Slashdot Log In
A Myspace Lockdown - Is It Possible?
Posted by
Cliff
on Wed Feb 28, 2007 10:44 AM
from the separate-your-workers-from-distractions dept.
from the separate-your-workers-from-distractions dept.
Raxxon asks: "We (my business partner and I) were asked by a local company to help 'tighten up' their security. After looking at a few things we ran some options by the owner and he asked that we attempt to block access to MySpace. He cited reasons of wasted work time as well as some of the nightmare stories about spyware/viruses/etc. Work began and the more I dig into the subject the worse things look. You can block the 19 or 20 Class C Address Blocks that MySpace has, but then you get into problems of sites like "MySpace Bypass" and other such sites that allow you to bypass most of the filtering that's done. Other than becoming rather invasive (like installing Squid with customized screening setups) is there a way to effectively block MySpace from being accessed at a business? What about at home for those who would like to keep their kids off of it? If a dedicated web cache/proxy system is needed how do you prevent things like SSL enabled Proxy sites (denying MySpace but allowing any potentially 'legal' aspects)? In the end is it worth it compared to just adopting an Acceptable Use Policy that states that going to MySpace can lead to eventual dismissal from your job?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
The 2nd best way is random incomplete blocking... (Score:5, Insightful)
Nonetheless, the best solution that I came up with (I don't think I "invented" this, but I did come up with it after many days of contemplating) was to have a revolving DNS change for those 20 MySpace Class C addresses. We made it intermittent enough that the employees "thought" it was MySpace downtime, and eventually usage dropped significantly. Every 5-10 minutes a CRON job would add its own random address for one of the MySpace addresses, then 5 minutes later it cleared that and then did it to another address.
The only guy that I am aware of that noticed it is the guy who ran his own DNS on his workstation, but he was geeky enough to probably realize that it wasn't MySpace that wasn't resolving.
I still think that it is wiser to discuss WHY employees might be needing some downtime versus locking them out of applications. Happy employees are efficient, productive and fun to work with. I would never block my employees access to any sites (then again, I would never drug test, delve into their private lives, run a credit report, or any of the usual steps employers take).
Re:The 2nd best way is random incomplete blocking. (Score:5, Funny)
Parent
Re:The 2nd best way is random incomplete blocking. (Score:3, Funny)
Re:The 2nd best way is random incomplete blocking. (Score:4, Insightful)
Parent
Re:The 2nd best way is random incomplete blocking. (Score:4, Insightful)
Seriously, I have left so many jobs simply because I wasn't happy being treated like a child. Give me a job and I do it, to the best of my ability... don't concern yourself with what I do when I'm not working, and certainly don't tell me that I am expected to spend every minute during business hours working.
Parent
Re:The 2nd best way is random incomplete blocking. (Score:5, Funny)
Bill Hicks put it best:
-Why aren't you working?
-'Cuz there's nothing to do.
-Why won't you pretend to be working then?
-Why won't YOU pretend that I am working? You are paid more than me, you fantasize.
Parent
Re:The 2nd best way is random incomplete blocking. (Score:5, Funny)
I was in the US Air Force at the time... and sitting idle in our office was a sure way to be given some mundane task to perform... so one had to look busy, or be outside having a smoke break.
In my office, the average smoke break was somewhere near 1 hour as our job was hurry up and wait. (ground computer maintenance for an aircraft based radar platform called AWACS). We could see the planes land, and the crew head in for debrief, from the "smoke pit"... so we were always there when real work needed doing.
Parent
Limited Internet == Lobotomy (Score:3, Interesting)
Amen to your policy. I started out in print design, and got my current skills ((X)HTML, CSS, Javascript, PHP, MySQL, etc...) entirely through online tutorials and documentation. I write copy with the help of Reference.com, stop first at Wikipedia to learn the outline of any unfamiliar technology, and of course, keep up with tech news here. None of these sites were work-related when I worked in print, but they enabled me to move to web development.
And MySpace? I use it to keep up with old college friends.
The damage of content filtering (Score:5, Insightful)
I have no mod points, but I'm modding you up in spirit.
<soapbox>
I absolutely cannot stand it when employers filter content. The thing is, even if people are wasting too much time at work browsing MySpace (or the Internet in general), that is a management problem, not a technical one. If you take away their MySpace or whatever it is they're browsing, they're just going to move on and browse some other site. If you put a whitelist in place, they'll just find some other way to goof off. The problem isn't that the Internet is distracting, it's that the employee is easily distracted.
I work at a big company as a contractor. It just recently blocked access to the big Internet e-mail services (Gmail, Yahoo Mail, etc.) because it didn't like employees wasting time with their personal e-mail at work. Of course, being a contractor, it doesn't take into account that I use my personal e-mail to communicate with my contract agency about stuff that I'd rather not have stored on company e-mail servers. It's easy to say, "Well, you shouldn't use company resources for that type of stuff," but practically speaking, my ability to communicate effectively with my contract agency is essential to me doing a good job for them. It also totally ignores the fact that I keep personal stuff like vacations and such on my personal Gmail calendar to know when I should ask for time off, when my coworker's birthday is, and so on.
