Changing date/time can bypass block / cause it to end early about selfcontrol HOT 70 OPEN

I have a rather cobbled-together solution. I ended up using a proprietary freemium blocker's free version (Cold Turkey) in tandem with SelfControl. I created a null block on Cold Turkey and turned on the option to prevent you from opening Date & Time settings during the block, which blocks nothing but prevents you from changing them. I then run a regular block on SelfControl. The same technique should also work with Focus.py, another open-source blocking tool I've been eyeing since it allows scheduling.

I might be overcomplicating things but seemed like the best way to accomplish this for free, since Apple Server costs $23 and @coolvision 's add-on doesn't seem to have been updated since 2014. Cold Turkey is proprietary, which I'm not a fan of, but at least it seems to have good policies.

from selfcontrol.

this may be solved by counting the ticks, without relying on computer timer at all

from selfcontrol.

I think it is better to improve own's self-discipline, in that regard.

Self-control do a lot of pre-work for us - relying solely on a technology for keeping us away from technology is only a temporary solution. You can always trick the system.

As for me, after some time passed, I realised that this "workaround" is actually a godsend. I had a few of those times then you REALLY NEED that blocked website. Like, REALLY NO FUCKING KIDDING NEED.

That are my options if date "bug" was not present? Find another machine, use my phone (which is partially blocked too). Anyway - getting more pain in the ass then necessary. But by changing my date, I can complete much needed task in a speedy fashion without that much of a hassle. Check.

Am I exposed to scary websites that soaking my soul (time) away? Yep. But do you know that I'm going to do then I will finish working? Just run that goddamn Selfcontrol thing again.

Guys, take that perspective. It is refreshing. May even rekindle your feelings about an app. Similar to the day you discovered Self-control for the first time... So good!

from selfcontrol.

There are other ways we considered, but they seemed more risky if anything failed. You're welcome to suggest code changes.

from selfcontrol.

There's potentially a way to fix this by saving an encrypted reference to the time. I'll look into it.

from selfcontrol.

That'd be pretty incredible!

from selfcontrol.

Could you refer to a couple of NTP servers as well as the system clock? If the system clock was ahead of, for example, two ntp servers, ignore it. If only the system is clock is available, just use that.

from selfcontrol.

towlerj might really be on to something. I wish i hadn't figured out this way to bypass SelfControl

from selfcontrol.

@towlerj that'd be a nice addition, of course it's pretty trivial to work around also (disable the network interface, move the time forward, re-enable the network interface, move the time backward) but it'd add another step to the process. Probably won't be added in the very near future though because it's not a huge priority and I'm busy.

@rillian counting the ticks sounds good in theory, but I've actually experimented that and it'd take our permablock problems to a whole new level. Just nothing quite as reliable as system time to make sure your block comes off when it's supposed to...

from selfcontrol.

cstigler - that would work round the NNTP check, BUT... if someone knows enough to disable the network interface then they probably know enough to restore the relevant file anyway. (Hmm, but disabling a network interface could just be pulling the ethernet cable / turning off WiFi. so maybe not).

However - I do get that this isn't a huge priority. Am also busy, but as someone who is learning ObjC I may be interested in attempting a patch to try this (most likely in summer - have a degree to be studying for at the moment), if i do and the code isn't too embarrassing I'll send it through. (they are both big if's though, obviously)

from selfcontrol.

@towlerj Yup, I was thinking just going up to the menu bar and choosing "Turn Wi-Fi Off," which is pretty simple. But definitely still a worthwhile improvement!

If you get to doing a patch, please send over a pull request. We attempt to read all block details from our lockfile and then from defaults, so I think the best way to handle it would be to store an offset from local to server time, then check that as we check the date and adjust if the offset has changed. We can't store only server time because we need local time as a backup...

On Feb 11, 2013, at 10:24 PM, towlerj [email protected] wrote:

cstigler - that would work round the NNTP check, BUT... if someone knows enough to disable the network interface then they probably know enough to restore the relevant file anyway. (Hmm, but disabling a network interface could just be pulling the ethernet cable / turning off WiFi. so maybe not).

