tom_newton

Interesting point... Dns servers are good because they're multicast, so unlikely to just become unreachable. It's false positives over false negatives really

It's likely they are doing selective MITM - only inspecting sites where it's "interesting" to MiTM (eg sites where you might post/get search terms, and herefore have useful alerting data). This can improve performance in web filtering, but of course doesnt make things much easier as a device with no cert soon wanders into difficulty on one of the "interesting" domains.

My preference is always Quad9s - I know they are decent folk, and it blackholes malware. A+.

I would not expect that to happen again - but if you never touch the publish button on cf no policy will push

Youve not got some folks without a cert using cloud filter have you? OR maybe there's an AV or something interfering? Be good to show that cert the user gets when it fails

I would concur with Joel - if you add cloud filter (no cost), alerts route through our email infrastructue. Alternatively a different SMTP provider like mailgun or Joel's suggestion might work out

Cloudflare Tunnel · Cloudflare Docs <-- depending what you were using Dnydns services for, this might be an answer

I just bubbled to the top of the Steam Machine waiting list. Better start thinking of some games then!

The posters here have given some good pointers. Agent based systems are only suitable for fully managed devices. Anyone telling you otherwise is leading you down the garden path. Smoothwall has agent based and proxy options. If you hear people saying proxies are dead technology, they're also poorly informed: outside of in-browser extensions and DNS filters, the vast majority of filtering (including windows, IOS, android agents) depends on a proxy somewhere. A proxy box at the edge of your network might be slightly less common than it was 5 years ago, but the technology just moved Happy to talk you through everything I know: reach out to your Smoothwall CSM and ask them to set up a call with me or one of the Technical Account Maangers.

Working on it - apple appears to have made life very difficult for all filter vendors with this. Are you using block-by-drop, or a redirect to a blockpage?

Can you give some concrete examples - with AI tools blocked, gemini searchers are too: 20260928-1012-40.4282808.mp4

Just played through "Nutmeg" a deckbuildery retro football manager game. Meh. Was alright. Nearly won the league with York, but the RNG has started to get on my wick, and it gets a bit repetitive

@Planehazza if theres anything you miss that's not MDMwise i'd be keen to hear it, we might be able to help

Very sad to hear of his passing - John and I had the occasional opposing view, but his work with LGfL pushed us all to do better.

Hmm, I wonder if we could run a different block.... there is, I think, still a block-by-drop which would present a different looking failure mode to IOS, but I suspect it wont help. Of course having the cert installed makes the block look successful: you get content from a domain you trust that is 200, and has size.