This idea just came to mind. Do you guys think something like this would work?
As far as your original question goes, I don't know of anything off the top of my head, but you could always get a sort of parental guardian box the plugs in between your router and your internet connection. Those usually have a block by site function built into them, as well as password protecting certain sites (you know, if you want to bypass your own security to get to HN or whatever).
Unfortunately, in most cases it is not simply employee laziness that drives people to waste time online, but a dull, non-challenging task which could be completed in an hour or two if it did not mean simply receiving additional work with no real benefit. In other words, I feel like the situations where it would be necessary would almost always be the same situations where the employee is actually acting rationally.
Of course if your employees are visiting these sites out of sheer boredom, then there's another issue taking place. If the management (don't know how large this company is) is good enough, they could watch the trends in their employee's surfing and turn it into a time to learn why they're spending so much time on non-work related sites, and hopefully provide them with more meaningful and efficient work.
Oh, it looks like Dave (name picked at random) is the winner with 12 entire hours! Way to go, Dave!
Still, I thought it was an interesting alternative to actual site-blocking.
Then use iptables to do a transparent redirect of all outbound web traffic to you squid server:
http://www.squid-cache.org/mail-archive/squid-users/200404/0...
This way you can actually have your employees end up a page of your design that says "Quit wastin' time foo'" whenever they hit a site you've placed on the block list. Mr. T. is optional of course.
The point of installing blocking software is so you can fire people that circumvent it and go to facebook without your explicit, written permission?