Speaking as a software developer, parent, and former school teacher, it's a LOT tougher than you think. Just about any program you can think of, he can probably figure out how to subvert it if he's determined. There are even a handful of programs on the internet that you can put on CD or USB drive, reboot the computer FROM the CD, and the computer completely ignores anything you've installed on the hard drive - the whole computer runs off the CD/USB.
The only-foolproof blocker is one that sits on a different computer in the house that is set up as a gateway for all of the others; see if a computer geek friend can't set up a spare computer with a program called "Squid proxy" or "Dan's Guardian" - they can also block ads and speed up surfing.
Additionally, many Nanny programs often have too many false-positive alarms. Check with your library and local school for what THEY use.
In our house, the best "Net Nanny" is keeping the computers in the kitchen and family room. They're in full view of regular traffic patterns, and nobody visits any sites they wouldn't want anyone else to know about. If this isn't possible, then the next best chance is to set up a recording program on the computer that logs key presses, mouse clicks, and takes a picture of the screen occasionally, and let him know you're watching over things - his own self-censorship will be much better than any program. Hiding a program on the computer and then ambushing him later can really damage trust later.
BTW: Among most of my geek friends, "putting the computer in plain sight" is the favorite Nanny program of the bunch.