Sysadmin given Licence To Perve shows why you always get it in writing Welcome again to On-Call, our Friday fun in which readers send in their stories of being asked to do odd things around the office. This week, reader “Logan” who once worked for an outsourcer shared the story of a colleague tasked with checking a client's smut filter was in proper working order. “The job was to upgrade the …
Decent filters have policies for different users. For actual genuine reasons we have an "Allow Porn" policy. One of the tests I am sometimes required to carry out is that the policies are being correctly applied. This usually involves going to a site, seeing that I can gain access, changing my policy and trying to access it again.
In my case I usually use something innocuous like an online gaming site (unless testing the Allow Porn, obv.). If this was just about smut filtering, well, there's only one way to test that. Unless the software provider had test URLs, that is.
Detection and alerting is feasible. An Internet connection with an absolute smut block is impossible, unless Far Eastern computer appliance vendors have finally stopped displaying their electronic delights by having them cuddled by young ladies in swimsuits... maybe that doesn't sound like porn to you, but back in the day it was something to... notice in the classified advertising in dear old "Personal Computer World". There must be middle aged ladies now who still have indentations in the shape of the BNC port or the Dvorak keyboard.
I think also that warning the browser before letting them see anything that might be inappropriate is simply fair, and, even better, applying a browse time quota to ALL internet access, not only the fun stuff. Most people don't need more than a limited time for work-related browsing, and it will be humiliating and worse to use it all up even on adorable kitten videos and then be not able actually to work. I wonder if any office has tried it that way?
in the managers office or a server room or done this testing out of normal business hours?
Even with permission it sounds like a recipe for disaster as it is inevitable people will come to see regardless of their opinion on what is made available for viewing.
I can't immediately think of a better way of testing a filter though... but I can't help thinking that the test plan document listing all the websites, searches, and language filters could provide entertaining (and possibly educational) reading...
"I can't help thinking that the test plan document listing all the websites, searches, and language filters could provide entertaining (and possibly educational) reading..."
Back in the early '70s, Massachusetts and the city of Boston were trying to shut down Boston's "Combat Zone" adult entertainment district. Part of that task was proving that various shops were, in fact, selling obscene materials to the public. For any trial, the courts have to post a public notice announcing that on such-and-such a date, in such-and-such a court, so-and-so will be tried for this-and-that and telling anyone who might have an interest in such a legal action to contact the court or appear at the time and place specified. I happened to be bored and reading the classified ads in the Boston Globe and saw -- to paraphrase Tom Lehrer -- the juiciest, spiciest, raciest legal notice that it has ever been my pleasure to read. Because, you see, in order to prove that the vendor was selling obscene materials, they had to list -- without elisions of any sort -- the TITLES of every book, magazine, 8mm loop, etc., that they were going to present as evidence. These ads are always in something like 6 or 7 point type and my recollection is that this particular ad had to be four column-inches long, at least! I don't know who submitted that legal notice or who composed the type for it, but they did me a POWER of good, I can tell you that!
This is the primary reason that I never delete anything from my mailbox.
Keep, store, archive, backup. Because years later you can pull out the email with exactly who "made that stupid decision" written quite clearly and verifiable in court, if necessary.
I just pulled out an email that proves that an order from years ago was never actually executed, and am waiting for someone to discover that they are going to have to pay for that AND the project they want to do because the prep-work was never actually ordered.
Yup, while at a large telecoms firm, I kept emails archived well away from Outlook.
I had a few run-ins with middle managent sending emails then saying or doing the opposite.
Heated discussions led to them going 'Oh, yeah?' but wilting when I said I kept and archived off-server anything I considered to be relevant.
eg 'can you help out with such and such a team who are overrun with work at the moment?'
Then I get up to Manchester and the level one manager says 'Ah, our secondment'.
Back in London I raised this and was shouted down with threats of 'disciplinary' until I unfolded a printout of his original email.
Not just email; I had the Child Support Agency come after me - 16 YEARS after I beat them in court; unluckily for them, I had kept all the paperwork, and as soon as I started quoting reference numbers at them, they stopped trying to steal my wages.
BTW, this salary grab was covert, they tried it without bothering to contact me first; if my boss hadnt been a family member.......
