History on the Firewalla

Status: built and in its trial run. History Sync sends to both the Firewalla and iCloud Drive until the Firewalla path has proved itself.

History Sync on the child’s Mac sends its CSVs to a small service on the Firewalla, beside the URL filter. The Firewalla keeps a rolling window of recent history, which any parent’s viewer can read. One parent Mac is the archive: its viewer keeps every file for good, and the Firewalla deletes old files only once the archive holds them.

Why

• The child can’t delete or edit the record. In iCloud, the CSVs sit in a folder the child’s Mac writes to. The service only appends, and nothing the child holds can rewrite or delete what it has.
• The child can’t see it. The iCloud folder is visible from the child’s Mac, along with anything else put there.
• No iCloud quirks: no sync lag, no “dataless” files to download before reading.
• One place: browser history beside the filter’s own log.

Size

Roughly 100 MB a year, including Chrome. The Firewalla has a few GB free.

How it works

Files use the same layout as the iCloud folder, so neither the viewer’s reader nor History Sync’s writer had to change.

Sending: append by offset. History Sync writes to a local outbox and sends each file’s new bytes with the offset they start at. The service accepts them only if that offset is exactly the size it has. Otherwise it answers with its size, and History Sync carries on from there. A retry after a timeout can’t duplicate rows, and a file edited on the child’s Mac can’t change what’s stored. Off the VPN, sends fail and wait, and the outbox catches up later.

Reading. Every viewer keeps a local copy and reads that, so it works the same as reading iCloud. A viewer fetches only the bytes that are new.

The archive. The archive Mac’s viewer never deletes its copy, and reports each file’s size and checksum. The service deletes a day file only when it’s older than the window and the archive holds exactly that file.

Tokens are per role: write (bound to one device’s folder), read and archive. A write token can only append to its own device’s files; it can’t read or remove anything. A per-device cap protects the Firewalla’s disk. See History service.

The changeover

1. The service, installed and tested on the Firewalla. Done.
2. History Sync 1.1, sending to the outbox, installed on the child’s Mac with the updated lock profile.
3. The viewer’s Firewalla source, and the archive on one Mac. Done.
4. Two weeks of both, with a script comparing the Firewalla’s files with iCloud’s.
5. If nothing is missing, stop the iCloud push.

Source: ideas/history-on-firewalla.md