12.3. Parental Controls If you're setting up a Standard account, the Parental Controls checkbox affords you the opportunity to shield your Mac—or its very young, very fearful, or very mischievous operator—from confusion and harm. This is a helpful feature to remember when you're setting up accounts for students, young children, or easily intimidated adults. (This checkbox is available for Admin accounts, too, but trying to turn it on produces only a "Silly rabbit—this is for kids!" sort of message.) Leopard introduces a lot more peace of mind for parents than other operating systems. You can now specify how many hours a day each person is allowed to use the Mac, and declare certain hours (like sleeping hours) off-limits. You can specify exactly who your kids are allowed to communicate with via email (if they use Mail) and instant messaging (if they use iChat), what Web sites they can visit (if they use Safari), what programs they're allowed to use, and even what words they can look up in the Mac OS X Dictionary. Here are all the ways you can keep your little Standard account holders shielded from the Internet—and themselves. For sanity's sake, the following discussion refers to the Standard account holder as "your child."But some of these controls—notably those in the System category—are equally useful for people of any age who feel overwhelmed by the Mac, are inclined to mess it up by not knowing what they're doing, or are tempted to mess it up deliberately. Note: If you use any of these options, the account type listed on the Accounts panel changes from "Standard" to "Managed." 12.3.1. System On this tab, you see the options shown in Figure 12-5 . Use these options to limit what your Managed-account flock is allowed to do. You can limit them to using certain programs, for example, or prevent them from burning DVDs, changing settings, or fiddling with your printer setups. (Limiting what people can do to your Mac when you're not looking is a handy feature under any shared-computer circumstance. But if there's one word tattooed on its forehead, it would be "Classrooms!") On the panel that pops up when you click Configure, you have two options: "Use Simple Finder" and "Only allow selected applications." 12.3.1.1. Use Simple Finder If you're really concerned about somebody's ability to survive the Mac—or the Mac's ability to survive them—turn on "Use Simple Finder." Then turn on the checkboxes of the programs that person is allowed to use. Suppose you're the lucky Mac fan who's been given a Simple Finder account. When you log in, you discover the barren world shown in Figure 12-6 . There are only three menus ( , Finder, and File), a single onscreen window, no hard drive icon, and a bare-bones Dock. The only folders you can see are in the Dock. They include: • My Applications. These are aliases of the applications that the administrator approved. They appear on a strange, fixed, icon view, called "pages." List and column views don't exist. The Simple person can't move, rename, delete, sort, or change the display of these icons—merely click them. If you have too many to fit on one screen, you get numbered page buttons beneath them, which you click to move from one set to another. Figure 12-5. In the Parental Controls window, you can control the capabilities of any account holder on your Mac. In the lower half of the System tab window, you can choose applications and even Dashboard widgets by turning on the boxes next to their names. (Expand the flippy triangles if necessary.) Those are the only programs these account holders will be allowed to use. (The new Search box helps you find certain programs without knowing their categories.) • Documents. Behind the scenes, this is your Home Documents folder. Of course, as a Simple Finder kind of soul, you don't have a visible Home folder. All your stuff goes in here. • Shared. This is the same Shared folder described on Section 12.6.2. It's provided so that you and other account holders can exchange documents. However, you can't open any of the folders here, only the documents. • Trash. The Trash is here, but you won't use it much. Selecting or dragging any icon is against the rules, so you're left with no obvious means of putting anything into your Trash. Figure 12-6. The Simple Finder doesn't feel like home—unless you've got one of those Spartan, space-age, Dr. Evil–style pads. But it can be just the ticket for less- skilled Mac users, with few options and a basic one click interface. Every program in the My Applications folder is actually an alias to the real program, which is safely ensconced in the off-limits Applications folder. The only programs with their own icons in the Dock are Finder and Dashboard. Otherwise, you can essentially forget everything else you've read in this book. You can't create folders, move icons, or do much of anything beyond clicking the icons that your benevolent administrator has provided. It's as though Mac OS X moved away and left you the empty house. • To keep things extra-simple, Mac OS X permits only one window at a time to be open. It's easy to open icons, too, because one click opens it, not two. • The File menu is stunted, offering only a Close Window command. The Finder menu only gives you two options: About Finder and Run Full Finder. (The latter command prompts you for an administrator's user name and password, and then turns back into the regular Finder—a handy escape hatch. To