Strawdog

We're unable to log behaviour events when using the link on the register page to get to behaviour (blue silhouette with a green tick icon) - the majority of our staff are on Mac though so it could well be a MacOS related issue as Bromcom insist they can't replicate it... Although they also keep telling me to press F12 to view the console log despite me telling them multiple times we're a Mac school and have been the entire time we've been Bromcom customers (10 years). We see the issue across multiple devices (2012 MacBook Pros, M1 MacBook Airs, etc.), MacOS releases and in both Safari and Firefox (again tested in a variety of versions).

We've found a work around for behaviour but still have a ticket open with Bromcom about it (you can access it from some routes but not others), I've also whitelisted the following on our internet filter which has improved speeds for some users but it's still not as quick as it used or should be: - *.fontawesome.com *.walkme.com *.getbeamer.com code.highcharts.com cdn.mouseflow.com cdn.jsdelivr.net whatsnew.bromcomcloud.com cdnjs.cloudflare.com

Apparently Attendance is fixed now (they've closed our ticket anyway), now need to check if we can log behaviour events again as that was broken for us after the facelift. *nope, logging behaviour is still broken for us*

If you fancy jumping on a Teams call sometime next week I'd be happy to demo, would be nice to have a second pair of eyes on it as it feels a bit creaky to me and I'm tying myself in knots testing a million different variables (OS, VLAN, cert/no cert, wagent/no wagent, browser, user permissions, etc.). The main issues we're having is with non-Windows clients (so no wagent as the LA haven't made one available for anything apart from Windows) of which we have no shortage (iOS, MacOS, Android, Smart TVs, etc.).

Done some more testing and it appears that clients not only need the certificate but also need the Selective Decryption list applied to their group otherwise Safe Search can be toggled off in Bing. Also found blocking search engines (Bing, Yahoo, etc.) in Policy->Categories doesn't appear to work (with or without the certificate) unless you have the Selective Decryption list applied to the group in question, this might just be a delay with the policy application as Twitter, Facebook, etc. are blocked by Category and are inaccessible but I think it's deeper than that... Blocking search engines in the Group's Local List (URL/Keyword Local List), via their URL, is blocking them correctly so not sure why Category blocks for the search engines aren't working (changes to the Local List also update pretty quick on the device). Also discovered DuckDuckGo happily lets you toggle off Safe Search with or without the certificate and/or wagent which then allows access to a ton of porn, via an image search, unless you have the certificate and Selective Decryption list applied to the group the device sits in (which filters the search based on the keyword list so although it doesn't actually enforce Safe Search it does block the majority of illicit content). Upshot: - Make sure all your groups, whether they have the wagent or not (i.e. iOS/MacOS clients), have the Selective Decryption list applied if they have (or should have) the certificate on them. If they don't have the certificate on them (e.g. guest devices) block pretty much every single thing you can. Block Bing and DuckDuckGo for anyone without the certificate and wagent (e.g. guest devices) and consider blocking them for everyone.

Temperature changes, humidity, compaction, rodents, etc. are all external factors (i.e. wear and tear) - to me the term 'break down' means natural rot/perishing/degradation over time (e.g. sticky / brittle plastics) which yes is possible with cheap cables (especially if exposed to UV) but it's still far more likely to be caused by other factors.

Cat 5 doesn't really break down (it's a solid copper core in a PVC sheathe) - wear and tear (pins in sockets getting bent, cable getting crushed/crimped/worn, plugs coming loose, etc.) is the more likely cause. A cheap £10 network cable tester (e.g. http://www.amazon.co.uk/Keple-Ethernet-Connnector-Broadband-Connection/dp/B07M67QN75) will tell you if you have a pin out and a set of crimps will set you back another tenner (or grab a bundle - http://www.amazon.co.uk/Hiija-Through-Crimping-Connectors-Stripper/dp/B082XXJ6RF) replacing RJ45 plugs takes a few seconds after a bit of practice. A Fluke tester, whilst lovely kit, is overkill for most people's needs but you can pick up cheap alternatives that do most of the core stuff (e.g. http://www.amazon.co.uk/Multi-Functional-Network-Tester-Tracker-Flashing/dp/B08QCY1785)

