OK, these two comments sort of illustrate a couple of points that bear repeating:
> I have no use for self-styled big brothers.
Neither do I, but some types of Web sites might lose significant revenue if blocking Websense results in them rating our sites as "bad" or "dangerous" -- which is why I asked the question.
I block an awful lot of sites, user-agents, hosts, countries, and geographical regions, but if someone asks me if my methods are "the best way," I always say, "No, they might be the worst way for your site."
> This site is of no corporate interest whatsoever and I doubt that any one surfing at work will waste up to 20 minutes, while changing UA at each attempt, trying to get access.
Yes, but what if Websense is a "side-car" filter, not a serial filter? That is, serial filters work by passing all user requests through their filter. The User-agent may be the real user's UA string, or it may be a standard one injected by the filter. However, the requests always look "human" because they are indeed being driven by a person clicking links and bookmarks and typing URLs. The requests are being filtered in real-time.
On the other hand, what I'm calling side-car filters just make a list of the URLs visited by their users, and go around checking them after the fact. The actual filtering is done by another part of the software, likely a blacklist compiled from the previous "scan cycle." Maybe they don't block at all, but rather just send reports or "fire this guy" e-mails when surfing policies are violated -- I really don't know.
These side-car filters may also use real users' UA strings, or they may inject a standard one, or they may rotate through a list -- In WebSense's case, it's either the first or the last of these three methods. But because a side-car filter doesn't work in real time, it does not appear to be human, even though its list of page URLs (and possibly its list of UAs as well) was generated by recording actual human requests.
Anyway, I don't explicitly block Websense, but they get denied more often than not, because the request headers rarely correlate to the browser claimed in the UA string.
So, I've been considering "giving Websense a pass" if I ever discover a down-side to kicking them out nine times out every ten they visit...
Thanks,
Jim
