I will never be compelled to implement this, and would never merge it.
Every release requires quorum signatures by an international maintainer team, and the distro is designed to work offline-first, with some variants not even supporting network drivers in the kernel, so Illinois legislators can eat shit.
RedHat/IBM does have an Illinois presence so will likely be compelled to add it to their distro, and will likely do it through systemd. So to avoid it getting into any consumer distro you'd have to ship a patch to remove it from systemd.
This is probably all completely irrelevant to StageX since it's a distro designed to be used in containers, AFAICT.
It was not. It was implemented by Dylan Taylor, an outside contributor who works at a fintech company in North Carolina, and has made it his hobby to submit PRs implementing age verification to all kinds of projects. The systemd maintainer who clicked "merge" (Luca Boccassi) does work at Microsoft.
how would it work in the age of everything virtual, from containers to VMs, even an OS instance running in a browser, with OS/kernels being spanned in sub-seconds and existing even for just one call with no user interaction. Are they going to inherit age bracket from supervisor/parent process? Which of course wouldn't work for AWS/GCP, and many other cases. It looks to me like it would require something similar to security labels implementation.
> "Internet-enabled device" means a smartphone, tablet, or
personal laptop or desktop computer that provides cellular or wireless connectivity, is capable of connecting to the
Internet, runs an operating system, and is capable of
downloading and running applications.
Enumerate all network interfaces. Are any of them cellular or wireless? No? Then the law doesn’t apply.
I am in the USA, but I literally cannot comply because by design it is not possible for me to ship changes without the international maintainer team agreeing to them. And Illinois legislators have no power over them.
Also, we are not a company. We are an independent community owned project. Our code is free speech and I will burn the world down to defend that right.
Truly I dare someone to try to take me to court over this. Would be great publicity for our coercion resistant approach.
They might as well try to mandate code changes to a blockchain and mandate the whole world host them.
There are a lot of remedies available to a court with respect to a recalcitrant party, ranging from an injunction to remove your product from the market to fines and imprisonment. Again, speak with your attorney. Do not try to "hack the law" yourself; many who have tried have regretted it later.
No need to hack the law. Our FOSS code is constitutionally protected free speech and I would defend on those grounds.
The technical design of the project just makes it so no one can force changes on the distro unwanted by the maintainer team regardless of any courtroom outcomes.
Like, what if someone made a law that said Bitcoin nodes must KYC? They could make the law I guess, and the international network operators would just laugh at it.
> Our FOSS code is constitutionally protected free speech and I would defend on those grounds.
You have precisely zero additional speech rights as a FOSS project than any other organization has. If "free speech" was a valid defense for you, then Meta would be doing the same.
> The technical design of the project just makes it so no one can force changes on the distro unwanted by the maintainer team regardless of any courtroom outcomes.
Being unable to comply is not a valid legal defense.
> Like, what if someone made a law that said Bitcoin nodes must KYC? They could make the law I guess, and the international network operators would just laugh at it.
This is the law in various places under various mechanisms. It is handled by putting people in prison or taking people's assets.
Okay well if they want to jail me for being unable to comply with violating the privacy of the users of the Linux distro I work on it. Cool, I guess.
They would sure be wasting a lot of resources and public goodwill with absolutely no positive outcome for their agenda. Which is why I do not think it will actually happen.
But if it does, it does. Not going to live my life in fear, I have more security and privacy tools to ship :)
Oh, we will be supporting desktop/ubuntu style use cases soon. Position will remain the same though. And, agreed, they will still ignore us. But sick of seeing bigger projects cave to this nonsense.
But, none of this was about protecting kids. It never was.
Unless the PGP decision has been overturned, code as free speech is in fact a valid defense. If the government couldn't stop code they claimed were "munitions" from getting distributed, then it seems unlikely that they'll stop a Linux distro.
Corporations do whatever seems most profitable. We can't base our understanding of constitutional rights on whether Meta decides to defend them.
Maybe try google before making statements like that. The decision was Bernstein vs. US.
Prior to that, export controls prevented PGP source code from being exported from the US. Advocates printed it in books and exported those, which helped clarify the issue.
Bernstein was a math student who made his own encryption software. The government tried to make him register as an arms dealer, and he sued in 1996, with the backing of the EFF. The result was a landmark decision that established source code as free speech and basically destroyed export controls on cryptography.
In 2016, Apple cited the decision when the government tried to hack a suspect's phone, saying they couldn't be compelled to "speak" by writing code.
It is you who needs to do your research. That was not PGP. The Bernstein case was about Snuffle.
In that very same case, the Ninth Circuit Court of Appeals said:
"We emphasize the narrowness of our First Amendment
holding. We do not hold that all software is expressive. Much of it surely is not. Nor need we resolve whether the challenged regulations constitute content-based restrictions, subject to the strictest constitutional scrutiny, or whether they are, instead, content-neutral restrictions meriting less exacting scrutiny. We hold merely that because the prepublication licensing regime challenged here applies directly to scientific expression, vests boundless discretion in government officials, and lacks adequate procedural safeguards, it constitutes an impermissible prior restraint on speech."
Yes, I mentioned that Bernstein made his own software. But that was in the context of a huge public controversy over encryption regulations, mostly focused on PGP, and after the Bernstein decision, the Clinton administration eased up on export restrictions and moved them to the Commerce department. Junger vs Daley strengthened the Bernstein decision, ruling that all source code is protected speech.
Yes, Junger v. Daley held that source code is speech for the purpose of First Amendment analysis in the Sixth Circuit. (The question has not yet been presented to the Supreme Court.)
But the inquiry doesn't stop there. First Amendment jurisprudence doesn't stop at asking the question "is this speech?". That's just a threshold question. If the answer is "no," then the case is analyzed one way. If the answer is "yes," then the case analyzed a different way. Think of it like a decision step in a flowchart.
Code being treated as speech doesn't automatically mean that software developers can do whatever they want, just like it doesn't mean that people who write, draw, make music, etc. can do whatever they want. It's not the magic unassailable defense you claim it to be. Courts will apply a balancing test to determine whether the Government's interest in prohibiting the speech outweighs the Constitutional interest in protecting it. The answer comes out different ways depending on the facts and the law, which is complicated.
For example, it's unlawful to make and distribute CSAM. It's unlawful to defame someone. It's unlawful to defraud someone. It's unlawful to violate others' copyrights. You have to label food and medicine a certain way. These are all forms of speech, but the courts have held that none of these restrictions (or requirements) violate the First Amendment. And I don't think we'd all be cheering someone on and claiming "code is speech" for someone who writes ransomware or software whose sole purpose is to drain your bank accounts or shut down power plants.
I didn't claim it's a magic unassailable defense. I claimed, contrary to the previous comment, that it's a valid defense. Maybe the courts will carve out a new exception for some particular type of code, maybe they won't, but what they certainly won't do is laugh at you for defending your code on free speech grounds. Just because a legislature passes a law doesn't mean the courts will agree that the law is valid under the Constitution.
And the bar for compelling any particular speech is generally quite high. Apple could not be compelled to put a backdoor in an iPhone, even though the suspect was the San Bernardino shooter, and this did not result in Apple losing their ability to sell iPhones. The courts may well hold that you can't compel a Linux distro to implement a particular feature either.
This may be a matter of semantics. To me, a “valid defense” is a defense that always prevails—for example, that truth is a defense to a defamation claim in U.S. law. The rest, I call “possible defenses.”
Another possible definition, one you may have meant, is that there's a set of "invalid defenses" that could not possibly work, and the remainder are "valid" even if they might not prevail.
If there's a law that says "Anyone who distributes X must also Y" and you can't figure out a way to continue distributing X while also doing Y, the way you comply with the law is that you stop distributing X.
A file hosted on foreign server might functionally be a system to "distribute" that file, but it is doubtful if a US state could prevent it from existing.
They could theoretically order US ISP's to cease providing access to said file, but that's a rabbit hole I'm not sure that Illinois or any other state really wants to go down.
Yes, most any law is primary enforced against people within the same legal jurisdiction. It matters less where the server is and more where the relevant people/organizations/assets are.
Major OS providers, including major Linux distributions, are all within reasonable reach of Illinois law.
It’s probably less relevant if you’re a hobbyist working on Hannah Montana Linux on the other side of the planet.
None of this answers the question: even if @Irvick stops distributing or participating in any way with this "stagex" distro, that "stagex" distro continues its life outside of the jurisdiction, at most you start treating it like contraband drugs within your jurisdiction.
With LLM's anyone will be able to disengage such "default wars" in popular software, so there isn't really any border control when LLM's form a large surface area of the border.
If anyone is distributing it within Illinois jurisdiction (or maybe even distributing it elsewhere while maintaining a business presence in Illinois), they could be at risk of qualifying as an operating system provider under Illinois law.
How does that work with data on a server outside of the jurisdiction, that’s freely available to download and re-upload? The ‘local legal presence’ thing might work, but then what if they only distribute it on (say) a thumb drive, sent outside the jurisdiction, which is then uploaded by a third party? This whole thing seems unenforceable (or worse, arbitrarily enforceable).
A court will care about what you do in the jurisdictions where it has power over you. What anyone else does is their problem, not yours.
Some oddball Linux distro really has no relevance to the larger picture that lawmakers are trying to accomplish though. The vast majority of kids are using iphone/android/mac/chromebook/windows. Basically zero are using esoteric container images to access TikTok.
But wouldn't this type of law drive youth to using more exotic distributions to get around the issue? It's not far fetched to think that kids will just live boot from tails or another distro to visit socials and circumvent this rule. Plus with unlocked pixel bootloaders it would be trivial for them to petition their parents for a pixel, hard reset it, unlock the bootloader, install grapheneos via the web installer, and then be on their way. If parents don't know how to monitor their kids I doubt they'll notice grapheneos not being base android.
Same way anything else gets pulled from distribution. You shut down the servers, destroy keys, remove files, etc. Sure, the files may remain in circulation from unofficial sources, but that's not your problem, as long as you're no longer facilitating it.
> If "free speech" was a valid defense for you, then Meta would be doing the same.
Meta lobbied heavily for this. The fact that they have not decided to use free speech to fight the move that they are lobbying for is not an argument that free speech is irrelevant here.
This is not legal advice but a personal request: please do not get your legal advice from Hacker News. Get it from a lawyer.
> If "free speech" was a valid defense to any legal compliance laws that affect software, then any software company would raise this defense this rather than comply.
And in fact, Apple in 2016 went to court rather than comply with the government's order to put a backdoor in the iPhone, and they argued their case in part on free speech grounds.
Whether other companies do the same depends on what they consider the most profitable path, including legal fees and risk.
Don’t read too much into the Apple case. There was no precedent set by that. The FBI withdrew their demands after they found a different mechanism to obtain what they needed.
The concern here is probably with the shipping of the product (i.e. the binary artifacts), not the code itself. I can imagine a situation in which you could continue to make the code available, but could not produce a shippable artifact from it that Illinoians could access.
If they are successful at doing so, then those distribution methods were too brittle.
I expect in response one of the maintainers outside US jurisdiction of their own volition publishes via bittorrent, tor hidden services, and embedding blobs in public blockchains with no help from me.
Then the problem the legislators sought to solve just got a lot worse, while calling a lot of attention to how little power they actually have to control decentralized FOSS software projects.
Of course another point of the project is building the entire thing from source code with deterministic results only takes a few hours. For many, this would be faster than downloading artifacts.
It is not needed for maintainers to publish binaries at all. Publishing signatures on the expected hashes would suffice at worst.
The person you replied to is using "could"/"could not" to mean "would comply with the law"/"would not comply with the law"
Nobody here is saying that anyone is going to swoop in and physically prevent this software from being distributed on the internet.
> Then the problem the legislators sought to solve just got a lot worse, while calling a lot of attention to how little power they actually have to control decentralized FOSS software projects.
The legislators who passed this don't give a shit about that. Their intended target of this legislation is mainstream devices and mainstream users.
Major distros will comply because they want to sell their services in Illinois.