However - I do get that this isn't a huge priority. Am also busy, but as someone who is learning ObjC I may be interested in attempting a patch to try this (most likely in summer - have a degree to be studying for at the moment), if i do and the code isn't too embarrassing I'll send it through. (they are both big if's though, obviously)

—
Reply to this email directly or view it on GitHub.

from selfcontrol.

Is there any way to require the user to type in their admin password multiple (say 20) times to make it a severe inconvenience to change time settings?

from selfcontrol.

@3marcusw we can't block any basic behavior of the system, such as changing the date/time settings. that's probably for the better.

from selfcontrol.

@cstigler, if you've done some work already on a ticks solution to this problem, do you think you could add the code to this repo in another branch? I'd be willing to sacrifice some reliability for a foolproof blocking solution, even though it might never be a good option for a general release.

from selfcontrol.

Can't we edit the /etc/authorization file in a text editor to prevent this?

Something like the settings in here? http://support.apple.com/kb/TA23576?viewlocale=en_US&locale=en_US

Not a change to the program of course but there might be an interim solution there

from selfcontrol.

I would like to throw my hat in the ring and note that this is a big challenge for me as well. Ignorance is bliss, I wish I'd never learned that I can simply reset self-control by changing the date and time, but now that I do, I've already started cheating myself and disabling the application. I don't know C++ or Objective-C but I'd love to help in any way that I can.

from selfcontrol.

Alternatively - has any one figured out a clever workaround?

from selfcontrol.

For anyone interested, I figured out a workaround to the Date/Time problem.

I installed the Apple Server app ($20), and the Apple Profile Manager ($3). Using these apps, you can set up an online dashboard to control which system settings are accessible to you as a user. I blocked out my Date/Time panel. Then I gave the Profile Manager password to my flatmate.

The big advantage to my Server / Profile Manager approach is that I can still use sudo and I can still act as an administrator of my MacBook Air. My Date/Time is the ONLY part of my laptop that I'm not allowed to access. This is important to me since I am a developer.

Obsessive, I know. If anyone else is as obsessed as me about being able to step away from the internet from time to time, they might appreciate this solution to the Date/Time problem.

from selfcontrol.

Thanks for that. Not sure I want to shell out $23 bucks for a solution at this point, but it's good to know there's an option out there.

from selfcontrol.

@dpmccabe You're very welcome.

from selfcontrol.

Could anyone write a guide on how to do the setup Henryvw mentions above? I purchased both programs but was unable to figure it out. I'm not too computer savvy, but also not illiterate. If anyone is able to do so, many thanks.

from selfcontrol.

@Henryvw Perhaps you could help me if it isn't too complicated? I'd love to be able to avoid the Date/Time problem but I don't understand how to do so with those programs (see my message above).

from selfcontrol.

@cstigler It seems like this could be easily fixed to just ask internet for the time, if there is no internet available, it should just keep blocking.

from selfcontrol.

@kasperpeulen I don't think you appreciate how often things go wrong with networking for all sorts of reasons... the website we ask for time goes down, or some other installed app ends up blocking that website, or we accidentally block it with a rule meant to block somewhere else. We will never have a rule that says "if we don't know what's going on, keep blocking". Well, maybe as an optional thing, but definitely not the default.

from selfcontrol.

You'd probably need a multiplicity of available time servers in order to make it work. Maybe there are even time servers that are available over protocols other than HTTP?

As far as other things that might go wrong...on one hand, if the internet is unavailable, there's no harm in blocking websites as long as you don't inadvertently block your DHCP server or something. It seems that blocking based on DNS wouldn't have any nasty side effects like that, correct?

from selfcontrol.

There is a protocol specifically for delivering times, NTP. And yes, DNS blocking avoids lots of nasty side-effects, but by default we don't do that -- we do full IP-based blocking, otherwise we couldn't do things like whitelists.

from selfcontrol.

pff, I got this solution from @Henryvw working. But now the self controll app doesn't work for me anymore It runs, already for 45 min. but I can go to any website that I want...

from selfcontrol.

Interesting and thanks for sharing. I have my little solution running now, and self-control, and the blacklist is successfully blocked on my machine. (And I am blocked from changing the time).