All devices get the cert apart from guests (e.g. NHS nurses, guest speakers, etc.), which are segregated from the main network and have pretty much every potentially dodgy category blocked/shared lists applied, and yep we deploy the cert in the same way. Blocking Google for guests, despite no SSL inspection (due to no cert), is impractical but I could live with it as Safe Search is enforced whether they have the cert or not - I was under the impression Bing worked in the same way but apparently Bing requires the cert to enforce Safe Search and without you can toggle it to Off, that coupled with no keyword blocking (as no cert to see what's being searched for) means guests potentially have access to porn if Bing is not blocked altogether for them. Suspect yesterday was a NetSweeper wobble as I can't replicate the issue today but I swear I have witnesses and it has served to highlight this issue

Yep we block student USBs for the same reason but it's not a VPN/proxy (I replicated the issue on a fresh machine with both student and staff profiles yesterday - today it's now working as it should be...), it just appears that if the client isn't using the BTLS SSL certificate for Bing then you can toggle Safe Search Off and without the certificate you also have no visibility of the search query so it allow free reign to access lots of porn (no blocking based on search phrase as it can't decrypt it and no enforced Strict Safe Search).

We're on the LEA broadband bundle so I don't have firewall access (beyond individual client firewalls via GPO, etc.)

I could replicate it on a test machine though so not a filter bypass site - I was thinking it was probably the certificate missing on the clients as this would explain both being able to turn Safe Search off and the search queries not being logged but I just checked the report again and my test client has some entries for some earlier Google search queries so the certificate must have been present. I suspect that report (Full Search Query Report(v1)) probably just doesn't record Bing Image searches - whether they're still recorded elsewhere or not I'll find out when I get my weekly suspicious search report and it's filled with me searching for 'porn'

After some more testing it appears Bing Safe Search is reliant upon it using the BTLS certificate, Google isn't - clients not using the BTLS certificate to access Bing can toggle Safe Search to Off and it stays Off, clients using the certificate can still toggle it to Off but it reverts back to Strict when you go back in (the Settings menu shows it as Off but it's not, the initial drop down menu just doesn't refresh the entry when it reverts back to Strict). Good to know, now just need to block all clients (e.g. guests) who don't have the BTLS certificate installed from accessing Bing which is easy enough. Still don't know why I was seeing different behaviour yesterday - both the affected clients (student machine and my test machine) should have definitely had the certificate (it's deployed via GPO and both machines are regularly used) but I didn't check it at the time so can't say for definite...

Using Firefox and Safari, see edited post above re. cert. Test machine is now blocking and enforcing Safe Search correctly on Bing :\ There's a machine a student was using yesterday that they had disabled Safe Search and accessed porn on - will jump on a remote session and see if that is still allowing it.

Running the builtin Full Search Query Report(v1) report only shows the search phrase, not the full URL but you can see entries for Google, Google Image search and Bing but I don't see any entries for the test Bing Image searches I did Seeing our (BTLS) SSL certificate on Google/Google Image and Bing/Bing Image. ....and just to make me spend hours chasing my own tail I'm now seeing the NetSweeper block page when searching for 'porn' in Bing Images despite it happily serving up all the pics yesterday on multiple machines/OS... I've not made any changes to policies, etc. beyond blocking Bing yesterday and then enabling it again this morning to do more testing.

Not made any change to its category at this end but a colleague in another local school is seeing different behaviour to so it's likely a setting somewhere in NetSweeper that's allowing it through. We see all search queries for Google (incl. image search) and the Bing homepage, just not seeing Bing image searches recorded.

As an added bonus it also appears as though searches performed within Bing Image search aren't being recorded/flagged in the 'search queries' report (searches performed on the main Bing homepage are recorded but not the image search page).

