Parental control software

There's no "silver bullet" that will cover all concerns, but one simple step that might help is to use OpenDns as your DNS provider in place of your ISP's DNS servers. It's easy, free, and appears to have little downside.

Whenever the MBP requests the DNS server to translate a domain name to an IP address, OpenDns will block access to "undesirable" domains. Optionally, you can use their OpenDNS Updater program to notify them of your current IP address. Then you can create a (free) account and have a fair amount of control over which sites are blocked and which are not. You can see recent stats on what domain addresses were requested. Check it out (opendns.com).

Easiest is to have all devices on your home network use OpenDNS by setting it in your router/gateway device (since normally devices on your local network get DNS server addresses from there), but you could also set the OpenDNS servers on just your son's MBP, leaving your other devices to continue to use your ISP's default DNS servers. (To do that, go into the MBP's system preferences-->Network-->Advanced-->DNS.)

My approach was to tell the kids upfront that if they got a "blocked" message, not to worry about it, but if it was something they thought they should be able to see then to come to me and I could check it out and unblock that site.

I think OpenDNS is pretty useful, but it certainly doesn't address every accidental, shocking, premature discovery. On my particular concern list is Google image search. You should know that by default "SafeSearch" is not enabled, and no DNS filter will help you with this, assuming you want to allow access to the google.com domain at all. Be careful what they type! You can go to every browser, on every account, on every machine, on your network that they might use, and set "SafeSearch," but what a hassle! And here we're just talking about more or less accidental exposure -- the setting (even if "locked" with a google account and password) is just saved in a cookie, so if the older computer-savvy kids want to get around it... well, that's a whole different discussion...

I think OpenDNS and "SafeSearch" probably block a lot of stuff I wouldn't really feel the need to block from my kids, but there is for sure some stuff I would like to block from them, at least for now, and well, these overly-blunt tools are at least quick and easy...

 

I also used OpenDNS for this, and it worked well most of the time.

 

OP wrote above:
[[ Having had a look around, something like Web Watcher software seems to be the only answer, but that monitors everything he does and I don't want to snoop on him. I just want to protect him. ]]

I think the dilemma here is that you can't really "protect" him without introducing some level of "snooping" as well. Something of a conundrum, but unavoidable.

I doubt there is a solution that will transfer the "burden of control" to the computer, that you need to exercise yourself.

Whether or not you wish to do this is ... well.... up to you....

 

I'm assuming you have administrator privs on his laptop, and that no one else does, except for people you trust. In that case, you can set OS X's DNS Servers to the IP addresses for the OpenDNS servers and "Click the lock to prevent further changes." I believe this is a system-wide setting (i.e., not "per-account"). No matter what network the laptop is used on, yours or hers or Starbuck's, it will (I'm pretty sure) use the DNS Server settings you put in place, thus "protected" by OpenDNS no matter where he is. You can test it out by going to "playboy.com" in any browser.

Go to System Preferences-->Network. Select "Wi-Fi", then click the Advanced button, then the DNS tab. In the DNS Servers box, delete any that may be there, and add the OpenDNS server IP addresses.

Go back and do the same thing after selecting "Ethernet" if you think he might sometimes plug an Ethernet cable into the laptop. (The DNS settings are for each network interface.) I don't know much about the possibility of the Bluetooth or FireWire interfaces being used for an Internet connection; I doubt that's worth worrying about but I see they can have DNS Server setttings, too.

To feel confident in the settings, take the laptop to some public WiFi spot and verify that the DNS settings are still what you put in, and that "playboy.com" is still blocked by OpenDNS.

If you don't feel the need to customize OpenDNS's blocking or see reports of what domains were accessed, I think this will do what you want. If you want to customize what is blocked and what is allowed, I think you have to "tell" OpenDNS what WAN IP address the laptop is (currently) using. If you install their OpenDNS Updater app it does exactly that -- so it should still work, no matter what network, yours, hers, etc. I am using their Updater app but I've forgotten the details of how it works and I'm a little too lazy to look it up... I think at startup and at intervals it figures out your current "internet visible" IP address and notifies OpenDNS if it has changed.

Hope this helps!

 

OpenDNS FamilyShield uses generic DNS servers so no matter what network he uses he is bound by the FamilyShield protection. That being said, it is not configurable but it would work provided you don't need the management console of the regular OpenDNS service.

 

Well, I wouldn't call them "generic," as I believe they filter/block some domains, right?

But yes, I that's what I meant by "If you don't feel the need to customize OpenDNS's blocking or see reports of what domains were accessed, I think this will do what you want."

I'll admit I was speaking from memory. I now see this OpenDNS Family Shield which is new to me, and I'm confused about how that's different from OpenDNS Home that I'm using.

In any case, I'm pretty sure you really don't need an OpenDNS "account" or "product" of any sort -- just set up your devices to use the publicly-known OpenDNS server IP addresses as a DNS Server, and you get their default blocking behavior. (Please correct me if I'm wrong about this.)

But just to clarify what I was getting at: the free OpenDNS Home allows you to create a free account and notify "it" of your current dynamic IP address. OK, instead of using this with your home router, you set up the Updater program on the child's laptop and insert the OpenDNS server IPs in the laptop. Now you get the "benefits" of filter customization and logging, and (I think) it would be effective wherever that laptop was used. I may be mis-understanding how DNS works and I haven't tested this exact scenario, but I've done essentially the reverse: having the home router/network on OpenDNS servers but one specific device using my ISP's DNS servers.

Anyway, all that is probably beyond what the OP wants and I apologize if I'm coming across badly -- I'm just always trying to solidify my incomplete uderstanding of the world! Thanks, Altemose!

 

OpenDNS Home uses the IP of the device (either a computer or router) tied to the account to provide settings. As soon as the device gets a new IP it loses all ties to the account. The updater program simply says "hey, OpenDNS, this device which is tied to this account uses this IP address now". This is circumvented by deleting the program off the computer.

OpenDNS FamilyShield is preconfigured. Anything using that DNS server will get the settings OpenDNS set up. It does not matter if the IP changes from one in America to one in Africa, they all are bound by the same filtering and protection. You do not have control or logging of devices using FamilyShield and you do not need the updater program.