Are you using the whitelist? The whitelist function hasn't worked for me since updating to Mavericks (with or without apple server, profile manager, etc.)

from selfcontrol.

Oh I've also done an osx update as that was required to install the apple
sever, that may explain it. Quite sad though, will try the blacklist
function now, I'm glad that I didn't set self controll for a week (what I
was planning, otherwise, I wouldn't be able to change self controll for a
week).

2014-09-25 20:20 GMT+02:00 Henry van Wagenberg [email protected]:

Interesting. I have my solution running now, and self-control, and the
blacklist is successfully blocked on my machine. (And I am blocked from
changing the time).

Are you using the whitelist? The whitelist function hasn't worked for me
since updating to Mavericks (with or without apple server, profile manager,
etc.)

—
Reply to this email directly or view it on GitHub
#28 (comment).

Kasper

from selfcontrol.

@Henryvw @kasperpeulen If you're having issues with the whitelist functionality, please try this new alpha version: http://downloads.selfcontrolapp.com/SelfControl_1.5.2alpha6.zip

Let me know if it's still not working with that version...

from selfcontrol.

The whitelist function in the new Alpha version works for me in Mavericks!
Thanks kindly. Henry

On Sun, Sep 28, 2014 at 1:58 AM, Charlie Stigler [email protected]
wrote:

@Henryvw https://github.com/Henryvw @kasperpeulen
https://github.com/kasperpeulen If you're having issues with the
whitelist functionality, please try this new alpha version:
http://downloads.selfcontrolapp.com/SelfControl_1.5.2alpha6.zip

Let me know if it's still not working with that version...

—
Reply to this email directly or view it on GitHub
#28 (comment).

+49 015251570719 {mobile}
RMSAHenry {Skype}

from selfcontrol.

I made a version that tries to solve this issue: it uses time queried from the internet, instead of system time.
https://github.com/coolvision/selfcontrol/tree/time_check
https://github.com/coolvision/selfcontrol/blob/time_check/SelfControl.app.zip

Each 10 seconds time is queried with http request to http://google.com/ (using code from https://github.com/freak4pc/NSDate-ServerDate)

Use at your own risk, it might cause permanent blocking!

I'm currently using (testing) it. There are a few issues:

• obviously, google.com should not be blocked (not in the block list, or in the white list), there is no check for that now
• if there is no internet access, blocking will not start (no warnings shown)
• and will not stop (but will stop if internet access appears and blocking time has expired)
• when the system time is ahead of checked time, negative time value can be displayed (I think it's good because it prompts you to stop meddling with the time settings :)

I will continue testing it, and it there are no problems, might try to add it as an option to the main version.

from selfcontrol.

Thank you for writing code instead of just demanding features. It's refreshing.

On Oct 9, 2014, at 8:53 AM, coolvision [email protected] wrote:

I made a version that tries to solve this issue: it uses time queried from the internet, instead of system time.
https://github.com/coolvision/selfcontrol/tree/time_check
https://github.com/coolvision/selfcontrol/blob/time_check/SelfControl.app.zip

Each 10 seconds time is queried with http request to http://google.com/ (using code from https://github.com/freak4pc/NSDate-ServerDate)

Use at your own risk, it might cause permanent blocking!

I'm currently using (testing) it. There are a few issues:

if there is no internet access, blocking will not start (no warnings shown)
and will not stop (but will stop if internet access appears and blocking time has expired)
when the system time is ahead of checked time, negative time value can be displayed (I think it's good because it prompts you to stop meddling with the time settings :)
I will continue testing it, and it there are no problems, might try to add it as an option to the main version.

—
Reply to this email directly or view it on GitHub.

from selfcontrol.

That's awesome. Thanks! I will try it out

On Thu, Oct 9, 2014 at 1:54 PM, coolvision [email protected]
wrote:

I made a version that tries to solve this issue: it uses time queried from the internet, instead of system time.
https://github.com/coolvision/selfcontrol/tree/time_check
https://github.com/coolvision/selfcontrol/blob/time_check/SelfControl.app.zip
Each 10 seconds time is queried with http request to http://google.com/ (using code from https://github.com/freak4pc/NSDate-ServerDate)
Use at your own risk, it might cause permanent blocking!
I'm currently using (testing) it. There are a few issues:

• if there is no internet access, blocking will not start (no warnings shown)
• and will not stop (but will stop if internet access appears and blocking time has expired)

• when the system time is ahead of checked time, negative time value can be displayed (I think it's good because it prompts you to stop meddling with the time settings :)
  I will continue testing it, and it there are no problems, might try to add it as an option to the main version.