I don’t think noncompliance of a container image is much of a “fuck you” since I don’t think lawmakers have ever heard of you nor would they really care about your compliance anyway.
This bill is primarily about kids using smartphones.
Anyway. Kids are an excuse to get it passed. It is about testing the waters of how much control can be exerted by government on end user devices, and we need all maintainers to hold the line.
Technical solutions may be seen as kindly as handcuffing yourself to something when told to leave. "I can't, I've made it impossible for myself to obey the law".
They might not be able to break your private keys, but they can fine you or jail you for not complying.
I could, at worst, resign from the project. International maintainers would carry on the work, but I will never be compelled to write code I do not wish to write.
I could probably play games like this, but I outright do not believe this law is constitutionally valid, and believe it must be challenged by anyone they try to wield it against.
I would refuse to even give the appearance of compliance in hope to motivate others to do the same.
> Again, speak with your attorney. Do not try to "hack the law" yourself; many who have tried have regretted it later.
Also reach out to the EFF, who may be able to help/advise, especially if you genuinely want to fight this.
This is a terrible law. That doesn't mean it's not a law, and courts do not look kindly on people subject to their jurisdiction (which unfortunately often includes state laws to people in other states) who try to dodge the responsibility the court thinks they should have.
With all due respect I sense that you might be neglecting the big picture. Unjust laws, slopped out illegal orders and an extreme activist court are all in play.
Those are valid opinions. However, I also see a lot of bluster here about going to prison for their beliefs from people who wouldn't last a minute behind bars.
People used to have to die in masses for freedoms in this country. If the worst thing one could face for defending freedoms is some jail time until bail gets posted while the law determines their innocence then anyone who caves to pressure anyway is a complete coward.
And, since you seem to be making assumptions about what people you know nothing about could or could not hypothetically handle, maybe look a bit closer at my history. I have survived WAY harder shit than sitting in an air conditioned box with 3 squares a day for doing what I thought was right, so even if the threat of jail was credible, it would not deter me.
It is the bluster of people that think I even could be jailed for something like this that I am most amused by.
Truly it is fascinating and a bit sad how much fear there is in this thread over upsetting some state level officials.
Given your comment history, I suspect that you are sympathetic to these laws and you’re trying to prevent people from opposing them, using your “friendly advice” as cover.
Believe it or not, there are plenty of people in the US willing to go to jail (or worse) for their beliefs. It’s kind of the founding mythology of the nation.
US history is full of people who successfully challenged violations of their rights and government overreach. Success isn’t guaranteed, sure. It never is. But cowering in fear because the tyrants might put you behind bars is downright un-American.
Not at all! I think these laws are dumb and I don't want my state to pass one.
But when I play, I play to win. Openly thumbing one's nose at the courts and the state is rarely a winning strategy. The way to win is through the democratic process: persuading elected officials to take your side. That, in turn, requires persuading the public to take your side.
Ok, fine, but what you fail to recognize that taking a loud public stance against tyranny provides cover for people who are too scared to stand up for their beliefs.
Successful civil rights activism took place in an environment where people were being arrested, beaten, and even killed for standing up for what is right. You could even argue that this created fertile ground for the success of the movement. Failures of justice create hardened activists and support networks, and eventually public support.
Comparing the "oppression" of a programmer who is forbidden from distributing an OS that fails to ask the user's age to the actual suffering of Black people in the U.S., who were regularly discriminated against and even lynched, is ridiculous. You'll never persuade ordinary people of this, that way.
Average people will come around when they start passing laws requiring deanonymization and arresting journalists and critics. (The latter is already happening, but I expect this to accelerate in the future.) Need to lay the groundwork for opposition now, and that means rallying dedicated people to the cause.
On the contrary, civil disobedience involves openly thumbing your nose at the state, and it has a long history of successes.
Going to the courts instead of the legislature is another strategy that often wins. This is how Bernstein ended export restrictions on cryptography, by suing the government on constitutional grounds rather than trying to persuade legislators.
1. Civil disobedience has worked when the timing and circumstances are right, and there is a just cause and clear pattern of oppression that engages the sympathies of a broad swath of people. That is rare. Most of the time, civil disobedience has been ineffective. Remember Occupy Wall Street? Black Lives Matter? The violence that coincided with them was a major turn-off for most Americans. About the only one in recent memory that was successful was gay rights, and even that was a result of evolving social mores and media portrayal, not disobedience. It required a tremendous amount of patience: the Stonewall uprising was in 1969; All in the Family had TV's first portray of an openly gay character in 1971; and the Obergefell v. Hodges decision that legalized gay marriage was in 2015--46 years after Stonewall--and even that was a 5-4 decision.
2. Openly thumbing your nose at the law is not going to serve you well in court. What did Prof. Bernstein do when he was threatened with legal sanctions? He lawyered up and took his counsel's advice. His communications throughout the process remained factual and respectful even though his disagreement was clear. He did not go onto Hacker News and prejudice himself by saying things like "Illinois legislators can eat shit" and "I dare someone to try to take me to court over this." He was patient, let his lawyers do the talking, and did not get the judge pissed off at him.
Civil disobedience, as with the legislative and judicial processes, works through the power of persuasion. If you fail to persuade, your mission fails.
These processes involve emotional and imperfect people, not deterministic logical machines, and success ultimately requires making them happy (or at least not making enemies out of them). The system might not work, but you have to work the system.
I'd trust the judgement on an open source maintainer on how to best maintain their code. Your comment seems like it was made out of genuine concern but I think you need a lawyer too before you can argue this with certainty
Stop it. This is not something either of you are competent to provide legal advice about. Anyone concerned about this should consult a licensed attorney, not get advice from randos on HN.
I respect your principled stance on one hand, while on the other I’m amazed that someone as successful as you hasn’t learned that logic doesn’t dictate how governments work.
Don’t make a target of yourself, there are countless ways for a government to make your life miserable.
I will never show fear to tech-illiterate bullies trying to compromise constitutionally protected rights. That is how freedoms get quietly lost.
Users need to see that the people in positions of influence in FOSS projects they trust are not afraid of this bullshit.
I -hope- someone is stupid enough to take a case like this to court so we can establish some much needed case law here. These overreaches deserve to be contested.
"never show fear" and "never engage intelligence" are two different things. Understand what people will do in response to your actions, and act accordingly to achieve the outcomes you want. Please by all means fight the law, and do so intelligently in a way that will actually help.
> There's a reason why lawyers generally advise their clients to remain silent.
Most people prioritize their finances (and non-imprisonment) over their rights, and attorneys will optimize for that expressed preference. GP has clearly indicated his priorities are different. That has nothing to do with intelligence. Someone having a different set of values than you does not constitute unintelligence on his part.
GP said they wanted to take it to court. I presume that means they wanted to win, in which case the best strategy is to discuss the issue in private with an attorney before making public statements that could undermine your ability to win.
If the actual priority here is advocacy, with no real desire to litigate, then I'd buy that.
Exactly. More power to anyone who wants to fight this. But if the goal is to win that fight, do a better job of fighting, rather than acting like "oh, I have a structure that prevents me from complying" will somehow magically make a court go "eh, nothing we can do".
Pretending like technical limitations protect him from being in violation of the law like another commentator made an analogy to handcuffing yourself to property you were told to leave?
His comments on this thread itself which establish intent to not comply with the law?
All power to him for going with his morals but he’s making unforced errors and should instead be contacting one of the several activist legal firms that would at least give him advice on how to protect himself and not follow through with this law if not outright pro bono legal defense.
No one is asking me to add code to stagex right now, so there is no actual legal situation I am in.
I am not even an owner of the project, I founded the project, but am now just one of many volunteer contributors. Are they going to mandate wikipedia volunteers alter pages to state guidelines as well?
We must not be afraid of stuff like this. It is blatant overreach I do not expect would stand legal challenge.
I am simply saying I would refuse to write code I do not want to write. I am honestly surprised people think this is such a scary thing to say.
The point of saying this publicly is not in order to harm or help my own defense of a court order from another state I will probably get.
It is to signal to legislators that if they decide to take this fight, it will be done with people not afraid to do it all in public to establish public trust. It is not even okay that people -think- it is possible for our FOSS projects to be altered or backdoored by any random state officials.
What next, asking Torvalds to add KYC to the kernel?
Wait, which constitutionally protected right is that? I'm an attorney and constitutional scholar and am particularly interested in what right you believe is being violated here.
I’m not a lawyer and even I know that argument would never hold up given the plethora of other laws that have been implemented through software. Not to mention copyright and patent claims too.
People don’t disagree with your moral position. The problem is you’re bringing a butter knife to a drone fight.
There are more effective ways protest this law than posting punk-rhetoric on a nerd forum for a project that will likely fly under the governments radar anyway.
We get their intentions. We just disagree with the effectiveness of it.
Posting rhetoric on an anonymous message board is not making a stand. If and when they’re doxxed by US media outlets, and slapped with life-changing court orders, with their work and families directly affected by their decisions; then they’re making a stand. But until that point, their words are as meaningless as their view of this law.
Eg I can confidently say I’m not going to comply with this law either. But you have no reason to assume that will make any difference nor that I wouldn’t fold the moment I’m put under the slightest amount of pressure.
If people really wanted to make a stand then they’d be drumming up support in real life, not anonymously. They’d be speaking to government representatives. They’d be raising financial support for lobbying change.
I’m old enough to have lived through multiple iterations of unpleasant laws being passed and each time a movement against it has been online-only, that protest has achieved nothing. So I know the real reason this maintainer is speaking as boldly as they are is because they know the government hasn’t heard of them nor their distro. Ie it’s a “making a stand” by doing exactly nothing. But it will also achieve exactly nothing too.
> hoping you are never forced to add code to a project you do not want to add
You keep saying that, but that's not the realistic outcome. The realistic outcome isn't an injunction forcing you to add code. It'd be to force you to pull it out of circulation.
They cannot force me to do either. But it would be a fascinating case study to watch them try. I feel it would only help prove the decentralized censorship-resistant tactics of the project work as intended. Government overreach should be in the threat model of every FOSS project.
That argument has been going on for decades, and has had few victories in the court system. The DMCA, which prohibits trafficking in anticircumvention devices, even though there's a lot of code in them, is still alive and well.
And the DMCA has been rightfully weakened to the point that archive.org has every Nintendo Gamecube game ever made hosted for the public, for years, uncontested.
There is pretty solid case law for the constitutionality of a variety of compliance requirements. If you can comply by being silent then they aren't really compelling you to do say anything.
Is is also clear that there are major deficits in our Constitution but that the amendment process has failed to survive a modern world.
Any of our original forefathers would recognize today's American federal government as an overreach from their indended form of government.
The only reason we aren't seeing a Boston Tea Party 2.0 over the recent string of coordinated assaults against our inalienable human rights is because surveillance capitalism is already coarsely achieving its goals of suppressing any civic participation which exists between the spectrum of ineffective political protest to the most desperate, radical action.
Some of those among us simply cannot drink this koolaid. A quote from MLK, Jr:
I submit that an individual who breaks a law that conscience tells him is unjust, and who willingly accepts the penalty of imprisonment in order to arouse the conscience of the community over its injustice, is in reality expressing the highest respect for law.
Who is "most of y'all"? Sounds like a generalization to me and a poor attempt at an appeal to character in order to undermine the perspective I've shared.
Have you been to prison? I've been incarcerated before already after having my rights violated. Let's not go there. Make less assumptions.
Incarcerated temporarily (e.g. awaiting trial or a prosecution decision), or actually convicted and sentenced to imprisonment? These two things are not the same.
No one is being convicted and doing hard time for refusing to add age verification to a Linux distro. This is just more fear mongering.
It would be a fine or a few days of jail until bail is posted, at worst. And then a media shit show where the public is certain to side with the developer who is having their rights violated to discourage this from ever happening again.
The public even got the back of weev for his bullshit arrest. Weev, one of the shittiest people to ever live. But rights are rights.