It is becoming ever more apparent that the level of comprehension amongst readers of El Reg is decreasing at an alarming rate. I can only think that the inability to not take literally what is written is due to an increase in readers from the left side of the pond. You know, those who are not familiar with the subtleties of the English language. Either that or a home grown generation of numpties who wouldn't be able to get pass in a pre-2000 English O-Level exam.
'Do managers yell at people?..'
Oh yes, and that's usually the incident which sets me into immediate 'itchy feet' mode even if I'm not the target of the outbursts.
It's usually the sign that a grade A inadequate clueless substance abusing twat of a jumped up wee Hitleresque martinet who has managed to get promoted to a position beyond his abilities via nepotistic means..that or the first signs of incipient mental health issues..or the signs of a pre-existing mental health problem..or both..(being on medications where the contra-indications include mood swings helps the fun along as well).
'...Go into rants in the middle of the office with raised voice?..'
Oh yes indeedy!, and in front of prospective clients as well (no surprise, we didn't get that contract)
'...I can't remember it happening, except in sit-coms and some poor Hollywood output.'
There's a bit of a feedback loop there, scriptwriters pick up on anecdotes and exaggerate, your typical arsehole manager picks up on the exaggerated behaviour as portrayed and thinks 'yes, that's me! and further exaggerates it in an effort to 'be more than he can be', this then feeds back to scriptwriters..Lather, rinse, repeat..
Had it happen to me, he wandered into the control room and found me reading a newspaper; so launched straight into a rant in front of all the control room staff.
I patiently let him finished, then informed him my shift didnt start for another 35 minutes, but I had left home an hour early to make sure I arrived on time, as I the snow was pretty deep and it was a 15 mile drive through the hills to reach the place..
Once a month we had to change the outbound rules in our hone system to allow calls to certain "Premium Rate" phone numbers for a member of staff. Part of his job, you see, was checking that they played the correct regulatory message about cost of call at the start, before the heavy breathing started. We were always damn sure to get the request in an email first, every time.
Whats with the recent Porn Friday feature ?
Is there no real tech news any more ?
You don't need to use dodgy sites to test filters content filters work, much in the same way you don't use real viruses to test that anti-virus products are installed correctly.
EICAR exists for a reason as do the test URL's lists from the content filtering providers.
I've yet to see a filtering product that is 100% accurate - either for virus detection or content inspection.
If even the big boys can't do it, then what chance to "Logan" stand ?
My favorite (real) story here is of a female security officer I worked with, who whilst at Infosec challenged a vendor that did skin tone detection to see how good the product was, by using a couple of sites by name. It only took her a couple of minutes to find some that weren't detected correctly.
There are also places that can't do filtering effectively without breaking the business need - take many medical roles. I've seen them use a trust and verify approach. It flags as potentially bad but allows people to continue - subject to post viewing review by a human.
I was once asked by the CEO to grant access to the Head of Legal mailbox.
Before I accepted this mission, I requested it in writing and signed by CEO and Head of Security, once the document was in my possession and safely stored. The deed was done with the CEO sat at my desk, browsing for whatever the CEO required.
A few hours later...a very angry and upset Head of Legal came to my boss and demand my head on a platter and to be instantly dismissed, all of which was heard by anyone and everyone along the open plan office.
My boss replied "he is protected by a document". (what a wonderful statement).
The Head of Legal then wanted a corporate change amendment where access to the mailbox can only be signed off by the Board of Directors.
A few days later.. Head of Legal had left the organisation.
A few months later, a call came from an IT Manager at where the Head of Legal was now working, asking all sorts of questions and concerns about this person. I did feel sorry for the IT Manager.
Anonymous for lots of reasons...
"A long time ago* in a galaxy far, far away...."
Or in a windowless cubbyhole in the depths of IT we ran a Usenet server for legitimate business reasons.
Enter person demanding (also for allegedly legitimate reasons) to see some pron. Preferably really nasty pron.
No, quoth we. It would be against all policy. So pron-fixated person goes to boss who dutifully gives him the same chapter and verse. On to boss-squared for the same result. Boss cubed and so on through the exponents until it arrived at the very top. From whence came the diktat "Do it!"
