5 ms·

My kids are required to use Google classroom and Google docs for schoolwork and extracurricular activities. YouTube algorithms are optimized to create pointless

by doetoe 5y ago

My kids are required to use Google classroom and Google docs for schoolwork and extracurricular activities. YouTube algorithms are optimized to create pointless distraction, so to improve their focus I blocked access to YouTube on their computers (with their approval even!), but now it turns out that they cannot use classroom and docs anymore!

scoopertrooper 5y ago
I think the problem here is more so your method of blocking Youtube than anything Google is doing. You should block DNS resolution of youtube.com and block outbound connections on port 53 to any device other than your router. This wouldn't stop DNS over HTTPS, but that workaround can also be blocked. https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...
- doetoe 5y ago
  Could that be done for individual but not all computers on the network?
  - hansel_der 5y ago
    local dns-override is possible with hosts-file or a local dns-server. nextdns offers this as a service. ublock with a cutom blocklist that is self-served (via gh-pages or whatever) could be the most simple solution.
  - scoopertrooper 5y ago
    Not without an authenticated proxy. Otherwise, some routers allow you to set up separate rules for 'guests', which authenticate with different credentials. You'd have to do some research to find one that had different DNS policies for each zone. A simpler, though more expensive, solution would be to just buy a second router for your kids to use, then connect its WAN port to one of the Ethernet ports on the main router. You could, of course, just modify the hosts file to block youtube.com on their local machines, but that wouldn't affect mobile devices, and they'd eventually workout how to get around it.
  - midasuni 5y ago
    Put a nat rule on your router to point a specific source address with target of UDP/53 to your desired dns server (and use the doh canary domain)
    - scoopertrooper 5y ago
      That's a flimsy solution as IP addresses are not generally static. Sure, you can manually assign an IP, but if the kids catch on, then they can just switch back to auto assign.
      - midasuni 5y ago
        That’s a different threat model - the kids not wanting it blocked. You can white list devices instead (so they’d have to spot a particular mac address), you can just add them to a different vlan in a different ssid (sane as you separate your IoT shit from your normal network), but you have to look at them establishing vpn to take traffic In this case the user wants it blocked and wants to fight the their device which acts against them (google doesn’t want you blocking google services)
- deleted 5y ago
  [deleted]
1vuio0pswjnm7 5y ago
Which did you block *.youtube.com *.googlevideo.com Only need to block the 2nd one to stop videos from playing Would be surprised if Classroom or Docs required the 2nd one
- doetoe 5y ago
  The first actually, I'll change it, thanks!

by doetoe 5y ago

scoopertrooper 5y ago

I think the problem here is more so your method of blocking Youtube than anything Google is doing. You should block DNS resolution of youtube.com and block outbound connections on port 53 to any device other than your router. This wouldn't stop DNS over HTTPS, but that workaround can also be blocked. https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...

doetoe 5y ago
Could that be done for individual but not all computers on the network?
- hansel_der 5y ago
  local dns-override is possible with hosts-file or a local dns-server. nextdns offers this as a service. ublock with a cutom blocklist that is self-served (via gh-pages or whatever) could be the most simple solution.
- scoopertrooper 5y ago
  Not without an authenticated proxy. Otherwise, some routers allow you to set up separate rules for 'guests', which authenticate with different credentials. You'd have to do some research to find one that had different DNS policies for each zone. A simpler, though more expensive, solution would be to just buy a second router for your kids to use, then connect its WAN port to one of the Ethernet ports on the main router. You could, of course, just modify the hosts file to block youtube.com on their local machines, but that wouldn't affect mobile devices, and they'd eventually workout how to get around it.
- midasuni 5y ago
  Put a nat rule on your router to point a specific source address with target of UDP/53 to your desired dns server (and use the doh canary domain)
  - scoopertrooper 5y ago
    That's a flimsy solution as IP addresses are not generally static. Sure, you can manually assign an IP, but if the kids catch on, then they can just switch back to auto assign.
    - midasuni 5y ago
      That’s a different threat model - the kids not wanting it blocked. You can white list devices instead (so they’d have to spot a particular mac address), you can just add them to a different vlan in a different ssid (sane as you separate your IoT shit from your normal network), but you have to look at them establishing vpn to take traffic In this case the user wants it blocked and wants to fight the their device which acts against them (google doesn’t want you blocking google services)
deleted 5y ago
[deleted]

1vuio0pswjnm7 5y ago

Which did you block *.youtube.com *.googlevideo.com Only need to block the 2nd one to stop videos from playing Would be surprised if Classroom or Docs required the 2nd one

doetoe 5y ago
The first actually, I'll change it, thanks!