The company spends a fortune on content filtering. There's the hardware itself, the update service, the support contract, the personnel cost for the guy who maintains it, the internal support costs of handling trouble tickets related to it, the cost of Internet downtime due to it periodically failing, the cost of packaging the software end of it and deploying it to the workstations (so that you can't browse them at home on your laptop, of course!), and so on ad nauseum. Just as one example, some of our customers are casinos. So we can't just put a rule in that says, "block gambling sites," because our marketing and sales folks have to be able to access their sites. No, we have to have rules that say things like, "This group can access these sites, that group can access those sites, everyone else can't access any of the sites, ..."
Even in the extreme case of porn sites, the answer to controlling it is to make a company policy prohibiting browsing them, and if you catch someone doing it, fire them for it. If you try to block them all, you're just setting yourself up for someone saying something like, "Well, it wasn't blocked, so I thought it was okay to go there!" I've found that if you treat people like 12-year-olds, they tend to not disappoint you. When policies like this go into place, you're also going to have the contingent of people who deliberately goof off more as a form of passive-aggressive rebellion. It's just stupid, you're only causing more problems, and there's no need.
I know that some of you will probably reply, "But you have to filter content to avoid sexual harassment lawsuits!" No, you don't. As long as you make a company policy about it and you take the appropriate action when someone breaks that policy, you'll win any lawsuit that someone may file. The law does not require you to spend a fortune to be a babysitter, it only requires that you take reasonable action to prevent a hostile work environment. The reason we have content filtering in the first place is because managers, in general, are lazy and don't want to do it themselves. The people who would sue you for not content filtering will sue you anyway. The only important thing is whether or not you'll win. Besides, at my company, the cost of defending itself against such frivolous lawsuits is negligible compared to the cost of maintaining our content filtering services.
Content filtering is no substitute f
Parent
I work for a state government IT department (Score:3, Interesting)
I work for Child, Youth and Family Development. We oversee the foster programs, youth activities, and detention centers. Even with all the filtering, we are investigating several net abuse cases per week. We
Gosh, you sound angry. (Score:3, Interesting)
Re: (Score:3, Insightful)
There are folks who have a genuine problem with web porn. I have, unfortunately, had a hand in marching them out the door. Warnings after warnings don't work, and it turns into a giant game of he-said she-said. Monitoring software lets you arbitrate and maintain a healty work environment. Do I sit on logs and reign in evil-doers? No. HR needs to authorize me to gleen the logs.
Simply throwing your ass in the
Re:I work for a state government IT department (Score:4, Insightful)
For troublesome sites, filter, it makes sense, just don't get carried away with it.
Parent
Re:The 2nd best way is random incomplete blocking. (Score:5, Funny)
Parent
don't block the site... (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Porn filters (Score:2)
Re: (Score:2, Informative)
Until somebody there goofs and flags the map image server for mapquest as porn (we are fighting that one now)
Luckilly they do have a user submission system to reclassify those goofs.
I mean, like, duh. (Score:5, Funny)
Stop hiring teenagers?
Re: (Score:2)
Re: (Score:3, Insightful)
Not illegal at all.
Wanted: Senior widget designer. Minimum five years experience.
Wanted: Administrative assistant. Must be responsible, hard-working individual.
And so on. Yeah, technically you can't explicitly exclude teenagers, but you can set job requirements that effectively do so. :-)
Internet on an "as needed" basis... (Score:3, Interesting)
There were about 20 people in management type positions that had absolutely no blocks set on the websites that they could visit.
The rest of the employees had a whitelist of work related websites that they could access. Everything else was strictly verboten. No checking personal email, no checking the weather or news.
To me it seemed somewhat Draconian, but that was the policy in place.
God I'm glad I left that job.
Re: (Score:2)
I allowed access to equipment vendor sites (tek.com for example) and that was it. If you needed anything else go do it in your office, not my lab. To lock down a general office environment that much is going too far IMHO.
We use an automated log auditing tool. Even one or two porn hits won't cause issues (it happens by accident sometimes).
I clicked a link in google once (before firefox and d
Definition of Draconian (Score:2)
Re: (Score:2)
It says the code of laws, not the punishment for violating the laws. Seems like a strange distinction anyway. You don't think strict rules are characteristic of Draco?
Re:Definition of Draconian (Score:4, Informative)
draconian (dr-k'n-n, dr-) Pronunciation Key
adj. Exceedingly harsh; very severe: a draconian legal code; draconian budget cuts.
Words evolve. Deal with it.
Parent
Re: (Score:2, Informative)
One day she was called into her manager's office and fired due to her web usage. No warning, no verbal/written reprimand, ju
Re: (Score:2)
So if employees needed to download an OSS utility, or look up some technical assistance on usenet/forums, as part of their job, they basically had to drive home or borrow their boss's computer to get that information?
It seems like the company was classifying the internet as wholly negative, that random unknown parts of the internet never contain things that might be important to getting one's job done? Certainly the Internet has more distractions than help, but there's been enough times in the past year
Websense (Score:2, Informative)
Hosts File (Score:4, Interesting)
Waste of time.. (Score:2)
Not to mention you'll come out of it looking less like a triggerhappy censoring dictator of some (not-so-)long-gone communist or fascist state.