> No one is being convicted and doing hard time for refusing to add age verification to a Linux distro.
That's not the point. The point is that people who don't face a real possibility of being convicted and imprisoned are the ones who make the most noise about how they're willing to accept imprisonment (or, worse, are cheering on others to be imprisoned as some sort of Cyberpunk Martyr).
As I said elsewhere - it's easy to be an Internet Tough Guy when you (think you) have little to lose.
This reads like your personal fantasy. It's also insulting to people who stand by these words all the way down the slippery slope. People who spend time trying to make the world safer for you and others.
Instead of positioning yourself adversarially and making unfounded and unwarranted claims about others, it would be more productive to engage in good faith and seek to lend a hand.
You've already made flat-out incorrect assumptions about me, indirect or not. Calibrate yourself.
You quite frankly have the conversational intelligence of a petulant child and I would not seek your legal advice in any matter if this is how you conduct yourself when discussing law with others online.
They also just went and silently changed multiple comments in order to make their replies look less edgy, petulant and unprofessional. I'm all for editing out swipes, but the lack of acknowledgement makes it clear that their last resort for turning this one around is manipulating the conversation after the fact to benefit themselves.
The public may have weev's back, but privately the majority of us disavowed him after he went full nazi in prison and doubled down on an alt-right agenda. I personally know people who signed the court petition to get him acquitted and they have rescinded support for him. That said, he shouldn't have gone to prison for that.
Anyway, the nature of a slippery slope like this one is that the punishments will get worse over time as the government further vilifies those who push against things like this and encryption backdoors.
I am amazed that an attorney would ask me to divulge this kind of highly personal information in a public forum when I am clearly trying to be discreet.
I'm not your attorney; I don't owe you a duty of confidentiality. You're not being discreet at all; you brought up your prior incarceration, presumably in the hopes that it would help you prevail in this discussion. By so doing, you opened that door and made the issue relevant.
Are you seriously comparing the "oppression" of a programmer who is forbidden from distributing an OS that fails to ask the user's age to the actual oppression of Black people in the United States before the Civil Rights Era? The oppression that involved lynching?
You have no idea who I am, what hardships I have dealt with, and clearly don't have a complete understanding of civil liberties if you cannot make the connection between the violation of two different Constitutional rights.
Your current negativity is not welcome, if you are an attorney then please conduct yourself with more professionalism. If you want to seek to understand, great, but now you are being aggressive and negative and making a host of unfounded assumptions.
Is that your legal advice? Has this strategy worked for your clients before?
Edit: Poor taste to edit out your original comment with no acknowledgement. That was inappropriate and you know it, which is why you've now changed your comment.
I think the issue here is that while the people here are aware of the history and "utility" of laws like the one above, most people aren't and right now "regulate social media, the internet, and what my kid does with computers" is having quite a day. Inevitably all of this is framed in terms of keeping children safe, whereas piracy is at most a misdemeanor of very little consequence.
Although I have no doubt that courts would ultimately side with you, the chance of becoming even a transient focus of a frustrated AG or congressperson looking to pin blame on "Out of touch and recalcitrant techies, the very ones who created this problem," is chilling. It's meant to be chilling, but it often works because he reality of what you'd go through on the way to eventual victory isn't trivial. Maybe you're willing to go through the courts (public opinion and otherwise), but if so the first thing any attorney you employ will beg you to do is stop talking the way you are.
tl;dr I think taking a stand is great, I support that, I think doing it now is a good idea. I don't think you should talk about it in public though, especially not in a literal, "Come and get me" way.
Ya, I think op needs to study the history of civil rights in the US on how to do these things. Quite often the people that were getting arrested and challenging the state were specifically chosen because they didn't have any kind of dirt to dig up. The state is perfectly fine with playing dirty inside and outside the courtroom. The state would love the person brining a constitutional challenge to suddenly be marred in the eyes of the public as some kind of deviant.
Good news: the legislation doesn't target you as an individual.
"Operating system provider" means a commercial or
non-profit entity that controls the Internet-enabled device's
operating system, including the design, programming, or supply
of operating systems for the Internet-enabled devices.
How are you deducting the taxes without a legal entity? Or did you just mean that they would be tax deductible but not that you are necessarily deducting anything.
Opencollective collects funds to distribute to open source project maintainers. Not that it matters. We have never collected a single donation, but figured it was worth a shot. lol.
I specialize in TPM security and know plenty of ways to bypass it with physical access to consumer laptop hardware, and would gladly make that easy for the public if needed.
But I hope they try this. It will be funny to watch the public humiliation of how hard it fails at scale.
> ”Linux distro founder here (stagex)… designed to work offline-first, with some variants not even supporting network drivers”
If your OS doesn’t access the internet or isn’t intended to run browsers / social apps, then you are outside the scope of this legislation. That would be a bit like requiring a toaster to ask for your age before letting you operate it.
They can stop you from doing any work on the project. They can even fine or jail you for work done after the law takes affect that the international committee doesn't allow. Which is to say you can be forced to stop work.
Though if you don't live in IL it is unclear how this affects you.
Some time in jail or having to fight a fine for refusing to implement features in the constitutionally protected free speech code they author? If that is what it takes.
I do not want to go to jail, but if that is the only way to get to an outcome where people have confidence they can not be forced to add unwanted code to open source projects, so be it. But that is a pointless thought experiment because it will never happen.
I do not think anyone would be stupid enough to jail a FOSS developer for not agreeing to compelled speech, and if they did, an army of lawyers would be lining up to take the case I expect, with the full support of the public. It would be an insane thing to attempt.
We must loudly push back on the chilling effects intended here. Our free speech to write or not write any code we want will not be compromised.
Can someone who knows the law explain to me how someone who lives in California, and hooks his computer in California, to a wire in California, from a company in California...
At what point do they become subject to Illinois law?
And can Illinois prosecute someone for doing something that is legal in California while they are in California?
>At what point do they become subject to Illinois law?
When they sell to someone in Illinois, although there is probably some bullshit case law out there that says the website owner has to take basic steps to block Illinois users to avoid all IL jurisdiction.
>And can Illinois prosecute someone for doing something that is legal in California while they are in California?
IL laws can't be broken by someone not in IL that does not interact with anyone in IL.
Presumably, there is a defense available in court that would prevent CA from extraditing someone to IL who is innocent because they have nothing to do with IL.
Governments can hire a hitman to go after you, if you say something wrong. So can international crime syndicates. Will this have a meaningful effect on chilling your speech?
I feel like all of these laws are being designed backwards. Content providers, like MPAA films, should have to identify what sort of content they are providing. Then I can give my kids a device configured to allow some or all of that at my discretion.
Requiring my kids' devices to advertise their age (or their age "bucket", as if that was a meaningful difference) to protect them is not doing me or my kids any favors.
Having the ability to identify who is watching or saying what on the internet would be immensely useful to the government; the justifications are really meaningless.
Anti-money-laundering is a comparable field, as all the AML regulations and laws are ineffective at identifying money launderers, but they're wonderful for verifying (auditing and prosecuting) tax compliance.
> Anti-money-laundering is a comparable field, as all the AML regulations and laws are ineffective at identifying money launderers, but they're wonderful for verifying (auditing and prosecuting) tax compliance.
As someone who’s implemented AML, KYC, and tax reporting functions in a bank. I think you would be very surprised at how shit they are for tax auditing at scale. Unless the tax man is specifically auditing you, and basically requesting all your transaction details, the reporting that banks do would only allow tax agencies to catch the most brazen and incompetent tax dodgers.
All of the tools however do make much harder to perform money laundering, forcing criminals to recruit and pay huge numbers of naive bank customers to allow criminals to launder money via their personal accounts, using them as money mules. Which then gets flagged and shutdown pretty quick by banks because the behaviour is generally pretty obvious.
Unfortunately (or fortunately depending on your perspective) banks can’t/don’t coordinate on identified money mules or know launderers, so criminals just move on to other banks and repeat.
Criminals don't have to "recruit and pay huge numbers of naive bank customers"; in my jurisdiction, they just walk into a casino with a few hundred thousand dollars, exchange for chips, pretend to gamble for an hour, then exchange the chips for cash, and walk out with a nice receipt. There're more complex schemes involving real estate and other mediums too.
That’s cute, but it doesn’t really scale. Organised crime groups aren’t interested in laundering a few $100k at a go. They’re moving and laundering millions, you can’t put that through a casino without it being very obvious.
There is a huge international criminal industry that exists to find and hire money mules, and launder eye watering amounts of cash. Where I worked, we broadly assumed that the police weren’t interested in fraud or money laundering unless it was measured in 10s of millions. We reported everything, of course, but we only got call backs for really big schemes.
If you’re just committing fraud measured in $100ks, the odd of anyone bothering to investigate, and attempt to bring criminal charges, was basically zero.
The 'small-scale' 100k-1MM per participant per day per casino laundering can add up to 'real money' quite fast.
The larger-scale money laundering in my area is a but more complicated, involving import/export schemes, real estate transactions, and property developments. I'm not in a mega-city, so I assume these schemes are taking place at a larger scale in those. I have only ever heard of very basic and stupid schemes (which didn't provide any tax revenue to my goverment) being detected or prosecuted.
> Unfortunately (or fortunately depending on your perspective) banks can’t/don’t coordinate on identified money mules or know launderers, so criminals just move on to other banks and repeat.
Or criminals just get a bank like HSBC to do the money laundering for them.
> Content providers, like MPAA films, should have to identify what sort of content they are providing. Then I can give my kids a device configured to allow some or all of that at my discretion.
If the intent were to actually protect children, then this would be what was done.
"Protect the children" is just a subterfuge to get electorate support for voting for the foundation for a "1984 thought crime" style monitoring of the internet.
Do folks realize how many people would need to be a part of this conspiracy to get these laws passed at the state level? Maybe some people actually want to do good and are just misguided. And responding to those people as if they are evil government stooges certainly isn’t going to help them find the light.
The adtech companies need human verification so they can keep selling ads. Age verification is a way to get that under the radar because normal people are pissed off about "the children" and "the social media". You've also got cultural warriors who would love to censor speech on the Internet championing it, too.
You don't think knowing a users self disclosed age-group would be beneficial to adtech? A) they shrug any liability for showing inappropriate things to minors when all the onus is on the OS to provide accurate info, and B) they get a highly-likely to be accurate piece of profiling information to add the the already huge pile they collect from spying on people 24/7 and harvesting microdata from browser APIs and mobile apps.
It helps soften people up for nastier stuff later.
As an example: Decades ago CPUID and a machine readable processor serial number was massively controversial. Today burned-in device IDs being sent to websites is status quo.
On the other hand, I don't know a single person or have even heard of people or organizations who are advocating to pass these laws. They want the war in Iran to stop and for costs to go down. How is there so much political willpower for the former and almost none for the latter?
> Do folks realize how many people would need to be a part of this conspiracy to get these laws passed at the state level?
Not many.
> Maybe some people actually want to do good and are just misguided
Yes. That's why it doesn't take many to be part of this conspiracy. You can just get people to play a part in the conspiracy by rallying supporters under the guise of good intentions.
> And responding to those people as if they are evil government stooges certainly isn’t going to help them find the light
Most of those people will probably die not finding the light. They are people who won't have to live with the long term consequences. Most of the Illinois House (~70%) is 46+ [1]. The senate statistic is even worse sitting at almost 75% for individuals 46+. If life expectancy in the US is around 80, that means people who are in the first half of their expected life are drastically underrepresented (especially considering Illinois's 46+ demographic only occupies around ~45% [2])
Can we extend that beyond just parental controls? I'd love to permaban 90% of the internet from ever reaching me. But the laws are designed backwards because they're probably written for someone else's benefit.
If this age verification stuff ever becomes plausible we always have the option of distributing actual Linux ISOs over bittorrent. Failing that, source code in RAR'd archives distributed across IPFS nodes and Tor. I feel like many of us would welcome the challenge if it were under better circumstances.
