IrritableTech

The same story has been reported in the Evening Post - Leeds pupils look at adult sites on school PCs - Yorkshire Evening Post It's extremely disappointing journalism. The 'research' has been extended to suggest that the local area has an issue, without any facts about where the 'survey' was taken. When you find the article written by the marketing department of the private company who conducted the research the story doesn't get much better... Third of schools struggling with tech | Daisy Group PLC A provider of IT equipment and services says that schools aren't getting the best out of their IT equipment and services. Guess who thinks they can do better? Have you seen the reports definitions? Says it all really.

If devices are configured to use a proxy they expect that the certificate from the site will be incorrect and therefore don't nag the user - effectively there is a known MitM. If iOS, Android and Windows Phone OS's fully supported wpad.dat then that would be the easiest way round the issue.

Schools (and providers) can still force safe search using the other google DNS trick (assuming they don't pull that)- some may feel that is enough. The difference comes with how your filter can log or manipulate searches made through google. Without a suitable certificated HTTPS inspection either devices will warn users, or filters will only see that a user visited google but not what they did once they got there. I completely see your point with a webpage redirection, perhaps you could implement this for a week, then assume most have the certificate and remove again? You'd need to make it available though somewhere for new or wiped devices. Or wait until users complain about the pop up security warning, then tell them how to fix the problem? I can't see an easy answer as yet. It's worth remembering that this is an issue for every single https page. So if you allow users to access twitter for example, the same applies. If you want to see which twitter user a device is trying to access, you'll need a certificate to stop the security risk warning.

I've been thinking about the implications of this change myself. Prompted quite a response on twitter yesterday morning... Lightspeed and Smoothwall have both offered suggestions, but as you highlight it's not straight forward for BYOD. Update on Google Encrypted Search | Lightspeed Systems Community Site Important Information for Customers Filtering Google Searches It's perhaps even more difficult because we don't know at what point in December the change will occur. Could you redirect your BYOD users to a webpage which offers the certificate for download? [edit] Just to clarify - Google searches have defaulted to HTTPS for a while now, they are however removing the option to force none HTTPS searches using the nosslsearch.google.com DNS trick).

Yeah - if you want to pay up and go ad free, you'll need to be signed into google 24/7 on every device...

I've not had any further success with Youtube for schools signup sadly. Looking at the google forums it seems many people are having the same issue - I hope it isn't a sign that the YfS service may be cancelled by google.

Google are signed up to Safe Harbor. They also now encrypt traffic and data held on their servers. Google along with Microsoft recently completed the self certification process as outlined by the DfE here - https://www.gov.uk/government/publications/cloud-software-services-and-the-data-protection-act.

I can see the product creating a adsl/vdsl equipped router in the future, but I suspect if the project is successful their ultimate goal is to talk the large ISPs into incorporating the technology in their standard router.

If you reduce the power down does it improve the situation?

That's poor - I signed up for a code ages ago which I have working, but it is based on my individual google apps account. I signed up the other day for one on a generic account (as google suggest) and I'm still waiting. Have identified an issue though that you need a channel name before you can use the service, and the channel name needs google+. Waiting for google+ permissions to propagate onto the generic account to see if that helps speed up the sign up process.

I've read that the browsing history can be accessed from the GApps admin area, is this true / do you use it, and is it accurate?

Some light reading... Information and Advice on Taking Photos in Schools - ICO Can I Send Personal Data Overseas? | ICO http://ico.org.uk/for_organisations/data_protection/topic_guides/online/~/media/documents/library/Data_Protection/Practical_application/cloud_computing_guidance_for_organisations.ashx https://www.gov.uk/government/publications/cloud-software-services-and-the-data-protection-act https://drive.google.com/a/google.com/folderview?id=0B4froD7RGVqtaFlKc3VnTHF0THc&usp=sharing# The short answer is yes - you are allowed to do this as long as you've completed a suitable risk assessment and that your data subjects are informed, but don't take my word for it - Your school needs to do the research so you are happy you are compliant. Don't forget you will need to ensure your ICO register entry includes statements to suggest information you may transfer information over seas but this will be done in accordance of the DPA. Information is now transmitted to and stored encrypted on googles servers. Although there is a fair bit of mistrust around the company, they have done almost everything possible to ensure data is safe.

