dhicks

Ah, good to know, thankyou. Might it actually work with just the .Net runtime, then? I've already got something else (Pinta, a Paint.Net clone) working with .Net. I'm building a remote desktop solution, intended as a software development platform but I realise it could be handy for a number of other things, and something like Exam Pad+ running in a self-contained (and limited) environment might be handy.

Can the executable run on Linux using Wine, would you know?

As discussed (at some length) over in this thread: I've written a client that can run on Windows and MacOS (and Linux) to inform the Smoothwall server of the machine's current username / IP address. It can report to the Smoothwall server using RADIUS or (as we found that didn't work for some reason) Smoothwall's own iDex. We have this running on our MacOS machines using the Moysle MDM set to run in a startup script where the Moysle environment provides the username to the client, which then informs the Smoothwall server. Should work for all browsers (indeed, all traffic from a device), although we've only tested with Chrome as that is what we have set up.

As suggested above, you could probably simply purchase the .co.uk / .com / .online / etc version of your domain name from Cloudflare, that might be the cheapest option. We've used Cloudflare's zero-trust tunnels for several years now to host various on-site applications, and found them to be reliable and very good value for money (free!). You can secure endpoints using login-with-Google/Microsoft (OAuth), which again is still free for under 50 users. For tunneling alternatives, the two I've used in the past are ngrok and Tailscale, a quick Google for "Tailscale alternatives" in particular brings up a good selection. The system I'm developing with at the moment is Pangolin, which can handle both the tunneling and user login, and (the self-hosted version of) which I find well designed and capable.

Update: yes, works nicely - turns out our teacher Chromebooks can handle two external monitors, making for a nice three-display setup (one laptop display, two monitors) if wanted. Worked pretty much plug-and-play, with ChromeOS finding the additional screens with no problem.

I just got it working the other day on our pupil desktop development environment, but I haven't tried using it for anything yet so I probably need to add more plugins and so on, so this thread is very handy. It turns out VS Code is an Electron application, so based on Chromium, so to get it running inside our Docker container desktop environment I had to add the "--no-sandbox" option

Thankyou. Our Macs (a suite of all-in-one iMacs, plus a Macbook used by the marketing department) are managed using Moysle MDM, which gives us the ability to run various startup / login / logout scripts. I think Action1 (which we use for our Windows machines) does now support MacOS, so we could use that as well / instead. We currently have a similar clear-the-profiles script running daily, which clears out the user profiles and stops the drives filling up. The problem with that is that the next time the user logs in, they are effectively logging in to the device for the first time and have to go through a bunch of steps to log in to Chrome / Google Drive Client, etc. It would be okay (if still fiddly) if they just had to do the whole login-and-set-up process once when assigned a device, but currently they wind up doing it each time (or, more likely, not bothering). Probably the solution needed is to modify the clear-the-profiles process to clear just the disk-usage-heavy parts of the profile (probably some cache directories somewhere) and leave the user option settings intact if possible. I guess in answer to the original question: I would guess the new Macbook Neo would be quite a nice device in a managed one-to-one setup for the average GCSE / A-level pupil, but we are currently finding MacOS clunky to manage is a shared user setup (better solutions than ours could be available, though). I would also guess the Neo might be a bit less robust than a tablet like the iPad, just because it has more moving hinges / buttons to get damaged, so I'm guessing not ideal as a shared device lower down the school, either.

Users log in using login-with-Google (OAuth) via Moysle's system ("Moysleauth", I think). The login process doesn't seem to pass browser cookies for Google authentication through to Chrome, so once a user has logged in to a machine they then have to log in to Chrome again separately. Same goes for the Google Drive client, so when a user first logs on to a new workstation there's several minutes of getting logged in / set up to do, which of course most people simply try and skip. At the moment we have a script running to clear out user profiles as the harddrive gets too full otherwise, so pretty much every user logon is like a new logon. I'm hopefully spending some time tomorrow figuring out how to fix this if we can.