I'm now pretty convinced that this is the best argument for persuading non-technical and non-internet-privacy minded people why this is a problem. It's hard to explain all the technical factors that make it impossible to implement without compromising privacy... but it's pretty easy to get them to understand the real intent. If you start them thinking through what mechanisms would make sense _if_ the original premise truly was protecting kids from content they aren't ready to see, it's easy to arrive at that answer, and equally easy to see why "everyone must provide their ID so we can verify their age" probably comes from other motivations.
and that's as useful as self-documenting "i am over 18" or "over 21" for things that require that, without any document checks.
this is a way to get something legal on paper, the rest of the stuff (patches, if you will) comes later. This asserts that age is important enough to force an operating system to comply, this opens the door.
> and that's as useful as self-documenting "i am over 18" or "over 21" for things that require that, without any document checks.
No OS I'm aware of allows non-admin users to add new users to the system. Parents that care about these sorts of things don't give their kids admin access to their computers.
> the rest of the stuff (patches, if you will) comes later.
Unless the legislation allows for such patches through non-legislative process, patches to legislation generally happens on a ~20 year cycle in my experience.
Maybe. I give kids more credit than most people on here, i guess. All it takes is one moment for the kids to see the password, guess the password, or whatever. if there's a physical key involved, parents sleep.
A determined kid will find a weakness in the pursuit of freedom.
also nintendo's OS lets users add users to their heart's content. At least i haven't found a way to stop a toddler from adding 6 avatars....
All I claimed is that as passed it is more effective than a "check this box if you're over 21" on forms. Not that it was fool-proof. I don't think any legislation would be fool-proof. Certainly not the privacy-destroying "upload your ID", which this isn't.
Why then did this completely leave out verification? Parents want and accept the out-of-box declaration idea. It requires no ID, no face scans, no "ID dot ME" or whatever. As parents we are more than able to open the box before giving our kids a laptop or phone and entering their DOB, and also able to see with our own eyes if the kid suddenly turns up with a second cell phone that they bought and configured as an adult.
Any parents who are pathetically absent from parenting their kids, well, they can just go right on ignoring their kids and letting the kid themselves put in 9/9/99, and consume all kinds of inappropriate crap.
This particular law is respecting everyone's rights.
I would argue the reason is so people can make arguments like yours.
Step 1: get easily passed, simple looking laws passed to 'protect the children'
Step 2: 'oh look at all these people bypassing the law. It's so simple for a child to watch porn with this.'
Step 3: increase the requirements bit by bit on the verification
By letting something simple pass, they can claim it's not thst bad, and anyone who argues against it is being hyperbolic.
> Step 2: 'oh look at all these people bypassing the law. It's so simple for a child to watch porn with this.'
This would be a demonstrably stupid argument. A parent who simply opens the box and does 5 minutes of setup before giving their child a new $300-2000 device, and maintains the most basic awareness of any rogue devices (i.e. ask questions if a new phone appears) is all it takes to make sure no "bypassing" takes place in your home.
Anyone claiming "all these kids are bypassing it" would be lying, unless the law isn't even being enforced or sites aren't cooperating. And no law can overcome those problems.
Do you have children? Have you witnessed what they can do with restricted $300-2000 devices? My kids hack restaurant tablets at every place we go. I don't even know how they do it most of the time.
This is going to be one hell of a slippery slope. And the actual publisher-driven proposal in this thread is so much more useful; I would love to filter out anything with excess violence and generally NSFW content from my view of the Internet -- and I am over 18.
The idea of a 'user agent' where the 'device owner' decides 'what should be displayed and how' is ancient history, grandad.
Modern social media is delivered through 'apps' which are like web browsers, except without ad blockers or privacy settings, and with push notifications to make them more addictive, and they only show one website, and they're each 5x the size of a web browser for some reason.
This is definitely not about "protect the kids" or age verification, this is a stepping stone to full identity verification to use the internet at all.
> I feel like all of these laws are being designed backwards. Content providers, like MPAA films, should have to identify what sort of content they are providing. Then I can give my kids a device configured to allow some or all of that at my discretion.
It seems like after Epstein was gone a lot of politicians in many countries suddenly want to identify children, take photos for "age identification", and their ages and what apps they use. Very strange.
Did you read the law? It actually imposes very (in my humble opinion) good rules on the content providers, specifically social media. We know why social media is addictive - the personalized feeds are highly optimized to extend usage time, with no amount of time being "good enough." Social media sites would be banned from using this type of feed, limiting it to feeds of content you've subscribed to or requested only. Instead of seeing mainly influencers and viral videos, people might even start seeing their friends' own content.
> Requiring my kids' devices to advertise their age ... to protect them is not doing me or my kids any favors.
Idk about you, but it'd be doing me favors because my kids will not be physically able to use the most addictive platforms that exist today in their current form. It would be a major disruption to the behavioral manipulation that Meta, TikTok, and X do.
Right, I'm saying that if the goal is to keep kids off of addictive social feeds, it would be better to have social media have to say "this site implements addictive feeds" and then I can configure my kids' devices to disallow that. The decision should be happening in my house on the devices I control, not in a Meta data center. The current law just gives Meta a way to start building a shadow profile early.
> then I can configure my kids' devices to disallow that
C'mon. We all know parents are far more likely to tap "OK" for "Allow personalized social feeds?" than they are to knowingly falsify their kids' age. The kids will be begging them to and saying "It's just to personalize it, Dad! There's nothing scary or bad on Tiktok - all my friends are using the personalized feed and mine is BORING!"
> The decision should be happening in my house on the devices I control, not in a Meta data center. The current law just gives Meta a way to start building a shadow profile early.
The decision would still be in your hand. If you want them to be using all the max addictive crap, just fake their age on the device that you bought them.
> The current law just gives Meta a way to start building a shadow profile early.
Whether or not they can start building a profile to start using at 18 is unrelated to this, and depends on data protection laws. There's no use tying the two together.
> We all know parents are far more likely to tap "OK" for "Allow personalized social feeds?" than they are to knowingly falsify their kids' age.
I know lots of parents and lots of kids, and I don't think this is accurate. In my experience the breakdown is parents who care what their kids are doing online, and parents who assume it will all turn out fine because they had AOL or even Facebook as teenagers and didn't get into too much trouble. The first group is already keeping an eye on their kids and might even have decent parental controls set up, and the second group doesn't care what happens as long as charges don't show up on the credit card.
These bills punish the first group of parents and OS/device makers for the transgressions of social media companies. The uninvolved parents won't even be in the room when the age question comes up.
Controlling my information consumption is not a legitimate function of the state. If algorithmic feeds get a lot of use, it's because people like them. Is that so hard to comprehend? That your preferences are not universal? And that you shouldn't use the government to bludgeon people into accepting the kind of information feed you, personally, would prefer for them? What gives you the right to do so?
What you calling "addictive" is just revealed preferences of the populace.
Great, let's legalize recreational fentanyl too, since 'whatever people seem to like' is good for society.
In this case, unless you're a child, nobody's trying to control what content you consume. And if you are a parent and want to make sure your children can continue to consume the most addictive possible social media, by all means lie about their age. The law does nothing to stop you from doing so.
By contrast, having zero mechanism for the rest of the parents to control this, as is the current case, does impose your "do whatever feels good" values on the rest of the world.
> By contrast, having zero mechanism for the rest of the parents to control this, as is the current case, does impose your "do whatever feels good" values on the rest of the world.
I use them. First of all, they're still absolute dogshit (but Apple promises good changes in next OS?). And the choice is to either allow social media in its current, extremely toxic form, or ban it entirely. There's no "Allow Instagram but only let them see the content their actual friends post." No "Allow TikTok but let me allow-list the influencers that show up in For You." The peer pressure on kids to be on those platforms is intense though, and many parents seem to be allowing it.
I think the theory behind the law is that experimenting on children to optimize (without any ceiling) for increasing watch hours, which 100% of the social media sites are doing at all times and have been for over a decade, is unethical and should be illegal.
If adults want to subject themselves to that, it's their business, but for children, we restrict all kinds of things from even being marketed towards children. Things (especially addictive ones) that are very obviously bad for humans, like cigarettes and liquor. Why? Because otherwise there's a huge incentive for the makers of those things to do so, because of how naïve kids are.
A wildcard here is how if at all to address careless, negligent parents of course. For the things so obviously harmful like drugs, it becomes criminal to give those to your kids. But perhaps social media falls into about the same category as R-rated movies, where we just say "it's bad parenting to take a 6-year-old to one, but not illegal." Another area where we have 'censored' things for children for decades - without any kind of scary police-state regime materializing and forcing biometrics and recordkeeping at the box office.
The difference is that those other things in the past didn't really place an undue burden on everybody else. Whether a child is allowed to watch an R rated movie or go to a pub has no effect on how I conduct myself, age-gating computers or the internet does affect how I use things.
> I think the theory behind the law is that experimenting on children to optimize (without any ceiling) for increasing watch hours, which 100% of the social media sites are doing at all times and have been for over a decade, is unethical and should be illegal.
I agree, and I think this is where the focus should be. It places no burden on any regular consumer to do anything and all the burden on the platform providers.
Information that enters the mind through the eyes and ears is nothing like a drug that alters consciousness at a low level. Words are just words. You don't get to control the words people choose to hear.
Parents already have the ability to do this, at least when it comes to porn. The fact is that most parents aren't doing it. Hence the push for legislation that increase the uptake of content blocks for minors.
Very true, though this is something thats pretty difficult to get to by tiny increments, which is usually how these nefarious means are accomplished. One tiny thing is asked after another, each one too small to put up a fight against, and then suddenly they've crossed your line and you didn't even notice. Thats not particularly easy to do here, so the line will remain just as strong.
Maybe next they'll ask maintainers to go from a bracket to a specific age, and then next ask for verification, but the jump from specific age to verification is big enough that there'll be just as much resistance to it.
As a counter, actual age verification is being rolled out in other places. I really don't think we're in a position of choosing between no age-based access mechanism, and age-based access mechanism. Between the anti-porn types and public demand for some kind of regulations on social media, regulation of some kind is inevitable.
Our actual choice may only be what type of restriction we can live with, and I much prefer this type to the kind that requires websites to demand my id and photos of my face. Especially since some implementations of this concept (the California one, I think) declare that websites aren't legally required to look deeper than the attested age, which is a very nice feature.
Mind you, I don't know why the legislators are bothering mandating OS support for these features. It would be much easier to mandate that websites support the feature, make it clear to them that supporting the feature appropriately will free them from liability for children accessing content, and then wait as users demand that their OS support the feature.
I actually agree with you, if you mandate that the site has to look for an affirmative signal and if it doesn't get one, has to assume the user is the youngest possible age group. Users would demand the proper support for it.
Although it would have to have some teeth capable of biting the client software companies, because for instance, if browser(s) chose to on their own simply send "I'm over 21" to every site this becomes a pointless exercise and that applies whether the browser makers do it out of frustration that the OS support hasn't landed, or out of malice (imagine a browser that misreported age on purpose, specifically targeted at kids who want to bypass the parental controls).
Honestly though - because kids (especially the younger set) are hard pressed to buy their own hardware, a property that can only be set up out of the box, and can only be undone by using the account password of the parent who set it up, it is the perfect level of security here. And as for browsers, all you need is the gatekeepers (Apple, Google, MS) to agree not to ship in their "stores" browsers designed to evade it. Yes, you can totally compile your own browser, but most kids are using locked platforms like iOS and Android, and are by default denied permissions to run arbitrary software on platforms like Mac and Windows, so that's fine.
Yeah, that's pretty much what I am imagining. You're right about needing some teeth - maybe the legislature could define a spec, and penalties for implementing the feature in a commercial product without actually following the spec.
I really think all we need is what you describe in your third paragraph. It doesn't need to be bulletproof, it just needs to be an easy way for parents to set the level of content their children can access without them having to hover over their children at all times. Something like that could easily be set up in the Genius store when someone gets a new iPhone, or set up at first boot on an Android phone. That's like 90% of the devices anyone is actually worried about. Windows support of the feature would take it to like 99.9%.