  Reply to this email directly or view it on GitHub:
  #28 (comment)

from selfcontrol.

Yes, @coolvision it's great that you went and actually did it! A few suggestions: 1) might try using a server other than Google since I think people do block it sometimes, 2) displaying negative times is neat but in the latest versions we take that as a sign we need emergency block removal -- so might be better to just display the actual time remaining.

If this gets cleaned up and pretty much just works I think we could definitely put this in as a option (although would have to be off by default, just because it increases the possibilities for badness).

from selfcontrol.

Thank you @coolvision for your effort! Since changing the time is too easy it completely rendered SelfControl useless for me. Until your patch came along. This should be integrated into SelfControl directly.

from selfcontrol.

@cstigler Does this problem solved in SelfControl 2.0?

from selfcontrol.

@coolvision Can you change the code to send http request to time.apple.com. instead?
Someone may just block the google.

from selfcontrol.

@cstigler @coolvision Dear Sir, I just make a change in the code by myself
https://github.com/AveMaleficum/selfcontrol/tree/time_check
I change the code
#define _SD_SERVER @“http://google.com/"
to
#define _SD_SERVER @"http://time.apple.com/"

Am I using the right code?
If so, how can I make my version of SelfControl to an APP? How can I do it?

from selfcontrol.

@AveMaleficum yes, this is the correct place for change.
But there is a problem with using time.apple.com. it looks like a time server (using NTP protocol).
I used HTTP for getting time, so time.apple.com will not work, because it returns NTP responses, not HTTP.
http://en.wikipedia.org/wiki/Network_Time_Protocol
http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol

It should be some normal web page, for the time querying code to work, like http://www.apple.com/.
I made a build that uses www.apple.com: https://www.dropbox.com/s/riwi2eblw4e5b3l/apple_time_SelfControl.app.zip?dl=0

you can use XCode to build the app. cocoapods (http://cocoapods.org/) has to be used to generate a project workspace first.

from selfcontrol.

@coolvision Dear Sir, I open SelfControl of this apple_time version, and it sends request to
a-23-216-91-43.deploy.static.akamaitechnologies.com
And in Private Eye, I can see that it just send the request to website once...I don't know what's wrong, shouldn't

1. send request to www.apple.com
2. send every request 10 seconds?

update:
I get it now.
because I open two SelfControl at once,and then it send request to www.google.com.hk.
Well, that's my guess.

I will check if this new apple_time version works after the time expires...

from selfcontrol.

@coolvision I am really sorry about that, and I know this is very rude.
Would you mind build a version of SelfControl that use www.microsoft.com?
I don't know why, but it seems that www.apple.com does not work for me.

I am really sorry for the inconvenience, and I know this is very rude to ask such request.

from selfcontrol.

@AveMaleficum not sure about this strange connections that selfcontrol makes
as you can see on privateeye screenshot, at http://radiosilenceapp.com/private-eye, itunes also makes requests to this akamaitechnologies domain, so it's probably some apple updating service.

made a build for www.microsoft.com:
#define _SD_SERVER @"http://www.microsoft.com/"
https://www.dropbox.com/s/rldxiykfo3q2hvx/microsoft_time_SelfControl.app.zip?dl=0

i probably should make it a configurable setting, but the thing that's stopping me is a total lack of objective-c knowledge )

from selfcontrol.

@coolvision thanks for doing this, works great! It appears they haven't implemented this in the newest version yet? If no one else has plans to, I'll clean your patch up and make it configurable so that it can be included in release.

from selfcontrol.

@landoncope
I did not add it to the current version because I'm using OSX 10.9, and don't have a way to test it on 10.10. Don't think I should patch SelfControl 2.0 without testing in 10.10, so if you would be able to do that, it would be cool!

from selfcontrol.

