12.4. Editing Accounts

12.3. Paren'tal Controls

If you're setting up a Standard account, the Paren'tal Controls tab affords you the opportunity to shield your Mac ”or its very young, very fearful, or very mischievous operator ”from confusion and harm. This is a helpful feature to remember when you're setting up accounts for students, young children, or easily intimidated adults. (This tab is available for Admin accounts, too, but it's empty except for a "Nothing to see here!" sort of message.)

Tiger introduces a lot more peace of mind for paren'ts than other operating systems. You can specify exactly who your kids are allowed to communicate with via email (if they use Mail) and instant messaging (if they use iChat), what Web sites they can visit (if they use Safari), what programs they're allowed to use, and even what words they can look up in the new Tiger Dictionary.

Here are all the ways you can keep your little Standard account holders shielded from the Internet ”and themselves . For sanity 's sake, the following discussion refers to the Standard account holder as "your child." But some of these controls ”notably those in the Finder & System category ”are equally useful for people of any age who feel overwhelmed by the Mac, are inclined to mess it up by not knowing what they're doing, or who are tempted to mess it up deliberately.

---

Note: If you use any of these options, the account type listed on the Accounts panel changes from "Standard" to "Managed."

---

12.3.1. Mail

When you turn on this checkbox, a list box appears. Here, you can build a list of email addresses, corresponding to the people you feel comfortable letting your kid exchange email with. Click the + button below the list, type the address, press Enter, lather, rinse, repeat.

---

Tip: No, you can't drag cards in from your Address Book; that would be much too simple. But after clicking the + button to create a new row in the list (in Edit mode), you can drag just the email address out of an Address Book card that you've opened up.

---

For reasons explained in a moment, turn on "Send permission emails to" and plug in your own email address.

Figure 12-6. Top: If your kid tries to contact someone who's not on the Approved list, he can either give up or click Ask Permission.
Middle: In the latter case, you'll know about it. If you're convinced that the would-be correspondent is not, in fact, a stalker, you can grant permission by clicking Always Allow.
Bottom: Your grateful young ward gets the good news the next time he visits his Drafts folder, where the would-be message has been hanging out while awaiting word from you, the Good Paren't.

Now then: When your youngster uses Apple's Mail program to send a message to someone who's not on the approved list, he gets the message shown at top in Figure 12-6. If he clicks Ask Permission, then your copy of Mail shortly receives a permission-request message (Figure 12-6, middle); meanwhile, the outgoing message gets placed in limbo in his Drafts folder.

If you add that person's address to the list of approved correspondents, then the next time your young apprentice clicks the quarantined outgoing message in his Drafts folder, the banner across the top lets him know that all is well ”and the message is OK to go out (Figure 12-6, bottom).

12.3.2. Finder & System

When you turn on this checkbox, you see the options shown in Figure 12-7. (In Mac OS X 10.3, these controls appeared on their own panel called Security.) Use these options to limit what your Standard-account flock is allowed to do. You can limit them to using certain programs, for example, or prevent them from burning DVDs, changing settings, or fiddling with your printer setups.

Figure 12-7. From the Limitations window, you can control the capabilities of any user of your system. In the lower half of the Finder &System Confi gure window, you can choose applications by turning on the boxes next to their names . (Expand the fl ippy triangles if necessary.) Those are the only programs these account holders will be allowed to use.

(Limiting what people can do to your Mac when you're not looking is a handy feature under any shared-computer circumstance. But if there's one word tattooed on its forehead, it would be "Classrooms!")

On the panel that pops up when you click Configure, you have two options: Some Limits and Simple Finder.

12.3.2.1. Some Limits

By tinkering with the checkboxes here, you can declare certain programs off-limits to this account holder, or turn off his ability to remove Dock icons, burn CDs, and so on.

You can restrict this person's access to the Mac in several different ways:

• Limit the programs . At the bottom of the dialog box shown in Figure 12-7, you see a list of all the programs in your Applications folder (an interesting read in its own right). If you turn on "This user can only use these applications," you can then turn the programs' checkboxes on or off. Only checked items will show up in the account holder's Applications folder.

  ---

  Tip: If you don't see a program listed, click the Locate button and find it, or drag its icon from the Finder into the window. You may have to do that when a program is inside a folder in the Applications folder, rather than sitting there loose as a solo icon.

  ---

  If, for instance, you're setting up an account for use in the classroom, you may want to turn off access to programs like Disk Utility, iChat, and Tomb Raider.