Exactly. Fortunately, the kids we're most concerned with - young ones who just want to access their brainrot - has very little overlap with Linux users anyway. So, while I hate this hysterical propaganda portrayal as "aGe vErIfIcAtIoN," an "OSS operating system" exception doesn't really bother me, as long as it doesn't let the usual suspects make an end-run ("Darwin is OSS! See! iOS is exempt")
> if browser(s) chose to on their own simply send "I'm over 21" to every site this becomes a pointless exercise and that applies whether the browser makers do it out of frustration that the OS support hasn't landed, or out of malice (imagine a browser that misreported age on purpose, specifically targeted at kids who want to bypass the parental controls).
If it's a header, you can strip it out at the browser level, the user level, the kernel level, the hardware level, the router level, the router OS level, the router hardware level, or at the ISP level, depending on what a parent (or a state) desired.
The teeth are only necessary for the websites, which are never going to conform to the law anyway, whether through a header or through device attestation, without draconian Chinese-level enforcement that has never been seen in the West before. This new contract will have to be enforced at both endpoints. You will need the ID (whatever you want to call it) to get onto the network, whether you're an individual or the site being visited.
The idea that device attestation is going to bother the Moldovan tube site your kid gets pirated porn through is a surprisingly ignorant fantasy, especially when it comes from technical people. The Pirate Bay is still up. Megaupload is up and runs better than ever. People have 20 year old torrent site accounts. OS-level age attestation must be a first step, because it won't work.
And as to it not being enforced either by the hardware or by identity verification of the user, that's an impossibility. A kid can also overwrite an operating system, or even just overwrite the important part; so that means that either only attested operating systems can be installed, or no user is trusted at any time without state verification.
This sounds like a hot take, but I'm way less concerned with sketchy porn sites (mostly for the kind of reasons you say which boil down to ... they're sketchy).
I'm more concerned with deliberate manipulation of young people by social media. TikTok and its clones especially have demonstrated an incredibly strong ability to not just addict and brainrot kids (which is bad enough -- and it's really, really bad), but also to shape their opinion. All that discussion about the CPC having complete control if they wanted to exert it wasn't BS. Whoever controls them absolutely can use an algorithmic feed to astroturf "viral" videos pushing any narrative they want. Think of Elon Musk in his role as owner of X if you like the CPC.
Anyway. Most tweens and young teens don't know how to use Bittorrent. They use iOS and Android all day, and Chromebooks. These function as closed platforms, and macOS is as well unless you go out of your way. And Windows unless you make your kid an Administrator. Linux and other noncommercial OSS operating systems can have an exception if it makes it less burdensome on the maintainers. This doesn't change the fact that a law like this still solves a ton of problems that parents otherwise can't solve, and that big tech could only solve independently today by very privacy-invasive means.
> because it won't work.
It sounds like you think "work" means "prevent 100% of minors from seeing even a single frame of Bad Stuff anywhere online on any device"
To me "work" means "prevent most children (who aren't extremely technical) from mainstream social media sites openly experimenting on them daily to build a paperclip maximizer, where the paperclips are 'watch minutes' (as a proxy for ad revenue) and the planet being dismantled is our society."
It would "work" by this definition.
> device attestation
this specific term means something specific and is not what this law is about - not sure if you meant to tangle that idea up with this.
But it's possible to lose a battle you were never going to win in the first place, and end up in a worse place.
I think that if these types of laws (illinois, california) don't hit a critical mass, we're going to see ID verification become the dominant method of age verification. Most websites will use it, and it'll become global because it's easier to just demand an ID and a photo for every user through some third party provider than to offer looser restrictions for the handful of states that have different demands.
This is especially true since it's now been demonstrated that states (like Texas) can go after out-of-state sites serving people in Texas. Sure, you could scrupulously try to identify which state someone is in and use the appropriate level of verification, but then you might be liable if it turns out it was someone from Texas or Georgia or Britain using a VPN.
> I think that if these types of laws (illinois, california) don't hit a critical mass, we're going to see ID verification become the dominant method of age verification.
You are assuming that age verification must necessarily happen. It needs to be destroyed at every possible juncture.
• Operating systems on devices whose primary user is a child must provide a way for the parent to provide age bracket information about the child.
• They must also provide an API that apps and app stores can use to find out that age range if they need to have limits on what children can do with them.
• They amended it to not apply to most open source operating systems.
Note that there is no actual age verification. It just uses what the parents put in. It is really just requiring each OS to have a standardized parental control system.
Among many other things, privacy. If you know an age range that's more information about the user than you should have, and you can use it for marketing. And if you can ask for an age range, then in practice you know a birthday; just keep asking until the range changes and record when you saw it change.
It's also the wrong way around: apps shouldn't ask for an age range, apps should provide one and the OS should do the checking.
I also object to it because it's a foot in the door for demanding that websites and apps care about that age range.
And most importantly, devices already provide parental controls in practice, and this law doesn't make those any better, it just unnecessarily cements one aspect of them into law. You can, already, on many devices, say "don't allow installing apps without permission", or "don't allow installing apps except those with this rating".
Yeah, I'm not super happy about all the 3d printing control legislation going around, which I frankly think is a lot more overreaching than these age declaration laws.
Hasn’t the right to ask existed since the invention of consent laws?
The state being able demand a persons age, and gate their behaviour based on that, has existed for hundreds of years so far. During that entire time the requirement to be truthful has also existed otherwise the laws would be meaningless.
All that’s changing now, is figuring out how that extends into the digital realm. I personally find the argument that the digital realm is somehow special compared to the physical realm, and thus certain laws simply shouldn’t apply when “done on a computer”, difficult to reconcile.
Hard agree. I don't think we allowed video store operators in 1995 to just let kids wander into the back room and rent porn, but we're so used to there just being "no rules" online, it is coming as a massive shock now when it's being suggested that maybe there should be some basic guardrails to discourage that.
Let me be clear, I don't want face scans, or more of those creepy companies that operate this age verification crap for Discord, etc. Because I know it's not going to be implemented in the privacy-preserving way it could be, if there's ANY involvement with identity documents. Not least because we don't even have any proper cryptographically useful identity cards, so everything like that operates on a "trust us bro" basis where they pinky promise not to accidentally store everyone's raw face scans / ID cards / numbers / etc and inevitably leak them.
But out-of-box age declaration is not extreme and is not slippery-slope, any more than out-of-box user account creation 25 years ago has led to out-of-box ID card checks.
This is a nonsense argument considering over half the states have already put actual ID verification requirements in front of "adult content". Blue states are trying to ratchet to what red states just pass? Why? They could just follow suit and require you to upload your ID to a 3rd party service and scan your face. Your conspiracy theories don't seem to hold up to reality.
Or alternatively - you could recognize that normal people are getting more and more pissed off by the fact that social media companies are force-feeding garbage into their kids eyeballs 16 hours a day.
We could give them a reasonable solution that demonstrably preserves privacy and doesn't inconvenience anyone else (Suppose you want to see all the uncensored everything, you open your new PC or phone and say your DOB is 1/1/1900. Done. Status quo.)
Or we could be alarmist about that, torpedo that plan, and then in 2 more years when people are even MORE pissed, a horrifying new plan comes out, where the government scans your photo ID (with the help of some crappy private contractor of course) and both of them promise to probably not store the info and log your access. And that one manages to scrape by because people are at that point even more pissed and are determined to solve the problem somehow.
The actual 'bad guys' just wouldn't be able to get the public support for that second, shitty plan, if we basically solve the problem now with this very modest plan that's on the table now. Parents can handle this simple one-time out-of-box prompt and it makes sense. Device owner, the parent, that's the one who should make the call.
I actually agree with you, but you have an optimism about the ability for open source maintainers to have achievable political aims, in a way that I haven't seen happen for decades.
What your happier future looks like requires both a technical solution, but more importantly political wins to sell that solution as the better one.
The current operating systems weighted by users, are entirely under the control of three major players, who are incentivised to further centralise things.
( I'm counting the three operating systems as Google Play Services, IOS and Windows. Yes, AOSP exists, but it's useless without Google Play Services. ).
I also don't think a device level switch would stop anything for a second, given the number of stories of parents who seem to hand their children their credit card, then complain about them racking up thousands of dollars on Roblox or whatever.
When the light-touch measures fail, the framework will be leveraged to start requiring more centralised and less private solutions.
> given the number of stories of parents who seem to hand their children their credit card, then complain about them racking up thousands of dollars on Roblox or whatever
Sure, but you hear about those because of how shocking they are to all sensible people. Actually I bet a lot more kids rack up those charges using cards they stole from mom's purse. Same kids will start trying to sneak mom's old iPhone out of the desk drawer to install "Adult TikTok" on. But again, this is not more concerning than the way my generation rooted around on the top shelf of Dad's closet to find the old Penthouse magazines.
I just don't accept the absolutist idea that if anything can be gotten around by any means, that means it can't still be sensible policy. Which seems to be the attitude taken by two separate groups -
1. Your and my common enemy -- the ones who are eager to enact "Show ID to access this site (trust us!)" verification schemes
2. And the freedom-loving hackers I've been arguing with today, who also detest those schemes but also don't want to see any scheme of any kind.
> I just don't accept the absolutist idea that if anything can be gotten around by any means, that means it can't still be sensible policy
Now on that I agree strongly, there is a crowd on here that believe that technical weaknesses defeat political strengths, and focus all their effort into proving a technical workaround only for the political juggernauts to continue crushing their freedoms.
These are arguments which often flow, "This law is impossible to enforce in totality, therefore the law will fail", which fails to understand what law really is, and how much people abide to even bad laws.
I think we disagree on what's actually needed to defeat the increasing centralisation of the internet, I think it really needs a movement to wake people up, it needs skilled political operators, and it needs passionate orators, to spread the message that we're increasingly operating in a controlled space which every year has greater hurdles to communicate outside of the bounds which those who control it allow, rather than the open internet we used to enjoy and need to fight to defend.
And, most importantly, that that fight needs to be political and not technical. Being seduced by the appeal of technical solutions is unhelpful distraction. Cryptocurrency will not keep you free. Duress pins will not keep you free. It is political will that will do that.
Slippery Slope is the assertion that A therefore B therefore C therefore D.
It is frequently a fallacy because D isn't predetermined by A when humans are involved. If you believe in free will, each of B, C, D are independent decisions. Sometimes we stop at A. Sometimes we pass Prohibition as a Constitutional Amendment, and later roll it back.
On the contrary in my experience once a legislature passes a bill to "fix" a particular problem they consider it fixed and don't update it for at least 20 years.
it depends on whether or not there's someone who sees it as a crusade (rare), sees it as a way to get political clout (very common) and/or is getting a lot of lobbying money (extremely common [1]). see, for eg, the anti-trans bills that are being passed
this is the same rhetorical and political strategy, that there are 'dangerous' people who will exploit your children so please vote for me, the person who cares the most about children and will go after the 'dangerous' people
"Overwhelmingly, state legislators behind recent anti-trans legislation have argued that they were introducing these bills with the intent to protect children – whether that be “protecting children” from “profoundly unethical and morally wrong” medical practices"
"Much of H.B. 5511 is modeled after controversial legislation passed in California (A.B. 1043) and New York’s Stop Addictive Feeds Exploitation (SAFE) for Kids Act"
"The surge in funding to the ADF, which has been termed an “anti-LGBTQ hate group” by the Southern Poverty Law Center, saw it record revenue of $104.5m in 2021, according to filings with the Internal Revenue Service."
this is very much like the funding of these 'privacy' acts by Meta, Alphabet, etc - lots of money directly into the hands of local legislators across multiple state legislatures with the ultimate goal of providing institutional power over individuals, one just has a slightly more Machiavellian economic logic foregrounding it but the strategy, tactics, and overall erosion of civil liberties make for very similar outcomes
i mean with the rise of flock ad campaigns of "think of the children" and them installing platereaders all over the place this kind of thing is something that people want to capitalize on and make a buck. i can definitely see the lobbying pushing for more and more invasive versions of this.
