Scootinger’s Blog

My school uses a filter called Shelterbelt from a company called TwoTrees Technologies. I have to say - it has to be some of the most unprofessionally designed software that I have ever used.

EFF.org blocked

First of all I was doing a project at school where I was writing something about the EFF. When I tried to go to the EFF’s website at school, I found this:

I felt that there was no reason for them to be blocking the EFF’s website. I did feel that maybe since the EFF opposes censorship on the Internet, they may have had something against that. I wrote this email to the email address on the “blocked” page, proxymaster@twotrees.com, on February 20, 2007:

“My school uses the Shelterbelt filtering system. While doing some research I noticed that the Electronic Frontier Foundation’s website, EFF.org, is blocked. Why is this? Your website claims that “Twotrees Internet Management is an outside company without any biases” yet I cannot help but believe that this may be a result of your own personal biases against Internet civil liberties organizations.”

It is March 3, almost two weeks later, and I still have not received a reply from TwoTrees! And of course EFF’s site is still blocked!

BoingBoing blocked

Sometimes I want to go to BoingBoing.net when I am at school (not in the middle of class!) But of course I get this:

I thought that Iran was the only place where BoingBoing was blocked, but I guess I’m wrong!

Competitors’ websites blocked

I noticed that if you go to Websense’s web site you get this: (Websense is a very popular filtering system in case you don’t know)

Same thing with Secure Computing, the developer of the well-known SmartFilter filtering software:

What legitimate business should feel the need to use their power as a developer of filtering software to arbitrarily block their competitors’ websites, especially major ones?

Shelterbelt’s reaction to PHProxy and other web proxies

The Shelterbelt filter gives you a “special” blocked page if you try to go to a recognized proxy/anonymization site. In my case it gave me this page when I looked up PHProxy on Wikipedia.

I got the same thing if I went to ProxyPlus.cz or CCProxy, which are both network proxy/firewall software programs. Maybe they want to block these competitors’ sites just like they blocked Secure Computing and Websense?
The most interesting part is where it tells you that “the browser may have frozen.” It does work, and they do it by running a loop, therefore the browser with JavaScript (it does it whether you use IE/Firefox/anything else).

I cannot share the JavaScript code because there is a copyright notice in the code. I would like to stay on the safe side, as you never know what TwoTrees might do if they find out, even if it’s as low as going after me for posting their little piece of JavaScript code written in 15 minutes. But I can say that basically it’s a script that runs a loop over and over again to crash the browser. Overall, it looks like it was written by a 10-year-old!

In addition if you do get to a PHProxy site that is not blocked the filter will block your IP as soon as you try to get to a website. Fortunately, at many schools (including my own), getting a new IP is as simple as restarting the computer!

Other Pages

Go check out http://db1.twotrees.com/errorpages/. It has a lot of error pages from Shelterbelt that easily show how unprofessionally TwoTrees’ system is designed. Of course, it’s unprofessional enough that they leave this directory open in the first place!

Half the pages say something to the tune of “the Proxymaster has been paged to immediately review the activity of this workstation.” They’re just “dumb” HTML pages!

Here’s a few of the best ones:

http://db1.twotrees.com/errorpages/00009.html - “This workstation has been identified as making intentional attempts at pornographic sites.” - how does it know that all attempts at accessing certain porn sites are intentional? Looks like crap too!

http://db1.twotrees.com/errorpages/freeze.html - DO NOT GO TO unless you want your system “frozen” - “freezes” your web browser by repeatedly making JavaScript dialog windows.

http://db1.twotrees.com/errorpages/mailform2.html - Automatically pops up a mailto with the subject “Feedback for webdevelopersnotes.com” and body “The Tips and Tricks section is great”. Seriously, how dumb can they be?

TwoTrees’ Website

Don’t forget to check out TwoTrees’ website! It’s almost as bad as their products.

Here’s one example of a major mistake from the site:

“Typically an institution will install a security device and then move on. Not realizing that the security within that device becomes outdated daily. If the device is not continually updated and monitored, then it will become ineffective.”

Of course, they also brag about their logging system and their supposed ability to contact the school regarding abuse. In my school’s (as well as many other schools’) case it is very ineffective because the Shelterbelt system only logs the IP and does not log any information about the user of the system. And if you look at the “error” pages at the URL above, you could easily doubt many of the claims that TwoTrees makes on their website.

Conclusion

It seems like I’ve been able to show you how crappily the Shelterbelt system is designed. I don’t think a whole lot of schools/organizations use the Shelterbelt system, and it appears (according to their website) that the schools that do use it are mostly located in the Midwest. However if your school is looking at using Shelterbelt, show them this article and make sure that they don’t make a decision that they’ll regret!