If you have to block, block all and
One way (Score:5, Informative)
I had to do this for a school. Basically, set up Squid to act transparently. Set up an acl like:
acl myspace dstdomain
acl work_hours MTWHF 09:00-12:00
acl work_hours MTWHF 13:00-17:00
http_access allow myspace !work_hours
http_access deny myspace
That would allow access during lunch and before and after work.
If you want to block against proxies, use SquidGuard plus some blacklists. The ones at urlblacklist [urlblacklist.org] are good, as is the isakurldb [gplindustries.com] list (it's based on dmoz). Another one is the one from shalla.de [shalla.de]. All have social networking categories as well as proxy sites, though shalla's proxy and spyware lists tend to overblock.
I'd recommend merging urlblacklist's lists with isakurldb, and also shalla (but remove yimg.com from the redirector list manually) for both proxy and social networking. Then use SquidGuard to restrict the access.
You already know the answer. (Score:3, Insightful)
Block the Class C (Score:4, Informative)
It's just a like a fence. (Score:5, Insightful)
There was a small wooden fence around an area containing the moat and some potential dangerous ruined stonework.
I said: "what is the point of that fence, it's tiny, I could climb over it easily? it really doesn't do anything to stop me ending up in the moat"
They said: "well, the thing with fences is that they're not there to stop you getting somewhere. They're there to make you KNOW that you're not supposed to go somewhere. If you just fell into the moat, the castle owners are in trouble. If you climb over a fence and fall in the moat, the castle owners can say, 'well, come on, he climbed over the fence that clearly marked that area off limits. You can hardly blame us, and he can hardly claim he didn't realise he wasn't supposed to be going into that area'."
Likewise with your problem.
Yes, technical measures can always be defeated by the determined myspacer, such as via a proxy. However, I would say some technical measures are worth considering hand-in-hand with the AUP, as a sort of 'fence'. If myspace is banned by the AUP, but not blocked, then everyone will go there, and when they do, they can claim they didn't realise it was against the AUP, or they clicked a link which took them to myspace without realising that's where the link led, "honestly"... etc, etc.
If myspace is blocked, on the other hand, then you force people to "climb over the fence". Yes, they can still get to it via a proxy - but the fact they've gone to it via a proxy means it is explicitly, unarguably obvious that they knew they weren't supposed to be going there, and deliberately went out of their way to get around the rules. This, imho, means you will be able to enforce the AUP more stringently.
Re: (Score:2, Informative)
(Althogh most restricitions are lifted outside of normal working hours, and at lunchtime.)
Automating invasiveness is not in itself invasive (Score:2)
Of course, there's the obvious solution of: give up, your goal is technically impossible.
Instead of Blocking the Bad, Allow the Good (Score:2, Insightful)
Instead of trying to keep up with every potential "myspace bypass" and blocking every site like it, just block all access to the internet by default, and then allow them out into only those few sites they actually need.
I can't imagine actually working at a company that did this, I treasure my ability to mindlessly surf fr
Don't actually block it (Score:2)
Just a thought... (Score:2)
If you wanna be really nasty... (Score:5, Funny)
Quick & dirty (Score:3, Informative)
I will point out that this was for a smallish company (25 people), not a school or anywhere else where the end-user can basically be assumed to be at least somewhat malicious. But, it does get the job done if you're in a hurry.
If you're blocking sites that eat time ... (Score:5, Insightful)
DNS blackhole (Score:2)
It was a dirty hack, and wouldn't be too hard for a technically-inclined user to work around, but they didn't need an airtight blockage. They just needed the misbehaving employees to know that management saw a problem, that the gentle measures taken before that had not produced the desired corrections, and that much blunter enforcement instruments were available.
It got the messa
Here's a crazy Idea: (Score:3, Informative)
As the old saying goes... (Score:3, Insightful)
Locks only keep honest people honest.
If you block MySpace succesfully, the people who visit MySpace during their work time will just find another way to waste time and expose the company's computers to spyware/etc. risks. It's a losing battle. Think of it as DRM for your employee's time.
Re: (Score:2)
I know of more people in R&D roles who waste "company time / resources" surfing slashdot, digg, youtube, etc. than in any other role.
On the flip side of that, I know of people in "receptionist only" roles that would benefit from websurfing to kill off the boredom of that position. These people are not permitted to leave the phone / desk [minor breaks to use the facilities, and a short lunch break], and many aren't permitted any other responsibilities that may take them away from the desk.
An
Re: (Score:2)
Re: (Score:2, Interesting)
Likewise, I would be suspicious of giving high sensitivity projects to employees to frequent lots of forum sites, as they might be more inclined to share things.
My, what an.. interesting point of view. So people who are more social are more likely to spill your secrets? The fact that someone likes to discuss things with people means that they are more likely to be telling everyone things you've asked them not to tell people?
Sorry, but I think that's absolute bunk. Knowing what to say and what not to