I don’t even get that far, the proper response to my operating system asking me if I’m a minor or not is: fuck you. It isn’t a harmless question. We aren’t friends, I don’t want an algorithm of news and content, it’s an OS.
But they could also just implement verification now, which many governments are trying to do. The idea that you shouldn't let a government do one thing because they might do another thing is flawed if they could already do the other thing.
The danger of a slippery slope comes when one change enables the next change - for example, a law mandating certain kinds of data collection enables a future decision to discriminate or control based on the collected data. But in this case, no data is being collected, there's no step happening here that enables a more dangerous later step.
If anything, I'd argue this makes it harder to implement more invasive measures later, because rather than arguing that some form of age control is necessary, Illinois will specifically need to argue that age verification is necessary over the existing anonymous system. That's harder than saying "there is no protection for children right now, age verification is the only way forward".
'AnimalMuppet has the right take upthread (https://news.ycombinator.com/item?id=49249774): "Once you accept their right to ask, then you open the door to their right to a truthful answer, and thus to a verified answer.
> But they could also just implement verification now, which many governments are trying to do.
That itself is a proof: the voluntary age declaration was and is common on all the services that governments are now trying to force to do age verification, and it wasn't enough.
EDIT: in more general terms, and going beyond age verification thing and over many recent developments in information security, the Internet as a culture is missing an on-line equivalent to a key real-life social feature: the ability to answer with a shocked "gross!", followed by slapping the asker in the face.
Nope. It's a stupid take. Especially considering over half of the US states have jumped right to looking for that verified answer but no one on HN gives a shit when red states do things. They only ever bitch and moan when a blue state is doing something far less invasive and then they have to turn it into a conspiracy theory that the blue states are secretly trying to do what the red states are just blatantly doing in the open with zero push back.
The slope is only slippery if the change in question makes it easier for future changes to be bad. Otherwise you're only arguing for no changes to ever be made. Does this law make forced verification easier than if this law didn't exist?
Once you go up the first step of a ladder, the second step is now easier. It's a shifting of the Overton window. You can't enact full surveillance in one move - no-one would accept that. You can boil the frog over a few decades, though.
Potentially. The existence of the law exemplifies the idea the law is there to protect someone; all you need then to upgrade it is to argue that the current method is insufficient protection. Spirit of the law has been established - letter of the law will follow.
Seems so - it builds in the verification infrastructure requirement, making it dead simple to change whether it is opt in or opt out at any time.
It's actually pretty hard not to have a change be part of a slippery slope. It requires including blocks for further behavior as any subset implementation is hard to sell as not being a slippery slope path otherwise.
As someone who's pushed on a technical law change.... "easily" DEEPLY, DEEPLY misstates the challenges of getting the law changed. Fun fact: people who oppose something tend to get in the way.
So in red states porn is being used, and in blue states TikTok and Instagram are being used. Is anyone tracking who is behind the concerted efforts here? For example, which organizations, executives, lobbyists and politicians are valid and responsible parties?
Meta is one of the biggest ones pushing for this, because they don't want to be accountable so these types of laws pass the buck onto the delivery platforms (Apple, Google, other OSes)
Meta is then funding/lobbying alongside a bunch of other conservative groups like Heritage Action, and the digital childhood alliance (also made up of a ton of other conservative lobbying groups)
> Separately, and for very different reasons, NetChoice, the trade group that counts companies like Google and Meta among its members, filed testimony opposing the same bill. Its objection was First Amendment law and the risk of exposing sensitive user data, not open source specifically. It’s an odd pairing: a digital rights nonprofit and the lobbying arm for the platforms the bill is supposed to be regulating, arguing against the same bill for opposite reasons. Illinois lawmakers passed it unanimously anyway.
Sure, but Meta also wouldn't mind if age verification of some kind were used, because it would just increase the moat they already have. Meta or Google would have no difficulty complying with any of these laws regardless of how extreme they are, while the mom and pop shops can't comply and are forced out of business.
Tech incumbents whose businesses are reliant on selling ad space need to designate who is a verified human on the internet as soon as possible or their businesses go to zero once the entire web is AI bots and all the traffic is fraudulent and worthless, so they have to play as many angles as they can to achieve this.
That's not how ads work. They're done on a bidding system. If the value of each ad impression / click goes down, the bids will go down, but their total revenue would stay the same. It'd have basically zero effect.
Their website (now offline) also added this page since I posted that comment: https://web.archive.org/web/20260411112604/https://tboteproj... where they claim their website is under "surveillance" because it got a few thousand requests from Google Cloud et al, most of them to a single page. This shows how low their standards are.
These bills all suddenly appeared, as if by magic, in multiple state houses only a very short time after Zuck was on the stand in the Facebook trial early in the year testifying that "the right place to do age verification is in the operating system".
Now, granted, correlation is not always causation. But it sure stinks of something Meta had their lobbyists push just after Zuck's testimony so as to shift the liability risk of handling age appropriate material away from Meta properties and onto operating systems (Microsoft, Apple, Google (Android)).
You raise an interesting point in the first sentence. It might be that age sniffing could actually violate the US constitution.
As for lobbyists: I think we can probably determine the key lobbyists, e. g. if we map the data and names. And ideally also the money given to them. Ultimately they are faceless though, because corruption is easily exchangeable. The issue here is systemic though. The US "democracy" no longer exists due to that corruption. It is not rule by the people but rule by bribery.
IANAL but there have been some attempts to argue that forcing operating systems to add any age attestation etc. is compelled speech. Guess the question is which Distro will foot the bill to test this in actual court.
I used to run a parental controls startup and after talking to lots of parents, I can tell you this sentiment is shared among most parents. Parents on both sides of the isle think they're going to keep their teenagers off the internet forever, I had parents look me straight in the face and say their child wouldn't be allowed online until she was 16.
Parents aren't interested in the nuance of good and bad guys, they see the internet, think it's too much trouble to keep around, and want it blocked. I suspect politicians are just mimicking this sentiment after talking to thousands of parents
> they see the internet, it's too much trouble to keep around, and want it blocked
I can sympathize with this sentiment
in my work and life and personal life the internet is very useful, but as a parent of children and young teens, the internet is really just a PITA that I wish would go away along with all of the games, social media sites, and everything that I have to expend so much energy educating / arguing / instructing / fighting / blocking with my kids about.
It's exhausting because it's everywhere pushing at them from every direction. It's like trying to teach your kids the hazards of cigarettes or vaping to your kids while cool cig pushers are standing in their bedroom talking to them and waiting for them every time they walk out the door.
So yeah, expect exhausted parents who never asked for the deluge of slop, to be supportive of bills -- as ill-conceived or intentioned as they may be -- that provide relief.
And lest you say, "oh but it's always been that way, before this it was the early internet, and video games, and cigarettes". I grew up through all of that, and I can tell you it is not at all the same today. The ubiquitousness of it is what makes all the difference.
I agree with literally everyone who thinks this is pointless and probably malignant. The problem isn't the visibility or the fact that weird stuff "exists" on the internet. The problem is advertisers "showing" it to people who didn't go looking for it. Ads and algorithms that decide what a person to see are 99.8% of this actual problem, and meta lobbying for something like this is just obvious self-interest to absolve them from any liability for showing kids damaging material, and to hit 2 birds with one stone, they get more PII to add to their "anonymized" aggregate data.
No good will come from this for the consumer. Websites are suddenly all going to start accurately reporting their content rating, especially ancient documents that have been "online" since before css and javascript were a thing. The only ones that will be implementing these checks will be adtech people that shouldn't have it in the first place. Letting out of touch geriatrics make tech policy decisions in a time when the bleeding edge is moving faster than ever is going to be disastrous for generations to come.
> Any choice of what content to display is an algorithm.
You could argue about the language and the meaning of "algorithm", but for practical purposes I'd consider a manually-curated feed to be non-algorithmic.
Companies like Red Hat/IBM operate in Illinois and for better or worse have controlling interests in Linux and across open source projects pretty broadly. Wouldn't they be forced to include the capability in their products, which then percolate out to everyone just by network effects?
I don't see how they enforce it though? Isn't this saying every linux instance needs basically a backdoor network access? How would verify the 30 pods on my node are from minors or adults without that? Or this is more about a user facing node? So my aws nodes need to verify my age before I ssh in?
systemd is a massive blob of code that infects every part of a system and all of its subsystems. It completely changed the way system administration was done, the way init scripts work, and added tons of things to init that some argue aren't necessary, like dhcp and DNS.
Newer linux folks like it because they're used to it, people who don't like it use devuan, gentoo, or one of the others that still lets one use openRC or whatever else.
upthread someone mentioned that systemd already has the ability to store the birthdate of a user. Why would an init system need that? It doesn't, but here we are.
Maybe I'm about to be too pedantic, but I never quite got the argument of systemd being massively bloated based on examples of it including DNS and DHCP. Sure it's a mono-repository that includes all these services, but in the end you do run them separately? The actual "systemd, the init system" doesn't have DNS, DHCP or a user birthday database built-in, those are contained in their own services, namely systemd-resolved, systemd-networkd, and systemd-userdbd respectively, and, although systemd does genuinely lead you down the path of using them (which might be a real problem!), there isn't actually a definite requirement to do so. systemd will gladly run your BIND, ISC DHCP and NetworkManager for you if you tell it to, no? In fact we do so at my place of work. Just because they are under the same project as the init system doesn't mean they are one monolith, I think. To me that feels like saying "Why does the GNU C library include a bootloader!".
Now it's not like there's not plenty to dislike about systemd, it is a wide-reaching project that has managed to get a huge mindshare of the lower-level services needed to run a basic Linux server or desktop, and that has caused many utilities and services to appear that have a hard dependency on it, which is obviously bad for anyone running services that aren't part of the systemd package set, just take a look at NixOS, it's practically built purely on systemd, with efforts to support alternative init systems essentially archived at this point. Plenty of people also quite dislike Lennart, or how involved corporations are in the systemd development, and other people have loads of other reasons. One of my own gripes is speed for quite a few basic procedures in networkd. There's enough stuff to hate about it! I think it's not really necessary to pretend that your init system runs a DNS server and stores birthdays.
> Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm?
Phrases can have meanings beyond just a naive combination of the words in them. And indeed "algorithmic feed" in the bill means what what we all understand that term to mean when we aren't paralyzed by pedantry.
> Under the law, [...] these users will only be shown content they request or search for or that is posted by a creator or friend they follow.
You may disagree with the motivation behind the bill, but you do the discussion a disservice to assume the people writing it are incompetent enough to not define their terms.
I think it's pretty obvious that your explanation cannot be complete or accurate. Algorithmic feeds usually have a strong influence of what they want to show you, commonly pushing stuff you aren't interested in, or anything that will keep you on their app/site longer so they have more opportunities to show you ads. There are strong conflicts of interest here.
"most liked" won't work. has to be chronological, and manually curated. the way fediverse works. when you make an account somewhere, you can choose to see the local people, or the entire network, but it's all chronological.
There's things like hashtag searches and whatnot, but none of it is algorithms; in the sense we understand it to mean, here, these are not manipulative algorithms designed to keep people on a site and keep ads rolling by.
on the fediverse, there are bots to curate content such as "most liked", one can subscribe to these bots to see such "views" of the feed.
there's absolutely no reason for any of that crap to be built in, other than that's how reddit (and HN) do it.
There's a "trending" feed on nearly every implementation including the official Mastodon one (hashtags have their own "trending" too), and chronological definitely fits "an algorithm" imo - it has all the hallmark problems of one, such as encouraging bad behavior (frequent spamming is the most effective strategy to be seen). Lemmy is even further down this path, with "hot", "controversial", "active", etc, and defaults to "algorithmic" sorts for its front page and all comments.
Fediverse absolutely has "algorithms". People generally want them. I agree that it's broadly less user-hostile (I'm very much a fan), but it's very much moving down the same paths as twitter (mastodon), reddit (lemmy), etc.
chronological feed nuisances can be blocked or not followed in the first place. It is absolutely not an algorithm by the definition we're all using here.
