VI-Labs for school IT

Qualified Teachers of Vision Impairment (QTVIs) from your local VI service visit pupils in your school. During a visit they may use VI-Labs, to assess how a pupil uses their vision or to work through an activity with the pupil. They usually bring their own service’s iPad or laptop.

Many school filters inspect secure (HTTPS) traffic by replacing a website’s certificate with one of their own. Your school’s devices trust that certificate because your IT team installed it. A visitor’s device does not, so its browser refuses the connection and warns that the site may be impersonated. The same thing can stop the sign-in box from appearing. Either way, the visit loses the time it was meant for.

In order of importance:

1. Do not inspect HTTPS traffic to the addresses below. This is the change that fixes the problem for visiting staff. Most filters call it an HTTPS inspection exception or a “do not inspect” rule.
2. Allow the addresses below if your policy blocks sites it has not categorised.
3. Categorise them as Education if your filter lets you set local categories.

A wildcard rule for vi-labs.co.uk and *.vi-labs.co.uk covers every VI-Labs address, including any added later. If your filter does not accept wildcards, use the full list. All traffic uses HTTPS on port 443.

This check runs from the device you are reading on. It asks each address for a small file and reports which ones answer. Run it on a device your school does not manage, such as a phone on the guest or staff Wi-Fi, to see what a visitor sees. Visiting staff can run it when they arrive. The last line tests the live connection that training sessions use.

VI-Labs’ simulation is used to train school staff. During a live session the presenter’s screen and the audience’s phones stay connected, so the audience sees each step as the presenter moves on. That connection is long-lived (WebSockets), and filters that inspect traffic can break it even when every page loads.

If you are hosting a session: please apply the same rule before the day and run the check above on your guest or staff Wi-Fi. If the last line passes, live training will work.

If you are presenting: run the check on the venue’s Wi-Fi when you book, or ask the venue’s IT team to. Mobile data is a good fallback for you and your audience, but not every room has a signal.

• VI-Labs is a subscription service for VI services and their QTVIs, run in the UK.
• It carries no advertising, no analytics and no third-party tracking.
• Only adult staff hold accounts. Pupils never sign in.
• Activities a pupil sees run in the browser and send no information about the pupil to VI-Labs.
• Where a QTVI enters a pupil’s first name to prepare a report, the name stays in the page’s memory and is never stored or sent.

Excluding these addresses from inspection does not open a route to other websites. It applies only to the addresses listed.

A note you can send to the schools you visit, before your next visit:

Our QTVIs use VI-Labs during visits to your school, usually on our own devices. School filters that inspect secure traffic can stop it working on devices the school does not manage. The page at vi-labs.co.uk/for-schools lists the addresses involved and the change needed, which in most filters is a single “do not inspect” rule. It would help our visits if you could make that change before our next one.

Questions from school IT teams: dan@vi-labs.co.uk.