• Limit the features . When you first create them, Standard account holders are free to burn CDs or DVDs, modify what's on the Dock, change their passwords, and view the settings of all System Preferences panels (although they can't necessarily change all of these settings).

  Depending on your situation, you may find it useful to turn off some of these options. In a school lab, for example, you might want to turn off the ability to burn discs (to block software piracy). If you're setting up a Mac for a technophobe, you might want to turn off the ability to change the Dock (so your colleague won't accidentally lose access to his own programs and work).

---

Note: The "Allow supporting programs" checkbox means, "Let the permitted programs open up secondary programs that they rely on." For example, if you've OK'd Photoshop CS2, this checkbox would mean that this account holder can also use the Adobe Bridge utility that serves as Photoshop's fi le browser.

---

12.3.2.2. Simple Finder

If you're really concerned about somebody's ability to survive the Mac ”or the Mac's ability to survive them ”click the Simple Finder button (shown at top in Figure 12-7). Then turn on the checkboxes of the programs that person is allowed to use.

Suppose you're the lucky Mac fan who's been given a Simple Finder account. When you log in, you discover the barren world shown in Figure 12-8. There are only three menus (a, Finder, and File), a single onscreen window, no hard drive icon, and a barebones Dock. The only folders you can see are in the Dock. They include:

• My Applications . These are aliases of the applications that the administrator approved. They appear on a strange , fixed, icon view, called "pages." List and column views don't exist. You can't move these icons, delete them, or rename them. If you have too many to fit on one screen, you get numbered page buttons beneath them, which you click to move from one set to another.

• Documents .Behind the scenes, this is your Home Documents folder. Of course, as a Simple Finder kind of soul, you don't have a visible Home folder. All your stuff goes in here.

  

  Figure 12-8. The Simple Finder doesn't feel like home “unless you've got one of those Spartan, space-age, Dr. Evil “style pads. But it can be just the ticket for less skilled Mac users, with few options and a basic one click interface. Every program in the My Applications folder is actually an alias to the real program, which is safely ensconced in the off-limits Applications folder.

  
  

• Shared . This is the same Shared folder described on Section 12.6.2. It's provided so that you and other account holders can exchange documents. However, you can't open any of the folders here, only the documents.

• Trash . The Trash is here, but you won't use it much. Selecting or dragging any icon is against the rules, so you're left with no obvious means of putting anything into your Trash.

The only programs with their own icons in the Dock are Finder and Dashboard.

Otherwise, you can essentially forget everything else you've read in this book. You can't create folders, move icons, or do much of anything beyond clicking the icons that your benevolent administrator has provided. It's as though Mac OS X moved away and left you the empty house.

• To keep things extra-simple, Mac OS X permits only one window at a time to be open. It's easy to open icons, too, because one click opens it, not two.

• The File menu is stunted, offering only a Close Window command. The Finder menu only gives you two options: About Finder and Run Full Finder. (The latter command prompts you for an administrator's user name and password, and then turns back into the regular Finder ”a handy escape hatch. To return to Simple Finder, just choose Finder Return to Simple Finder.)

• The a menu is really bare-bones: You can Log Out, Force Quit, or go to Sleep. That's it.

• There's no trace of Spotlight.

Although the Simple Finder is simple, any program (at least, any that the administrator has permitted) can run from Simple Finder. A program running inside the Simple Finder still has all of its features and complexities ”only the Finder has been whittled down to its essence.

This, of course, is one of the downfalls of the Simple Finder concept. It's great for streamlining the Finder, but novices won't get far combating their techno-fear until the world presents us with Simple Keynote, Simple Mail, and Simple Microsoft Word. Still, it's better than nothing.

In any case, as shown in Figure 12-8, the available programs' icons appear, up to 12 on a "page," with page buttons and previous/next buttons at the bottom of the screen. The Simple person can't move, rename, delete, sort, or change the display of them ”merely click them.

When Simple people try to save documents, they find that although the Save box lists the usual locations (Desktop, Applications, and so on), they can in fact save files only into their own Home folders or subfolders inside them.

12.3.3. iChat

These paren'tal controls work a lot like the Mail limits described above. When you turn on the iChat checkbox, an empty list appears, which you can fill with the buddy-list names of everyone it's OK for your kid to chat with. This time, though, you do get some help from the operating system. When you click the + button to add a name, your own Address Book list pops open. You can add a name to the list by clicking it and then clicking Select Buddy. (Even though you see everyone in your address book, you're allowed to choose only people with an AIM-compatible address listed in the Instant Messaging box.)