It is an algorithm on a data structure, but it is not an algorithm to drive ad impressions.
do you see the difference?
this is why people say "Algo" when talking about the latter, and "Algorithm" when talking with other like-minded people about data structures and algorithms.
Someone chose "most recent" when implementing "most recent", and then that decision automatically controls what is shown next. They could have chosen "most recently liked" or "most liked" or "minimum MD5 checksum" or "alphabetical" or "most liked in past 24h" or "likes / hours * followers / followee_ratio * poster_birthdate_days_diff(admin_birthday) * tfidf_rank_matching_books_published_in_1885" - all of those would be algorithmic sorts in my book. "Most recent" is just one (among multiple) of the simplest ones to predict the behavior of.
A fully human-curated feed would not be "algorithmic", in contrast. Print newspapers do this, and sometimes online ones to varying degrees, and most blogs. You could even let people build their own (e.g. "boost to my popular feed [at position X/newest/oldest]"). Essentially none do this though, they all choose algorithmic ones of varying complexity - it doesn't make them non-algorithmic to choose a simpler one.
They want an explanation of what an algorithm is. The world is full of people using words they don't understand and sometimes of them work in legislatures.
> Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm?
That's a paraphrasing of what law says. The law is more clearly defined:
> "Addictive feed" means a website, online service, online
application, or mobile application, or a portion thereof, in
which multiple pieces of media generated or shared by users of
a website, online service, online application, or mobile
application, either concurrently or sequentially, are
recommended, selected, or prioritized for display to a user
based, in whole or in part, on information associated with the
user or the user's device, unless any of the following
conditions are met:
(1) the recommendation, prioritization, or selection
is based on information that is not persistently
associated with the user's device and does not concern the
user's previous interactions with media generated or
shared by other users;
(2) the recommendation, prioritization, or selection
is based on data controlled by user-selected privacy or
accessibility settings or technical information concerning
the user's device;
(3) the user expressly and unambiguously requested the
specific media, media by the author, creator, or poster of
media the user has subscribed to, or media shared by users
to a page or group the user has subscribed to, provided
that the media is not recommended, selected, or
prioritized for display based, in whole or in part, on
other information that is not permissible under this
definition;
(4) the user expressly and unambiguously requested the
specific media by a specific author, creator, or poster of
media the user has subscribed to, or media shared by users
to a page or group the user has subscribed to as described
by paragraph (3), be blocked, prioritized, or
deprioritized for display, provided that the media is not
recommended, selected, or prioritized based, in whole or
in part, on other information associated with the user or
the user's device that is not permissible under this
definition;
(5) the media is direct and private communication
between users;
(6) the media is recommended, selected, or prioritized
only in response to a specific search inquiry by the user;
(7) the media that is recommended, selected, or
prioritized for display is exclusively next in a
preexisting sequence from the same author, creator,
poster, or source; or
(8) the recommendation, prioritization, or selection
is necessary to comply with the provisions of this Act.
"Addictive social media platform" means a covered platform
that offers users or provides users with an addictive feed as a
part of the service provided by that website, online service,
online application, or mobile application.
> (3) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information that is not permissible under this definition;
incoming wave of "follow back"-encouraging UX patterns, "subscription packs", and "you might like [add all]" buttons in 3... 2... 1...
That part hasn't really been decided since it's a regulatory question.
Basically the bill defines
> "Operating system provider" means a commercial or non-profit entity that controls the Internet-enabled device's operating system, including the design, programming, or supply of operating systems for the Internet-enabled devices.
Which is an extremely broad definition that could be interpreted in a whole bunch of ways.
The relevant text doesn't call it an "algorithmic feed" for what it's worth. They define an "addictive" feed and it's essentially any kind of personalized recommendation.
> "Addictive feed" means a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met.
It seems that it mostly bans behavior-based personalization that is opaque to the user. It seems to allow for several types of personalization where the user has agency.
Serious question: This is a out-of-box "ask for age" requirement. No one is "verifying" anything. Why are we using this misleading headline? Face scans, ID cards, all that stuff that makes everyone nervous, are specifically not a part of this. To imply that it is verification is propaganda.
As a parent, I'd be very happy with this "age declaration" method, as I also don't think the 'verification' others push for is at all worth the risks. All parents want is to put the devices permanently into a mode that flags it to third parties as belonging to a minor, so they can't just hold up their hands and say "idk they said they're 18" like they do today.
It moves the Overton window, making worse things easier to pass in the future. And it enforces requirements on projects the state should have zero jurisdiction over.
Step 1: Shift the burden from service providers to OS providers (on devices owned by individuals).
Step 2: Recognize that the system is trivially bypassed by a kid who sets up their own device without their parents' oversight or parents who just think this is a stupid law and lying for their kids. Or bypassed by anyone using open source operating systems which are (for a feature like this) going to be trivial to amend to always claim the person is an adult regardless of which account is being used.
At this point there are three possible futures that are worth considering:
1. Throw out the rules because they're stupid and everyone with any common sense or sense of decency has been saying it since the start. The service provider is responsible, not the OS developer or device manufacturer. (Best case)
2. Keep the stupid rules on the books and pretend they work. Let the service providers off the hook. (Second best case)
3. Create more rules that effectively cedes more control of personal devices to the government to make this actually work, but the effect of this is to essentially outlaw OSes like Linux and many, many devices and even raw hardware without a government permitted OS pre-installed. (The worst case)
(3) is extreme, but it's the only way that this law actually has the desired effect. (1) and (2) are the most likely outcomes, but reflect that this whole exercise is just a waste of time.
Your Step 2 assumes complete idiot parents. Parents who hand their kids a new device without adding any parental controls (A) are already in the minority today - I know a lot of parents and none of us would do that, and (B) can't be helped anyway under any scheme other than invasive identity "verification" (which this law isn't).
> bypassed by anyone using open source operating systems
You know what? If millions of tweens develop a keen interest in building Linux and Firefox from source just to get "the good TikTok" I'm fine with that. In reality 99% of them use iOS and Android nearly exclusively, so Linux is irrelevant to the conversation.
> The service provider is responsible
We tried that. That's the status quo. There are only two options I know for this, both stupid. 1. (the current model) Just trust the user. Talk about 'trivially bypassed'! 2. Invasive ID checks - with the camera, identity documents, and government databases.
If parents want to go out of their way to irresponsibly give their kids unmonitored access to content that is bad for them that's on the parents. If you try to make service providers "responsible" for it, they WILL build invasive, corporate-controlled systems to cover their asses. Basically option 3 but controlled by shitty companies that get hacked, instead of even a theoretically accountable government that will get hacked. Note that I am not saying your option 3 would be acceptable, just that a private version of it would be even grosser.
> Parents who hand their kids a new device without adding any parental controls (A) are already in the minority today
If this were actually true then the law itself isn't needed because kids are already getting filtered access to social media sites and other things. Right?
So then what is the point of the law if parents are already setting age filters for their children's devices?
> The signal itself isn’t a birthday, it’s a bracket: under 13, 13 to 15, 16 to 17, or 18 and up. Operating systems have until January 1, 2028 to have this built.
> Nothing in the bill requires a passport scan or a face scan at setup. It’s self-declared, the same way most apps ask your birthday today, just centralized once at the OS level instead of repeated app by app.
Maybe this is just a badly written law or purposefully designed to have basically no impact on anyone?
Or maybe the age bracket self-declaration part of this might make it a legitimately useful mechanism when a parent sets up a device for their kids. Their device declares “under 13” and apps and sites have to then follow the more strict social media laws which themselves should be relatively beneficial to the target audience.
In other words, the part that’s really privacy-destroying is the age verification, but that’s not part of this bill. The part that could be a benefit is the part where companies need to respect an age flag set by parents and comply with a concrete set of parental controls.
In other other words, it’s not left up to operators like Meta and Roblox to decide what age their users are, parents can set that device-wide and know it can’t be circumvented.
I love how everyone knows this has nothing to do with kids safety. However no one can or is willing to put up a fight. In the UK where I live its the same. Government does whatever they want and most of us just shrug our shoulders and say "that's messed up" and go on about our day.
The reason is ridiculously simple: people don't put up a fight because they don't want to be labelled as a peto or as someone not in favor of the protection of Children. This is primarily why this cudgel is brought out so often: it's very difficult to oppose because you risk getting shunned for it.
The UK is relatively small and I see surveys suggesting 70-80% of the population think the country is on the wrong track. Perhaps you should have a national strike or something, make the politicians come crawling to you instead of the other way around.
Don’t worry. It will all burn down soon. This administration is preparing the narrative to "cancel the midterms" if they lose the senate and house. Using the illegal war as cover.
Nothing in this bill requires age verification. It just requires the OS to have a way to specify the user’s age (not necessarily an exact birth date), so that it can be provided to apps and websites that ask for it.
Legislating that all complex computing devices must give out your birthday (technically a "signal" of which bucket you're in, but sites are absolutely going to keep track of which bucket you where in, keep asking, and see when it changes).
It's constitutional case law that there's an implicit right to privacy in the constitution. I don't see a law that you must wear a band with your birthday out in public passing muster based on that. I don't see why existing in cyberspace changes the inherent privacy question, and in fact makes it more meaningful given ease of automation.
> It's constitutional case law that there's an implicit right to privacy in the constitution.
Constitutional scholar here! I mean, yes, that's true in a very general sense, but no court has held that age verification to gain access to a service, or even a device, is unlawful in practice.
Novice, but I'd argue that Dobbs has seriously eroded that case law. The right to privacy used to be pretty settled law, but now the foundation of that settled law is on sandy ground.
It was never really all that settled, IMO. Roe v. Wade (which is now dead) was built on a pretty shaky foundation that was inspired by emanations of privacy rights like the Fifth Amendment, in the absence of clear Constitutional language that made a privacy right explicit.
You don't have a right to privacy. It should be covered under the 9th amendment, but the supreme court generally just ignores that amendment.
Edit: I see people don't like this comment, so here's an article about it from Wex law [1] (read under "Roe's Overturning"). The part of the Dobbs decision was removing a right to privacy and promising that it could be revisited in overturning other cases like Griswald.
The 9th amendment has never been used to establish a right to privacy, but then I don't think the 9th has ever been used to establish any right. We've used the 14th in the past to establish that right and now it seems that's no longer good law.
> While it is unclear to what extent that may have on the right to privacy in the current time; it is likely that the case law around this right will continue to evolve with more recent Supreme Court decisions.
I don’t think the Supreme Court as a whole wanted to overturn Griswold. At best, specific justices like Clarence Thomas wrote in a concurrence that he would want to overturn it, but that’s still far from the opinion of the court. Given the character of Thomas, it’s safe to say that most of his opinions don’t become opinion of the court.
Cool. I'd like to propose a federal law wherein every lawmaker, state or otherwise, musts either demonstrate they correctly enough understand the subject they're legislating over (for every single instance of legislative act they perform) or get approval from an actual accredited expert panel before being allowed to push any more inane bullshit that will help noone in the future.
Thankfully for now this dragon is a hydra. Too many paths to block for now. The whole TPM fiasco with windows is preparation to put the genie back in the bottle. Soon, much sooner than I would like you will need a Global ID to access the internet, which will require an "internet safe operating system". It's only a matter of time. Get your sneakers ready folks.
Does it even ask for verification? If not, the problem with it is that it seems to require the OS provider (not the local installation) to store the age.
> "Nothing in the bill requires a passport scan or a face scan at setup. It’s self-declared, the same way most apps ask your birthday today, just centralized once at the OS level instead of repeated app by app."
I think this is a bad thing overall, but if the OS is responsible for reporting my age, that means I get to pick my own age... I'll take what I can get.
Some states will pass laws that companies cannot show advertisements to minors. So...
I think I'm about to become a bit of a minor myself, at least whenever it serves my interests.