We have a suite of iMacs, all with wired network connections (so not quite what you're asking), that are shared user devices, manged with Moysle MDM. We currently have issues with user profiles taking up disk space - with multiple users and multiple user profiles, the disk fills up very quickly. As managed single-user devices, assigned to individual pupils (GCSE / A-level maybe), I would imagine they should work nicely.

Ah ha - we (home, not work) were just thinking about getting a new laptop for lighting / sound purposes (as well as general use), and this looks like it should do very nicely, so I've ordered one for pickup at the Apple store next Wednesday.

I've not come accross any pupil resources that require a VPN to access, i.e. coming from the school to an outside, external resource. We do offer remote desktop access for pupils and staff, authenticated with their school Google accounts which should satisfy the age-restriction part of things ("this is a pupil account, filter appropriatly"). Filtering is applied at the school side of the connection, so they can access exactly the resources they would be able to from a normal classroom device. Our pupils do travel quite widely (something we noticed in particular over Covid), so in theory a pupil could use our remote desktop to access a resource banned in the country they are in but allowed here, although I don't think I've seen any practical examples of that.

Ah, good idea. We bought a USB-C "docking hub" dongle capable (hopefully) of running two external HDMI-connected monitors (in addition to the built-in Chromebook's monitor, I think, so three screens in total) for the setup I'm looking at on Friday. I was surprised it was only £30 or so from Amazon - I haven't tried it out yet, but hopefully it works okay.

Thankyou for the link - looks like they have a Community Edition, and they have a core "AuthWebserver" authentication plugin that looks like it should enable it to run behind Pangolin for authentication.

Our pupils all use Chromebooks, and our staff are each issued a (larger, more adult-sized) Chromebook which they increasingly tend to do most of their work on, but most of our current front-of-classroom devices are still Windows. A couple do plug their Chromeboosk in to larger displays, which seems to work fine. I didn't pay much attention myself, but I seem to remember the multiple-displays setup dialog in ChromeOS being very similar to the Windows one, where you could drag the displays around to change how they were arranged. I've got a dual-screen setup to sort out on (I think) Friday, I'll try and have a tinker then and see what it'll allow me to do.

I'm currently building a desktop environment for our pupils to be able to use for development, I was planning to probably have separate shortcut icons for "IDLE", maybe "Python" (the interactive command prompt) and plain, standard "terminal" (Bash). This is on Debian running XFCE4, so the shortcuts will be on a panel, a MacOS-style "dock" at the bottom of the desktop, so there might be limited room for icons by the time I've added everything else I can thing of (Chrome, Inkscape, Pinta, probably VS Code, etc).

Okay, so we have two separate problems: - What do we recommend our parents do by way of filtering at home: looks like the answer is either "make sure your child is logged in to a Chromebook with their school account" (which needs supervision from the parent, but should be do-able for younger children) or "Use Qustodio", which is designed (and, hopefully, has suitable support) for home users. - We have (Windows and MacOS) school-managed devices where the Smoothwall browser extension is not working properly because the Smoothwall client-side application isn't reporting the correct username to the Smoothwall browser extension. We are currently instead using our own client-side utility that reports the correct username to the on-site Smoothwall gateway server via iDex (would have been RADIUS but that seems to not work properly either), with filtering then done by the gateway. However, now you seem to be saying there might be some way of forcing the Smoothwall browser extension to pick up the username from the browser. Can you explain this in more detail, please? Has anyone at Smoothwall managed to get around to having a look at getting the Smoothwall Windows client to be able to report the username correctly if using a local / GCPW / pGina account (and ideally for MacOS, although I do appreciate that's a whole different architecture and set of problems to solve)? I don't know how your software is developed, but it would seem to be a relatively minor fix (just add an append-this-domain-name setting to the client, probably just a value picked up from the Windows registry).

Ah, that makes sense - we can, hopefully, point the parents that way.