Just a heads up for other potentially affected schools - our (Lancs) Netsweeper isn't currently enforcing safe search (Strict) on Bing, it's defaulting to Moderate and students can toggle it to Off allowing unrestricted access to lots of hardcore porn. You can create a rule/configure your network to map Bing to strict.bing.com to enforce safe search (https://support.microsoft.com/en-au/topic/block-adult-content-with-safesearch-946059ed-992b-46a0-944a-28e8fb8f1814) but Netsweeper should be doing this automatically and frankly the easier option is to just block Bing across the board as I remember having exactly the same problem with Lightspeed back in the day.

BTLS pointed me at the following video which may help some - https://education.btlancashire.co.uk/videos/2020-02-11%2021-10-39.mp4

Now the first week madness has (slightly) subsided how do you go about whitelisting individual Youtube videos? Netsweeper gives me a bunch of automated suggestions for how the URL should be formatted when I try adding them to my 'allowed' list but it doesn't appear to matter how I format it the videos remain inaccessible with a warning about it being restricted and the suggestion signing into a G Suite account might help (it doesn't)... On a device with our 'allow all' policy (no categories, except for the locked ones, filtered) the videos play fine, even when not signed into a Google account, but obviously this isn't suitable for general staff/student use and we wish to continue filtering out YT flagged mature content and decrypting YT searches for the majority of users/devices. Couple of example videos - & https://www.youtube.com/watch?v=GyVD8V0016w

Time to resurrect this thread - anyone else got problems with YouTube being overly filtered again? Currently seeing pretty much everything to do with war or Nazis blocked which is completely scuppering our history teachers :\ Their machines have the BTLS certificate installed and this issue was previously resolved, just wondering if BTLS have reverted back to a more restrictive YouTube filter again... Example -

@BroganOs - Did you get a price? Just looking at this myself as I want to use conditional access to restrict China, Vietnam, India, etc. signing in to our accounts as we appear to have a problem with staff getting their accounts compromised ("How did that happen? Well I haven't given my password to anyone"...) and I'm sick of having to do ICO declarations... :x

It's that time of year, I'm getting blagged for access to it too. I've had a ticket in with BTLS about it for a few days but no answer yet - I've allowed access at Category and Local List level (incl. all the domains from this list - https://openconnect.netflix.com/mobiledeliverydomains.txt) but I still just get the 'Netflix Site Error' page when trying to log in. As PM1TF0rward says if you're already logged in it works fine (you can temporarily tether to a phone, sign in and then connect back to the school network if you need urgent access), it's just the sign in that is goosed. The iOS app also works fine on iPads, AppleTVs, etc. I tried contacting Netsweeper directly about it to see if it was a known issue but they've said it isn't and I need to talk to BTLS in the first instance for troubleshooting. I don't see any Denied entries in Request Log Files when trying to access it and I've tried it under OS:X, MacOS, Windows 7, Windows 10 and in Safari, Firefox and IE (on machines/groups both with and without the Wagent / certificate / SSL decryption) but they all do the same thing. I'm presuming it's something to do with Netflix's geo identification not playing nicely with Netsweeper.

Just to resurrect this thread, I'd recommend anyone using the 'Selective Decryption' Shared List checks whether Facebook is now accessible for anyone with that list assigned to them :/ After chasing my tail for a few weeks as to why Facebook was now accessible, despite being blocked at Category level, it appears the culprit is this shared list (I was under the impression this list solely contained financial and medical websites) as it contains allow entries for Facebook (the block/allow hierarchy, from top to bottom, is Local List->Shared List->Category).

Just found another blocked YouTube video/stream - The Guardian News live Parliament stream.... Obviously not suitable for viewing by minors :\

Hi Charlie, If anything the filtering of YouTube content now appears to be more restrictive than it was... Couple of examples: - Our RS department wants to show this - but it's currently blocked, it's a 1979 film about the life of Jesus that is rated G (https://www.imdb.com/title/tt0079368). Being logged in with an age verified YouTube account makes no difference, the video remains inaccessible. This is is a 4 minute clip from the film Pearl Harbour (PG-13) that our English department want to use, this is also blocked -