OS X Parental Controls Review - State of the art in OS X 10.5 and 10.6

Apple has recently updated their OS X Parental Controls documentation for 10.5 and 10.6. It will be interesting to see if they improve Parental Controls with 10.7(Lion).

The only good thing I can say about the current generation of OS X Parental Controls is that they're an improvement on the non-existent Parental Controls in iOS.

Below is a summary of the current controls documentation, followed by notes of my own. I appreciate the irony that, as the father of a vulnerable child, I share the same agenda as China's totalitarian Party (emphases mine) ...

Mac OS X v10.5, 10.6: About the Parental Controls Internet content filter

The Internet content filter can operate in three modes: unrestricted, automatic, and whitelist.

When "Allow unrestricted access to websites" is selected, the Internet content filter logs websites that the account visits but does not restrict Web browsing. Visited websites are still logged and can be examined in the Logs tab of Parental Controls preferences.

When "Try to limit access to adult websites automatically" is selected, the Internet content filter does its best to block websites with inappropriate content. To do this, the Internet content filter uses the same technology that the Mail application uses to identify "junk" mail. The Internet content filter can identify, with a high degree of accuracy [!], whether a Web page is safe or not by examining various properties of the website including text and structure.

Additionally, the Internet content filter will block a website if the website identifies itself as adult-oriented using RTA (http://www.rtalabel.org/) or SafeSurf (http://www.safesurf.com/ssplan.htm) rating systems, as well as forcing "safe" searches with some search engines.

In this mode, the Internet content filter logs all visited and blocked websites, and flags them as such in the Logs tab of Parental Controls preferences.

In certain situations, the automatic Internet content filter may mistakenly block a safe website or allow an adult-oriented website. For example, if the website uses an uncommon language or if there is very little text on the page. These websites can be identified in the Log tab of the Parental Controls preference pane and added to the "Always Allow" or the "Never Allow" lists. These lists can also be accessed by clicking the Customize… button in the Content tab of Parental Controls preferences. Websites that are mistakenly blocked can also be allowed by clicking the "Allow…" button on the blocked web page and authenticating as an administrator user.

https note: For websites that use SSL encryption (the URL will usually begin with https), the Internet content filter is unable to examine the encrypted content of the page. For this reason, encrypted websites must be explicitly allowed using the Always Allow list. Encrypted websites that are not on the Always Allow list will be blocked by the automatic Internet content filter.

If "Allow access to only these websites" is selected in Parental Controls, the Internet content filter blocks any website which is not on the list. When the blocking web page is presented, a list of allowed websites is also shown. If using Safari, allowed websites are displayed as bookmarks in the bookmarks bar.

Note: For most websites, the Internet content filter considers the domain name and not the path. For example, if http://www.example.com is added to the list, then http://pictures.example.com will be allowed, as will http://www.example.com/movies.

In whitelist mode, visited and blocked websites are flagged in the Logs tab of Parental Controls preferences and can be added or removed from the whitelist there.

The documentation is incomplete (I gave it a rating of "2"). Some additional notes and references:

• Safari history cannot be deleted in the most restrictive mode and in that mode preference changes are limited as well. It can be deleted and preferences can be edited in other modes.
• The documentation false claims about the accuracy of content blocking, and of course images cannot be managed (emphases mine).
• A user account must be closed (user logged out) for content rule updates to be applied.
• Because of the various measures Google takes to evade censorship by authoritarian governments their services are a poor match to Parental Controls. Bing is much more dictator friendly, so I block all Google services and allow Bing.
• OS X Parental Controls settings and logs can be managed from a remote admin account (see references below).
• It is most convenient to allow and block sites while reviewing the log file records.

It's easy to find problems with OS X Parental Controls, but I don't expect much improvement -- even with all the world's dictators on my side. For example ...

1. There's no customer demand for improvements. I think most parents are quite unaware of what most adolescent males do on the web, and I think they prefer to remain unaware. This is not necessarily a bad solution for most adolescents and parents; not all children are equally vulnerable.
2. Technologies for evading monitoring, ensuring security, and protecting privacy also block Parental Controls.
3. Engineers without young children don't like Parental Controls, not least because of how the technologies can be misused. Working on Parental Controls is unlikely to be a career move at Apple.
4. These are hard problems because of the way the Internet is structured, and because content providers are actively trying to evade Parental Controls either because they want to facilitate adult access or because they are seeking vulnerable people to exploit.

See also (mostly Gordon's Tech):

• Parental Controls - The wikipedia problem solved (11/2009)
• OS X Parental Controls: The https bug and our family Google Apps services (4/2010 - I later gave up on all Google services on a parental controlled account)
• Parental Controls - Remote Access and other tips (1/2010)
• Parental controls: Apple and Google joint fail (6/2010) - Back when I was trying to get Google services to work. I later returned to Parental Controls without Google.
• Apple's Parental Controls: Never more broken than with Apple's MobileMe (7/2010) - Totally incompatible, maximally ironic. I bet iCloud will be no better.
• Gordon's Notes: Google's ad platform is a gaping hole in iOS parental controls
• LEGO Digital Designer is pure evil on OS X (protocol blocked by parental controls) - 11/2009
• Can't select Jabber or Google Talk for iChat? Here's one reason. (5/2009 - don't know if this was fixed)
• Apple's iPhone parental controls are completely broken(9/2010) - I bet iOS 5 will be no better.
• iPhone for kids: The Achilles Heel

Update 6/15: Nothing illustrates Apple's disdain for Parental Controls better than this screenshot:

The log display can extend vertically, but not horizontally. It's fixed width. So you can't actually view the URLs. The poor engineer must have taken pity on his users however, if you let your mouse rest on a URL for a while a popup will show you the full text.

This is third rate work.