When your underling fires up iChat, she discovers that her Buddy List is empty except for the people you've identified. If she tries to click the + button to add a buddy list, she gets only an error message.

Handling the teenage hissy fit is your problem.

12.3.4. Safari

This feature is designed to limit which Web sites your kid is allowed to visit. But you don't build the list of approved Web sites right in the dialog box, as you do with mail and chat addresses.

Instead, you're supposed to set up your kid's copy of Safari (after logging in with his account). Turn off paren'tal controls, for the moment, by choosing Safari Preferences, clicking Security, and turning off "Enable paren'tal controls." Enter your administrator's name and password.

Now set up his copy of Safari so that all of the approved sites appear on the Bookmarks bar (Section 21.1.2.1 has instructions). Everything else will be off-limits. When you're finished building the Bookmarks bar, return to Preferences and turn paren'tal controls back on.

You've just clipped your youngster's wings to the extent that he can't use the Bookmarks menu , can't type in a Web address into the address bar, can't use the Google search box, and so on.

If he tries, he'll see a message that invites him to add the desired Web site to the Bookmarks bar, thereby making it an approved site ”but he can do that only with an administrator's name and password. Put simply, your kid need to call you over to do the job, and that's your opportunity to see what he's up to.

---

Tip: Your kid is allowed to visit any Web page within the specifi ed Web site. So if you put www.nytimes.com on the Bookmarks bar, he can also visit www.nytimes.com/movies, for example. One more point: The paren'tal controls work only in Safari, iChat, and Mail. If you've got other browsers, chat programs, and email programs on the hard drive, remember to keep your kid out of them, using the application-limit controls described earlier.

---

Figure 12-9. Something's oddly missing from the Dictionary when paren'tal controlsare turned on: dirty words

POWER USERS' CLINIC
Moving Your Home Folder Between Computers

Mac OS X proposes putting all of the account holders' Home folders in one special folder (Users) on the main hard drive. But being able to put your Home folder on a different disk can have its advantages, too. If you travel back and forth between home and work, for example, you might find it convenient to keep your entire life on an iPod or some other portable disk. In corporate environments, a network administrator may want you to keep your Home folder elsewhere on the Windows network. (Yes, Mac OS X is that compatible.)

You can do it, but you'll have to exploit the some-times intimidating power of NetInfo Manager, a program included with Mac OS X that's designed to let you perform just such technical tasks .

Begin by copying your Home folder to the iPod (or wherever).

Now open NetInfo manager, which is in your Applications Utilities folder. Click the lower-left padlock, and then enter an administrator's name and password.

In the second column, click users. In the column to its right, click the name of the account whose Home folder you want to move “let's say it's chris.

In the bottom half of the window, scroll down until you see an entry called home. In the next column, you'll see its current location: /Users/chris (that is, the Home folder is called chris, and it's in the Users folder).

Double-click this notation (/Users/chris) to edit it. Change this text to /Volumes/diskname, where diskname is the name of your removable disk. ("Volumes" is the name of an invisible folder on your Mac OS X machine that lists the names of all disks present.) Press Enter, and then choose Domain Save Changes (and click "Update this copy" in the confi rmation box).

Log out and then log back in again “as chris. You should see by the house-shaped icon on your desktop that the iPod is now, in effect, your Home folder complete with all the usual Home-folder subfolders (Desktop, Document Library, and so on).

You're not allowed to remove the disk from the Mac until you've logged out and logged back in under a different account. Once you've done so remove the disk and take it to work (or wherever the other Mac OS X machine is). Insert the disk and then repeat all of these steps so far.

From now on, both Mac expect to fit your Home folder on that removable disk. (Make sure that you've inserted it and given it time to spin up before you log in. And of course, don't remove the disk while you're logged in.)

And by the way, the procedure described here leaves the original folder on the primary hard drive “an orphaned duplicate. It's not doing any harm, but if you find its presence confusing, you can always delete it by restarting your Mac in Mac OS 9 (if your Mac can do that) or using the sudo rm command in Terminal. (See Chapter 17.)

12.3.5. Dictionary

As you know from Chapter 10, Mac OS X Tiger comes with a complete electronic copy of the New Oxford American Dictionary . And "complete," in this case, means "it even has swear words."

Turning on this checkbox is like having an Insta-Censor ¢. It hides most of the naughty words from the dictionary whenever your young account holder is logged in (Figure 12-9).