Hello All, We have the Smoothwall Cloud Filter (v3.2.3) browser extension force-installed accross our Google Workspace (ChromeOS) devices and Windows Chrome browsers. When a pupil logs in to Chrome browser at home with their school Google and turns on sync, the extension gets installed in the browser, but doesn't seem to be able to filter anything. I'm guessing this is the same / similar problem we've been having with using GCPW / pGina on our in-school devices - if we install the Windows Smoothwall client it sees the logged-in account as a "local" account, it doesn't report the full [email protected] account to the browser. Is this something that is fixable / being worked on? Is there an option for home users (parents) to be able to use the school's filtering for their child at home? Note: filtering on ChromeOS devices, school-managed ones or otherwise, seems to be working fine (as long as a pupil is logged in with their school account their school setting apply), this is a specific Windows (and, I guess, MacOS) issue.

As far as I could figure out, you just need "UserName" and "FramedIPAddress", as defined in RFC2865. Some example code that might come in handy: https://github.com/dhicks6345789/radius-user-client/blob/main/client.go The above is for a client application to pick up the username from the local machine and send it to the Smoothwall server. We seemed to be able to get the client sending user details via RADIUS, but for some reason the Smoothwall server would seem to treat each new RADIUS message as needing to expire / log out all other RADIUS-athenticated users - if you checked on the "User Activity" screen you could see users listed, but only one at a time could be live. We never did get to the bottom of what the issue was.

I live in London, which of course is cheating 🙂. The problem with the Edinburgh Festival is that it's now got so big it tends to suck all the available acts in for the whole of August, and the costs (venue hire, accommodation, promotion) of putting on a show have grown so that it's difficult for newer acts to make money - people need to be able to make enough money to live on. The Camden Festival in Camden (North London) is on at the same time of year (August), and seems to have grown into the alternative festival for people in London who can't afford the time / money to go up to Edinburgh. Nearer to me (South London) there used to be the Vaults Festival, on at this time of year in the arches under Waterloo Station, that seems to have got moved on due to redevelopment of the area. Even nearer to me (Balham), The Bedford, a well-known comedy venue, has a festival this year, which looks interesting. I'll hopefully be going to see (some of) the London 50-hour Improvathon this year at the Pleasance Theater near Kings Cross - they run a venue at Edinburgh each year as well, so this is a good way of seeing some performers outside of Edinburgh.

If this is for your school building / area, if you have decent WiFi coverage throughout could you use a push-to-talk-over-WiFi solution? That should take care of your network security / encryption, and should give you network-manageable devices.

How are the GSuite apps "built in"? Is there an included OPS-slot module of some sort, possibly running Android? I think that's the configuration we've tended to see on newer SMARTBoards, with a non-removable OPS module as well as a second free OPS slot for our own module to go in if we wanted. As @DrBeaker points out above, those built-in modules can be difficult to manage / update. You could possibly provide your own OPS module per screen, configured however you like - if you wanted to keep the just-switch-on-and-use style of use, maybe a simple kiosk Linux setup that just loads up Chromium in incognito mode?

If the screens themselves are okay you could just replace the OPS slot PC. VeryPC do a good selection (or, at least, did a couple of years ago when we last looked). For a wireless keyboard with a combined trackpad, we find the (£30-ish) Logitech K400 is pretty reliable.

If you want to be able to run servers / virtual machines / etc off site ("cloud" based or simply on a server in a datacentre somewhere) you could look at one of the various tunneling services available that give you a secure connection between your internal network and a point somewhere outside. We've got on very well with using Cloudflare's tunneling service over the past few years, and at the kind of usage level we're at it's free. You would need a small internal device of some sort to act as the terminating point for the tunnel, but any basic mini PC these days should be able to handle that. If you want something you can self-host and have more control over, then we're also now looking at Pangolin.

A device that will no longer receive OS updates gets taken off our managed domain. For us this mostly means Chromebooks or MacOS machines with a well-defined support cutoff date. Any devices too old to be supported by their original OS we'll try ChromeOS Flex on (that doesn't work for Chromebooks, obviously). We've had issues with ChromeOS Flex issues on our staffroom Mini PCs (they all just stopped booting after a particular update) and on older iMacs (no support for the wireless hardware), so do check ChromeOS Flex does actually work as expected on your particular hardware before you plan too far ahead.