate to use in the curiculum, particularly food knives and craft knives. All actual commerce including all actual shopping is blocked.

 

Our issue is zombie, throwing and other now illegal knives where they turn up in image searches and are being sold online as weapons, and they walk straight through our filter so pupils can view them.

 

Our pupils would never see that list of sponsored products from your "where to get a knife" search because we ad-block as all sorts of unsuitable links turn up there.

[Tefters]

Sorry - got caught up in the xmas break. Drop me an email - [email protected] and lets talk it through, and we can post our conclusions here?

Thanks Tom.

 

The problem I have is time for testing and that this was a trial setup which clearly failed.

 

I raised a support ticket regarding everything mentioned in the document linked but have heard nothing back after 3 weeks, I appreciate it's been Christmas but to hear nothing back from support just adds fuel to fire in terms of me having to write off Smoothwall as a solution with lack of support also being a contributor as well.

 

I'm a little disappointed to be honest as from our previous chat in this thread you perfectly understood my needs and so did the pre-sales guy I spoke to on a Teams meeting but after implementing the solution as a trial it all fell apart very quickly and no-one wanted to reach out and help. Several emails to pre-sales and implementation engineer were ignored and I had to go through tech support which was awkward because I wasn't a customer so they didn't have any record of me being setup but managed to raise a ticket finally which then prompted the implementation engineer to finally respond but as mentioned has since gone quiet.

 

I don't have anymore time to invest at the moment and hopefully my trial will just stop and not auto-delete so will email you in a few weeks time so we can maybe find out what is going on as I will need a solution moving forward still as I am stuck on a broken solution at the moment and don't want to move to another broken solution!

[tom_newton]

Can you drop me a line with your details - that sounds like a serious failure on our part, and needs investigating.

[Joeloman]

Hi Tefters, I have looked through your test results.

 

I can't comment on the monitor solution, as it is not something we use.

But the filter is guaranteed to be the best on the Swedish market, as it can handle many different languages ​​(including Swedish), which is a big problem as we have many immigrants who always search in their native language to get past the filtering.

It is also common for students to use different translation services for entire websites, so they get past filters that don't look at the content.

Google has now stopped the big porn sites but not drugs etc.

 

Therefore, you should probably only look at web filters that look at the content in real time, as Smoothwall does.

 

I immediately found the error why your searches for knife were not blocked.

Smoothwall has a very good function where you enter several words that must be in the search for it to be blocked and that is what you have done as all the search words are on the same line...

 

So try doing a search with all the words, you should see that the search is blocked.

This is not entirely clear in the interface, as it only states "Required" in red, but they should have told you about that feature when they set it up.

 

I don't know if knives are a big problem in the UK, but it's probably difficult to block so that you don't overblock pages with knives, food and crafts.

 

Then it's an extremely much bigger problem in Swedish schools with various AI apps that make nudes from regular images, for example, this https://undress.appIt happens that nude images of teachers and students are shared between students.

Therefore, it is important to also look at the images themselves, which Smoothwall is already doing as a test in the USA.

 

I also know that Smoothwall is looking at whether to create a new category for this, today they are classified as porn.

 

The support usually works well, but unfortunately it happens that those who are not yet customers are missed.

My advice is to be on your customer contact to get a proper overview of what the system is capable of and how to handle the different settings.

Edited January 9, 2025 by Joeloman

[Tefters]

So this week I had a conference call and was asked to test again, some changes had been made and taken onboard from my initial testing before Christmas.

 

Well...

 

3 searches later and I was on a WIKIHOW guide on how to make a knife with pictures. *Facepalm*

 

Now again, this is with the weapons category blocked under core content. I also had 0 alerts from the monitoring/safeguarding system/team either on this.

 

At this point I have no idea what to say... Weapons are blocked but apparently a knife is not a weapon?!?! *insert crocodile dundee joke*

 

This is a double system failure, firstly I can access this content as a student through the web filtering and then secondly I got no alerting whatsoever from a monitoring/safeguarding stand point.

 

Who in their right mind from a safeguarding standpoint would deem this acceptable, I know full well my head of safeguarding in school would not!

 

I'll wait to see what the next round of excuses are but this is getting stupid now. Is there a systematic issue/failure by all top web filtering providers when it comes to a full cloud solution and iPads???

 

The part that worries me the most is how am I the first school to be highlighting these issues across multiple suppliers? What sort of internal testing is being performed? How many people are using these services in the same way and completely unaware of these massive pitfalls.

 

Lightspeed filters through an agent app that seems to work reasonably well but the monitoring/safeguarding is pretty non existent and can only be done on Google searches, any other search engine is open market.

 

Smoothwall has their own web browser app so I was more hopeful on them capturing everything typed but the filtering seems a joke around basic core categories like weapons and the alerting is just a 50/50 toss of the coin as to whether you get one or not.

 

I know we're dealing with iPads here but come on... Both suppliers advertised how they can manage IOS and provide all the same bells and whistles as per their desktop counterparts but basic testing is showing the complete opposite.

Edited February 8, 2025 by Tefters

[tom_newton]

It's my understanding that you hit a bit of an issue where we had recently updated the rules to mitigate an overblock, and this coincident with the slightly different context we get on ipad (we work with slightly less data on that platform) is at the root cause of the issue.

 

Right now I'm traveling between our UK and AU offices, so I've not got a full picture, but this is being taken very seriously and is in view of the most senior people at Qoria.

 

I'll keep a close eye on the root cause analysis.

[sigma]

So this week I had a conference call and was asked to test again, some changes had been made and taken onboard from my initial testing before Christmas.

 

Well...

 

At this point I have no idea what to say... Weapons are blocked but apparently a knife is not a weapon?!?! *insert crocodile dundee joke*

 

.

 

Ah but, I wouldn’t expect to see knife that would be used at table as cutlery classified as a weapon, nor a kitchen knife of the type you would expect to find in food tech, not a craft knife that might be found in art or resistant materials classed as a weapon.

 

I was surprised to see a picture of a naked Hagrid with a sorting hat over his manhood get through our filter though. (not Smoothwall or Lightspeed).