return to Simple Finder, just choose Finder Return to Simple Finder.) • The menu is really bare-bones: You can Log Out, Force Quit, or go to Sleep. That's it. • There's no trace of Spotlight. Although the Simple Finder is simple, any program (at least, any that the administrator has permitted) can run from Simple Finder. A program running inside the Simple Finder still has all of its features and complexities—only the Finder has been whittled down to its essence. In other words, Simple Finder is great for streamlining the Finder, but novices won't get far combating their techno-fear until the world presents us with Simple Keynote, Simple Mail, and Simple Microsoft Word. Still, it's better than nothing. When Simple people try to save documents, they'll find that although the Save box lists the usual locations (Desktop, Applications, and so on), they can in fact save files only into their own Home folders or subfolders inside them. 12.3.1.2. Only allow selected applications By tinkering with the checkboxes here, you can declare certain programs off-limits to this account holder, or turn off his ability to remove Dock icons, burn CDs, and so on. You can restrict this person's access to the Mac in several different ways: • Limit the programs. At the bottom of the dialog box shown in Figure 12-5, you see a list of all the programs in your Applications folder (an interesting read in its own right). Only checked items show up in the account holder's Applications folder. Tip: If you don't see a program listed, use the Search box, or drag its icon from the Finder into the window. If, for instance, you're setting up an account for use in the classroom, you may want to turn off access to programs like Disk Utility, iChat, and Tomb Raider. • Limit the features. When you first create them, Standard account holders are free to burn CDs or DVDs, modify what's on the Dock, change their passwords, and view the settings of all System Preferences panels (although they can't change all of these settings). Depending on your situation, you may find it useful to turn off some of these options. In a school lab, for example, you might want to turn off the ability to burn discs (to block software piracy). If you're setting up a Mac for a technophobe, you might want to turn off the ability to change the Dock (so your colleague won't accidentally lose access to his own programs and work). 12.3.2. Content (Dictionary and Web) "Content," in this case, means "two options we really didn't have any other place to put." Actually, what it really means is Dictionary and Safari. 12.3.2.1. Hide profanity in Dictionary As you know from Chapter 10 , Mac OS X comes with a complete electronic copy of the New Oxford American Dictionary. And "complete," in this case, means "it even has swear words." Turning on "Hide profanity in Dictionary" is like having an Insta-Censor™. It hides most of the naughty words from the dictionary whenever your young account holder is logged in (Figure 12-7 ). Figure 12-7. Something's oddly missing from the Dictionary when Parental Controls are turned on: dirty words. 12.3.2.2. Web S ite Restrictions This feature is designed to limit which Web sites your kid is allowed to visit. Frankly, trying to block the racy stuff from the Web is something of a hopeless task; if your kid doesn't manage to get round this blockade by simply using a different browser, he'll just wind up seeing the dirty pictures at another kid's house. But at least you can enjoy the illusion of taking a stand, using approaches of three degrees of severity: • Allow unrestricted access to Web sites. In other words, no filtering. Anything goes. • Try to limit access to adult Web sites automatically. Those words—"try to"—are Apple's way of admitting that no filter is foolproof. In any case, Mac OS X comes with a built-in database of Web sites that it already knows may be inappropriate for children—and these sites won't appear in Safari while this account holder is logged in. By clicking Customize and then editing the "Always allow" and "Never allow" lists, you can override its decisions on a siteat- a-time basis. • Allow access to only these Web sites. This is the most restrictive approach of all: It's a whitelist, a list of the only Web sites your youngster is allowed to visit. It's filled with kid-friendly sites like Disney and Discovery Kids, but of course you can edit the list by clicking the + and–buttons below the list. 12.3.3. Mail & iChat Here, you can build a list of email and chat addresses, corresponding to the people you feel comfortable letting your kid exchange emails and chat with. Click the + button below the list, type the address, press Enter, lather, rinse, and repeat. Tip: No, you can't drag cards in from your Address Book; that would be much too simple. But after clicking the + button to create a new row in the list (in Edit mode), you can drag just the email address out of an Address Book card that you've opened up. For reasons explained in a moment, turn on "Send permission emails to," and plug in your own email address. Now then: When your youngster uses Apple's Mail program to send a message to someone who's not on the approved list, or tries to iChat with someone not on the list, he gets the message shown at top in Figure 12-8 . If he clicks Ask Permission, then your copy of Mail shortly receives a permission-request message (Figure 12-8 , middle); meanwhile, the outgoing message