Got a config backup you could look at restoring before getting the step ladder out?

Still time... http://www.schoolsbroadband.co.uk/the-schools-broadband-roadshow-is-coming They've been publicising it on their website, Twitter...

Is your servers time correct? Clutching at straws possibly...

They do run training sessions around the country every so often. I think I'm right in saying there's been some this week in Northamptonshire? Lightspeed is fairly straight forward - and there's some useful videos on their site. Fortinet is more complicated but again, there's quite a bit of info out there.

I think all these apps are probably using the same technologies, possibly not the same ports though. I'm a Three customer and did spend half an hour trying to research and configure the Three Intouch app. Three claim it uses ports 5060 & 5061 but opening those alone (both UDP & TCP because three couldn't confirm) didn't solve the issue. It's not exactly a high priority job though, so I haven't gone back to it as yet.

I think the eSafety policy and AUP can be one and the same. I think policies have to work for the individuals they are there to guide and protect and therefore need to be short and sweet. It's unreasonable to expect a year 7 to digest too much information in their first week. One of my favourite sample eSafety policies is written by @esafetyadviser - Esafety Adviser – Free e-Safety Resources

Our fibre circuit is fine - do you know who provides yours? I find speedtests fairly useless generally but yours does seem very very low. A few of our primaries are struggling today - but I think there is a desire at Schools Broadband to move all customers onto their own network eventually and remove third party ADSL & FTTC providers.

The issue as I understand it depends on which filtering technology you are using, and in some cases how you are implementing it. It's not impossible, but depends on what technology you're using to ensure the desired effect. @tmoon-mint you haven't explained which filtering technology you use, but let me try and explain; Many filters struggle with https sites because the traffic is encrypted between the site, and the end user. If you attempt to inspect that traffic your browser will detect a Man in the Middle attack - quite rightly too. The browsers have been designed to protect their users data. Products which don't inspect the traffic only get to see the base URL (in this case https://sites.google.com) and the certificate. Everything after that is encrypted. Products which do inspect traffic tend to be proxy servers. The browser is configured to use a proxy, so it expects that the data will have been seen or tampered with by a third party. Products like Smoothwall can be implemented in various different ways - as a proxy (either transparent or not) it can inspect the traffic and filter these unhelpful sites out - but it isn't always that straight forward. Where as products like Lightspeed use Layer 2 to categorise traffic by default - to complete this deeper inspection you have to use its proxy functionality. Impero (not a true filter I wouldn't have said, but includes some filtering options) is installed on the end user machine and therefore works differently again. The people who create these sites do so on google sites because it's free and it's easy, but perhaps most importantly because they understand that there are also some very useful google sites for education, and it's a good tool to allow pupils to create something public and therefore it is usually unblocked in school. The same issue effects all https sites. Google, twitter, facebook etc. The industry is moving to secure sites so end users feel secure, but it is complicating filtering for those of us with a safeguarding role.

That's odd. Never seen this on a newly created account before. Have you spoken with google? There helpline is pretty good.

You may have already seen this, but the Department for Education have issued this document around the use of cloud services in schools and the Data Protection Act. It also includes links to the Google and Microsoft's self-certification checklist and statements allowing schools to make a fully informed decision over the use and security of data within each of the respective cloud services. http://irte.eu/pQ (pdf)

Not unless you are using its captive portal. The APs hold all the other settings locally. [edit] Oh and usage stats need the controller running too.

I've moved controller (on a small install) without any issue at home from a windows machines to a raspberry pi. Just back up from one and restore to another - the controller informs the APs of the change (I think they go through a reprovisioning state [as unifi does every time you change something major]) and then everything was fine. To answer the original post, Unifi is no frills as stated. If you are looking at BYOD then ruckus comes with some clever solutions out of the box. Unifi can emulate some of it, but only when hooked up to a Radius/NPS server really.

Join.me is quick and easy for a one off.