I'm running OSX 10.6. I downloaded the zip file of the updated app from this thread, but the new version of SelfControl wouldn't open. I got an error message:
"SelfControl cannot be opened because of a problem.Check with the developer to make sure SelfControl works with this version of Mac OS X...."

I clicked on details & it said:
"
Dyld Error Message:
Symbol not found: _kSecDigestSHA1
Referenced from: /Users/aaaa/Downloads/SelfControl.app/Contents/MacOS/../Frameworks/Sparkle.framework/Versions/A/Sparkle
Expected in: /System/Library/Frameworks/Security.framework/Versions/A/Security
in /Users/aaaa/Downloads/SelfControl.app/Contents/MacOS/../Frameworks/Sparkle.framework/Versions/A/Sparkle

I tried two of coolvision's links:

https://www.dropbox.com/s/riwi2eblw4e5b3l/apple_time_SelfControl.app.zip?dl=0
&
https://www.dropbox.com/s/rldxiykfo3q2hvx/microsoft_time_SelfControl.app.zip?dl=0

Am I doing something wrong?

from selfcontrol.

@step11 The latest version of SelfControl is compatible with OS X 10.7 and above. For older OS versions, you can use version 1.5.1: http://downloads.selfcontrolapp.com/SelfControl-1.5.1.zip

from selfcontrol.

Thanks for that cstigler. I downloaded that version (1.5.1) from your link, but it still has the loophole of the date/time workaround. Is there a version that I can download that prevents the work around? (and is also compatible with OSX 10.6?). Or is there a way I can modify the 1.5.1 version of the app myself to prevent the work around? Thanks for your time!

from selfcontrol.

@step11 All official versions currently can be worked around by changing
date/time. I haven't evaluated or tested the patch in this thread and can't
recommend anything regarding that.

@coolvision @landoncope I haven't looked at the specifics, but great job
making changes that people really want! I would welcome seeing this as a
cleaned-up PR so the broader SC userbase could take advantage of it as well

On Mon, Aug 31, 2015 at 1:01 PM step11 [email protected] wrote:

Thanks for that cstigler. I downloaded that version (1.5.1) from your
link, but it still has the loophole of the date/time workaround. Is there a
version that I can download that prevents the work around? (and is also
compatible with OSX 10.6?). Or is there a way I can modify the 1.5.1
version of the app myself to prevent the work around? Thanks for your time!

—
Reply to this email directly or view it on GitHub
#28 (comment)
.

from selfcontrol.

@coolvision - is the version you made only compatible with OSX 10.7 & later? I tried downloading it but it wouldn't run on my computer (which is running OSX10.6).

from selfcontrol.

@step11 I use @coolvision's Version 1.5.2a8 (1.5.2 alpha 8) and it's working fine apart from the bugs stated in the documentation on Mac OS X Yosemite Version 10.10.5 (14F27).

Hope that helps. Also thanks and props to @coolvision for adding this feature. Hope to see something like it in the official version one day.

from selfcontrol.

@yolotariat - Thanks for the reply! I downloaded that same version (1.5.2a8) by @coolvision, but when I try to open it I get the error message that I posted earlier in this thread ("SelfControl cannot be opened because of a problem.Check with the developer to make sure SelfControl works with this version of Mac OS X...."). You are running 10.10.5? I'm on a much earlier version (10.6), and so I was wondering if @coolvision's build was compatible with earlier forms of OSX.

from selfcontrol.

Sorry to chime in without any code. I am an academic, not a coder. But I signed up to github just to urge the inclusion of a fix to this. Not being able to easily suspend a block really is the point of this wonderful software.
Any idea when a fix could be included in the main version? My heartfelt gratitude to the authors of SelfControl (a owe a whole thesis to it!), and I hope a fix comes soon to restore some peace of mind to us serial procrastinators.

from selfcontrol.

@koenige50 @coolvision app worked for me pretty well. However if you're willing to fork out the dough and cant get @coolvision app set up for whatever reason (it worked for me and I am on Yosemite 10.10.5) there is another solution at https://heyfocus.com/ that looks pretty stable. I know being distracted is a pretty serious issue for me so if coolvision's app ever goes out of date ill head over to heyfocus.

from selfcontrol.