gets placed in limbo in his Drafts folder. If you add that person's address to the list of approved correspondents, then the next time your young apprentice clicks the quarantined outgoing message in his Drafts folder, the banner across the top lets him know that all is well—and the message is OK to go out (Figure 12-8 , bottom). POWER USERS' CLINIC Parental Remote Controls It occurred to somebody at Apple that the new Parental Controls feature might be especially useful in a classroom. That person further realized that it'd be very cool if you could adjust the settings for Macs A, B, C, and D while seated at Mac E. That is, the teacher might prefer not to have to scurry from kid's desk to kid's desk to make changes. And that's why you can operate Parental Controls from another Mac on the same network. Phase 1: While seated at the first kid's Mac, open System Preferences; open Parental Controls; click the ; enter your password. Now click the name of the account you want to manage remotely. Then, from the menu below the list of accounts, choose Allow Remote Setup. Close System Preferences. Repeat for each account on each Mac that you'll want to manage from afar. Phase 2: Go back to your teacher's desk. On your own Mac, choose Go Connect To Server. In the resulting dialog box, click Browse. Now you get a list of the other Macs on the network. Click one and enter an administrator's name and password for that Mac. Now open System Preferences, click Parental Controls, click the , and then enter your password again. This time, you'll see a section in the Accounts list called Other Computers. Click the account name (on the kid's Mac) whose settings you want to change. Enter the administrator name and password of the remote computer one more time, and off you go! Note: This feature doesn't attempt to stop email or chat using other programs, like Microsoft Entourage or Skype. If you're worried about your efforts being bypassed, block access to those programs using the Forbidden Applications list described above. Figure 12-8. Top: If your kid tries to contact someone who's not on the Approved list, he can either give up or click Ask Permission. Bottom: In the latter case, you'll know about it. If you're convinced that the would- be correspondent is not, in fact, a stalker, you can grant permission by clicking Always Allow. Your young ward gets the good news the next time he visits his Drafts folder, where the message has been awaiting word from you, the Good Parent. When your underling fires up iChat or Mail, she'll discover that her Buddy List is empty except for the people you've identified. Handling the teenage hissy fit is your problem. 12.3.4. Time Limits Clever folks, those Apple programmers. They must have kids of their own. They realize that some parents care about how much time their kids spending front of the Mac, and some also care about which hours (Figure 12-9 ): • How much time. In the "Weekday time limits" section, turnon "Limit computer use to," and then adjust the slider. A similar slider appears for Weekend time limits. • Which hours. In the "Bedtime" section, turn on the checkbox for either "School nights" or "Weekend," and then set the hours of the day (or, rather, night) when the Mac is unavailable to your young account holders. In other words, this feature may have the smallest pages-to-significance ratio in this entire book. Doesn't take long to explain it, but it could bring the parents of Mac addicts a lot of peace. 12.3.5. Logs The final tab of the Parental Controls panel is Big Brother Central. Here's a complete rundown of what your kids have been up to. Its four categories—Websites visited, Websites blocked, Applications, and iChat—are extremely detailed. For example, in Applications, you can see exactly which programs your kids tried to use when, and how much time they spent in each one. Figure 12-10 shows the idea. Figure 12-9. Top: If this account holder tries to log in outside of the time limits you specify here, she'll encounter only a box that says, "Computer time limits expired." She'll be offered a pop-up menu that grants her additional time, from 15 minutes to "Rest of the day"—but it requires your parental consent (actually, your parental password) to activate. Bottom: Similarly, if she's using the Mac as her time winds down, she gets this message. Once again, you, the allknowing administrator, can grant her more time using this dialog box. If you see something that you really think should be off limits—a site in the Websites Visited list, an application, an iChat session with someone—click its name and then click Restrict. You've just nipped that one in the bud. Conversely, if the Mac blocked a Web site that you think is really OK, click its name in the list, and then click Allow. (And if you're wondering what a certain Web page is, click it and then click Open.) Figure 12-10. These logs track everything your kid tried to do; it's spying, sure, but it's for the good of the child. (Right?) Use the popup menus at the top to change the time period being reported (Today, This Week, or whatever) and how they're grouped in the list—by date or by application/Web site. . 12.3. Parental Controls If you're setting up a Standard account, the Parental Controls checkbox affords you the opportunity. bottom). POWER USERS' CLINIC Parental Remote Controls It occurred to somebody at Apple that the new Parental Controls feature might be especially