We quailed and genuflected and timorously prayed "Put it in writing." And lo the verse of the chapter was amended to say "...yea dismissal and dole will be upon ye except for this, which you must do." And we read the Revised Version and in obedience thereto added numerous binary groups to the server, supplied the means to assemble and view whatever might arrive and righteously averted our eyes.
Each day the valiant pron-seeker waxed wroth and wrother verily until the fourteenth dawn when he went full Lucifer and accused the minions of censoring his feed, impeding his noble purpose and even keeping his pron unto themselves.
We minions were puzzled. Had we not offered up the finest pron the interwebs had to offer? We mused, we pondered long — about 15 seconds — and dug out a binary viewer...
Now good and bad are often subjective values but we all (five of us) agreed that the "worst" a fortnight's binary collection had produced was a scantily clad lady of substantial build interacting with a widely available root vegetable.
Sadder and not notably wiser we returned the server to it pristine condition, scrubbed the evidence (such as it was) and turned our attention to less stimulating affairs.
[ * 1996. Any connection to other events of the time or the creation of the IWF will be denied.]
I was once responsible for an organizations smut filter, and so when something got through, I have to verify it was smut before it was forever added to the blacklist.
I used to joke I was paid to watch smut, but it was not all fun and games as this introduced me to a number of perversions I would have never thought existed and now wish I didn't.
I was never "paid to watch", but did have to review logs before decent proxies were around, implement the IIS ad-ons that passed for filters back then, and take action when I thought the Police were needed. The latter tended to end up with me in a Courtroom wearing my funeral outfit as witness for the prosectution. Process, systems, date/time and custody type questions for the most part.
Which, perversely, wound up with me seeing things I *really* didn't want to see: I'd reported them because I knew from the domain name(s) that it wouldn't be pretty, but in the early days of Internet, Lawyers tended to print out all the alledged images (though how they did that legally I'm unclear).
So many, many, things you cannot unsee - mind bleach would be useful.
And as someone above noticed, senior staff in Legal section of a previous employer had some very unusual "interests", and we always knew who was planning holidays, weddings, cozy nights-in, trying out their favourite kink, and etc..
Did make dealing with some people awkward, looking them in the eye difficult, and staying far enough away not to shake their hand essential.
'..Did make dealing with some people awkward, looking them in the eye difficult, and staying far enough away not to shake their hand essential.'
A couple of nights monitoring of one of the top 10 World Uni departments web traffic, if it fell into the wrong hands (e.g. Undergraduates) would probably lead to a faster issuing of Degrees and Doctorates than this lot ever could achieve.
String Theory?, more like Whips'n'chains the practical...and what exactly was it that Japanese schoolgirls and tentacles have to do with quantum physics again?
As to the hand shaking etc. Retreating to a nice secure server room took care of the need to physically interact with these characters, passing the buck onto a minion helped when they required a physical presence..
Needless to say, that level of web monitoring didn't last, we switched to a different method, but certain filter rules generated 'too many false positives' so were dropped..I got the PHB to send me an email instructing me to remove these ones so that there'd be no comeback.
'..So many, many, things you cannot unsee - mind bleach would be useful.'
Mind Bleach?, well, alcohol and time works...lots of both...I'm glad I no longer have to go through this sort of crap on a daily basis for a living.
One of my friends worked for an ISP and was given responsibility for testing their latest smut filter implementation (with similar consequences), and one of our conversations went:
Him: *reveals being put in charge of white/black lists etc*
Friend #2: Could you send the decent URLs to me?
Friend #3: ...and the indecent ones to me?
I worked at a place that developed their own keyword filter list to block smut in dns records because the main backers had religious links, and they did this by recruiting a willing group of foriegn student young ladies from the local college to sit round in our office browsing for the very worst stuff to add the filter, because they could check for smut in their native languages.
I certainly learned a few new words, it was a interesting office, but the net result was 18 or so very very corrupted young not so ladies and a business model that tanked because it didn't earn any sales from porn or sex sites.
I manage the internet filtering where I work and have found curl and wget are the best way to browse porn whilst at work. You are unlikely to have anything obviously offensive in a page of text, and in all honesty I really would not want people to see me looking at porn to make sure the filtering is working.
We even have a server that used to spend all day browsing Playboy until they took of all the smut :( (this is a direct result of a cockup that resulted in us having no filtering for several days)
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