@koenige50 scratch that heyfocus.com has the same bug, glad i didnt purchase it

from selfcontrol.

@ryyanj I tried @coolvision 's app on os x El Capitan but it doesn't fully work.
What works: if you tamper with the system clock the timer goes to negative numbers and you still can't access the net.
What doesn't work: the block seems to be intermittent, for about a minute you can connect to the net, then you can't, then you can, then you can't, successively until the end. And at the end when the timer reaches zero it doesn't go away but goes on counting into negative time. At that point, I could only make the timer go away by opening the official SelfControl 2.0.2 and manually unblocking.

from selfcontrol.

Apologies not much to add, but just saying I would happily pay up to $60 for someone to implement this in the new version, have it work with whitelists in os 10.11.
Help me Obi-Wan-Kenobi you're my only help.

from selfcontrol.

@yolotariat make a bounty: https://www.bountysource.com/issues/1212872-works-with-easy-workaround-possible-to-change

from selfcontrol.

I will also happily offer a bounty to resolve this issue of changing clock time to override self-control! It would be so good if this could be resolved.

from selfcontrol.

I tried cool vision's app but it wasn't clear, at least to someone like me with no expertise in computing, that I had to double click and open a new version of self-control from within the folder on cool vision's page. It then gave me the option to manually override the block so not sure what the point of it is! I changed date/time a few times and it eventually overrode self control so not sure it is effective, perhaps I am doing something wrong? I am using yosemite

from selfcontrol.

I have just sent a 100$ bounty payment. Is this something that might get fixed in the near future Steve?

from selfcontrol.

Hey added the $60 bounty (my local currency). Here's hoping!

from selfcontrol.

Hey So I downloaded and am currently using the version on self control that uses microsoft.com for a time and date reference and it works great. My macbook pro is running OSX sierra 10.12.3. I have been running a bunch of tests to see if I can fool the program so I did the usual, I changed the date, no luck, I changed the date and I shut off the wifi and the timer displayed negative numbers which is great since I cant bypass it that way; however, there is still one method of bypassing the program that I believe should be very easy to fix but since I don't know how to program (I use to a long time ago) I am not sure how to do it myself. If I access my hosts file and I put a # sign in front of the blocked website that the self control app added to my hosts file and then I save the document and replace the old version of the file then I can access those sites without a problem. To remedy this problem, I believe the self control app needs to run a check to see if there is a # sign in front of the websites that it is trying to block and if there is it needs to duplicate that block and add it in so no matter how many times you add a # sign on the new block a new one will just pop back up until the timer runs out. Please let me know if this is something that can be done, thank you all for your help you have been great!

from selfcontrol.

For anyone interested, I figured out a workaround to the Date/Time problem.

I installed the Apple Server app ($20), and the Apple Profile Manager ($3). Using these apps, you can set up an online dashboard to control which system settings are accessible to you as a user. I blocked out my Date/Time panel. Then I gave the Profile Manager password to my flatmate.

Thanks a lot! I've used the same approach and it really works for me too :) Nowadays, you don't have to pay for Profile Manager cause it's included in a bundle right now. IDK about setting Profile Manager login because it uses my administrator account. Investigating further. At least, there is an additional step between me and distractions :)

from selfcontrol.

Still here 4 years later. Added some more $ to the bounty! The total is now $263. If anyone else feels like shipping a few bucks and getting the total up to $300.

from selfcontrol.

Any progress on this?

from selfcontrol.

Hello selfcontrol fam, I notice this issue is still open. And the bounty has yet to inspire a fix. I'll be withdrawing my bounty at the end of the week and unfortunately putting the funds into a SaaS proprietory solution. Which is a bummer because I prefer open solutions.

from selfcontrol.

@yolotariat all for open-source also when possible, but glad you found a SaaS solution that works for you!

from selfcontrol.

Cold Turkey is also a good blocker for those of us who uses Opera VPN or even Virtual Machines (I did) to bypass Self-control (ahh, monkey brain is insidious :) )

from selfcontrol.

Is there a solution to this issue?

An app called Focus for Mac can block apps including System Preferences, which makes it impossible to change the time.

Is this a solution?

from selfcontrol.