Astaro now blocks Ultrasurf with version 7.4. The need and difficulty of this task for schools are so great that Astaro issued a press release to announce the new feature.

Apparently they are doing this using SSL inspection (outbound SSL proxy) as opposed to using application signatures. Outbound SSL proxies introduce a new range of hassles. It would be better if they could detect the application (ahem) and block it that way:

The new filtering engine of Astaro’s version 7.4 also…