However, unlike GNU plus Linux plus systemd plus FreeDesktop.org, it does not constitute a usable Operating System for a Desktop computer per se. Merely having a notion of userland isn't sufficient! Is age verification to be placed within the coreutils? I think not! Hyperfocusing on putting the API in systemd should be sufficient....
Pay no heed to anyone saying anything different, regulators!
I would like to take a break from all the complaining and point out how hilarious it is that this law does not apply to any computer that can only connect to the internet via an Ethernet port.
> The bill’s own text caps penalties at $7,500 per affected child.
If the distro does not ship with any hardware, it could only be attained via download? So how would this imperil Linux distros?
Not to defend the law, it's comically pointless. Conservative states demanding ID verification for anything 'pornographic' and progressive ones trying to limit anyone under 18 from having any social media access at all. Clownish.
Can someone tell me why all of the sudden everyone's totally cool with letting political hacks choke the internet to death?
We used to make fun people like Ted Stevens for calling the internet "a series of tubes" and now we're just totally cool with letting a failed, bankrupt state in the US dictate what code needs to go into voluntary open source software. We need to fight back, now.
So presumably the next step is they move their servers out of the US and then DA's target the Linux Foundation directly (e.g., coerce the kernel to take a change by some Meta engineers that "attests" a device when said option is compiled in, then force it as default on.. so in Debian you'd get an "Illinois"-kernel variant).
At which point the only move is to relocate the foundation to another country, which will then of course be hit by tariffs and sanctions.
There are 189 active legislative bodies to choose from; it's hard to imagine, but yes in the worst case they all fall in lockstep on this issue and none of them provide this kind of freedom. The obvious next step is to buy a remote island (better yet: some foreign body in Space) and form "Freedom (tm) Republic".
Remember that "pirate" guy buying an oil rig and building "freedom" crypto / torrent "country" there, with Datacenter running on the rig? That did not end well. Another case is Kim DotCom. And just look at the "success" of UK's freedom.
TBH, we all are f...d.
Ok so, all the appliances and cars and TVs and who knows what other embedded electronics sold in Illinois will require the user (?) to verify their age?
Here's my slight defense of something like this, in theory. I have not read the text of the bill.
If OSes build a standards-based way to query age of user that is logged-in, where non-admins are not allowed to adjust the age bucket, then parents can configure devices on first use to have an OS-wide enforcement of age controls.
Apps and sites would query the OS, not individual app/site accounts, for user age and act accordingly.
Apps can then lock out certain features like algo feeds and adult content more consistently.
Responsibility for proper use is still on the parent, and no verification process is put upon the operators of sites.
Not sure how I actually think about this; I'm only putting this out for discussion.
I would disagree. First, passwd(5) is a venerable and rigidly-defined format. Can we please stop abusing poor GECOS for everything?
Second, storing PII in a world-readable file is unacceptable. Linux is multi-user so the administration needs to be responsible about sensitive data like that! Find somewhere else to stash it!
This will end Linux as end user OS, it will stay only in Cloud and containers. Arguably, the goal here is to destroy home PC altogether. maximum we will be allowed is a laptop with endpoint verification and mandatory touch ID, locked boot and non-replaceable hardware. If you think Linux is the end of it – think again. The same crap will be implemented in BIOS/UEFI, on "HW management" level. Essentially, your bare HW only laptop will not even start without you touching fingerprint sensor and allowing it to "validate your age" against – of course government approved – HW manufacturer.
Same with smart phones – it's already here, if you tried to activate iPhone.
And projects like Open/Free BSDs? Government will sure their leaders happily retire and ... well, the community will just "die" naturally.
These laws are so short-sited and willfully ignorant of the unintended consequences. The constitution provides rights and protections, and the government cannot compel speech. This will be appealed on consititional grounds and reversed. If not, I'd ban any Illinois resident from being able to use the site and redirect them to their local government representation. Compelled speech is just one attack the law is open to.
Illinois can put up a great firewall like China and search citizens devices for contraband operating systems. The onus is not on tech to enforce it, it's on them.
Unpopular opinion, but this is objectively better than having to upload your ID to every random website that requires an age check (if that's what the end result is).
In the sense that a website could just ask your OS if you are over a certain age and that age was self declared? That seems fine to me, but why can't the websites just ask me for my self declared age?
That's how things used to be and that makes more sense in my opinion because an OS isn't the thing displaying content. It just run whatever it is told to run.
>but why can't the websites just ask me for my self declared age?
Because children just click through the age gate when it suits them. With this legislation, a parent that purchases the device and creates an account for the child can set the age once and take the decision out of the kids hands. It's a huge improvement without any significant privacy issues. I can't fathom why the tech crowd is having a collective aneurism over this.
>OS isn't the thing displaying content
But the account on the OS is the right place for the single source of truth of properties of the current user.
Also children can "come upon" devices, so this is still completely pointless unless there's a way to ban devices that don't have this ability. and the only way to do that is to ban devices that cannot verify the user's age. since a device can't really verify an ID, some third party (ideally meta, but also the government works) needs to verify id and age, write something to the secure enclave of the device, and now that's stuck with the verified age set.
If "just let someone report the age" worked, pornhub wouldn't be blocked in TX.
How do you propose that a child's device will remember their age in a "legally distinct" way for the life of the device? You ought understand what i am asking here, as it directly follows what i said before. You have a child, somehow the device knows how old the child is. An adult sets it? great. What if the device wasn't set up by a responsible adult?
You don't foresee a black market of "no-age-audit" devices? How do you prevent that? Well, one way is to use the secure enclave and write the birthday in it so that it cannot be tampered with. How is that written? who writes it? Who verifies the ID?
TX passed a law stating that adult sites like pornhub must verify age. I hope you understand what "verify" means in this context. It isn't "i promise i am over 21 or 18 or whatever" - because if that worked, TX lawmakers wouldn't have made the law say "verify" https://journals.law.unc.edu/firstamendmentlawreview/screeni...
In the future, casual dismissals are viewed negatively.
I really don't know where you're coming from. You seem to be imagining that the law requires some kind of cryptographically validated age attestation. The law requires nothing of the sort. It's just an age field associated with the account. There are many ways to get around it, none of which the law demands protection against. It's simply a standardized way for parents to ensure a modicum of reasonably effective age-discrimination for online services.
There are no secure enclaves, no verification, and certainly no black markets. I really don't know where you are getting any of this from.
>TX passed a law stating that adult sites like pornhub must verify age.
Yes, when states are left to their own devices to come up with laws, some of them will be more onerous than others. But I don't know what you think you can infer from this. Casual dismissal was warranted.
that you know of. when you were 11 could you get root? I could. I got expelled from a highschool for getting "root" on a DOS machine by holding down the shift key (at 13).
All it takes is one moment of weakness from a parent or not blocking the kid's view of the keyboard, or the kid getting an app that figures out possible passwords from keyboard sounds (it'll be here someday), or any manner of other things, like you forgetting to close your session.
11 year olds aren't stupid.
also there's nearly weekly exploits that get your root on a linux machine, so unless you're blocking arbitrary code downloads, which means you're going to have to whitelist sites you allow your kid to visit, which means they're probably just going to get that stuff elsewhere, as is customary. Again, 11 year olds aren't stupid. any one of them could tell another "here's a script that gets root" and spread it around school. If it became a thing.
I just had a vision of linux being outlawed because it's too insecure
Instead of the client sending the user's age to the server, why not make the server send a minimum age to the client? The client is welcome to block content without disclosing personal information to the server. This is as secure as sending an unverified age to the servet.
Because the requirements being placed on social media sites are much more nuanced than simply allowing or blocking content... to implement this all in the OS or browser would require an exponentially more complicated API.
Come on. Now you get face and body scans. That's not better. And when the machine randomly selects you, you take off your shoes anyway, and then they frisk you.
This is worse than the California one. Since this applies to all Internet-capable operating systems, it's effectively forcing people to utter their age bracket in order to communicate digitally, which is compelled speech - a violation of the First Amendment.
Here's an idea for the lawmakers that actually want to solve the digital parenting problem: fix the mobile OS duopoly with antitrust. Most kids only know how to use touchscreen devices. If you force mobile hardware vendors to ship smartphones without an OS, then we will get plenty of forks of Android and even entirely new OSes as a result of natural demand, some of which will be toy OSes with all of the child features built in. We'll also get scam-proof OSes for the elderly as a bonus. There is no good reason for the entire population to use the same OS.
when it comes to commerce it isn't because it makes doing business impossible. How is this practically going to look, Canonical, Red Hat and open source maintainers are going to ship 50 different Linux distributions in the United States?
The reason the US has fairly robust interstate commerce laws is because if you don't you'll have trade barriers between states. Even the most well intentioned internet company can't operate in that ecosystem
Yes the constitution specifically identifies commerce as something Congress has the power to regulate. That doesn't mean states can't have their own rules. Many states have various forms of legalized cannibis, different laws regulating firearms, or automotive emissions.
These laws still do not sit well with me. This is just going to create endless lawsuits. In my opinion the safer choice would be to avoid doing anything with current teens, that's just a non starter. Instead think of sliding windows of time and sandbox small children on a child account that if all goes well will one day be a teen and then an adult. They will thank you when they are an adult for looking out for them when they were too young to consent to the data leaked by these laws.
Why not just signal age ranges? Simple, the way the legal system works is one puts in a benign sounding law, then tweak it every year since the mechanism exists. (scope creep)"Now add city, state", "Now add DOB and address", "Now add your federal wallet ID."
- For small children set an RTA header (previous discussions) [1] for any URL that may potentially contain content not appropriate for small children. Give site operators 1 year to implement this. Not counting QA and change control this takes minutes.
- Require app and device vendors to create a properly sand-boxed child account. Pen test it but it does not have to be perfect. This is for small children and default installed applications. If the child visits a URL that contains the RTA header then trigger parental controls. It is entirely up to the parent when that child is ready for mature content. It must be impossible for the child to install any applications, addons, etc... There are a myriad of ways to accomplish this.
- How is this enforced? Same way as any other parenting issue. If there is an incident that involves law enforcement, then social services can investigate and determine if negligence was occurring. When the child is mentally mature enough to deal with all the crap that is the internet their account is converted to an adult account. If the parent is giving the child an adult account before they are ready then the parent(s) go to mandatory parental training. If the child was being bullied or groomed, redirect law enforcement to go after the bullies or groomers.
- Set the laws to be active for any small child that would be under 13 as of the year 2034. Presto! One need not try to confine teens. When these small children are teens they will either be used to the sandbox account or the parent may have converted the account to adult.
As a side note all public and private schools should be legislated to have classes on dealing with all the crap the internet has to offer. Bullies, Cry-bullies, Trolls, Groomers, Scammers, Devious companies, Astroturfers, Gas Lighters, Propagandists, NGO's and so on. Also teach and help them build friend networks so there is protection in numbers. No child should be friendless.
> Why are you people in such a hurry to have facebook et al collecting government IDs?
I want kids off social media. I don't care what happens next. If we're really concerned about this, also make it a legal liability for social media companies to retain IDs collected to verify age.
I predicted this would happen. Others also predicted this would happen.
I think now even the last person realises that this has nothing to do with age "verification". They simply hate us for our freedom. And it is clearly a move coordinated by private business here; their lobbyists are acting. This is also why it is the same law essentially in so many different countries at the same time. It is quite fascinating to watch, actually. People used to say "conspiracy nut!" - well, the facts are too clear now. That's no longer a conspiracy.
Linux distro founder here (stagex)
I will never be compelled to implement this, and would never merge it.
Every release requires quorum signatures by an international maintainer team, and the distro is designed to work offline-first, with some variants not even supporting network drivers in the kernel, so Illinois legislators can eat shit.
RedHat/IBM does have an Illinois presence so will likely be compelled to add it to their distro, and will likely do it through systemd. So to avoid it getting into any consumer distro you'd have to ship a patch to remove it from systemd.
This is probably all completely irrelevant to StageX since it's a distro designed to be used in containers, AFAICT.
Fortunately patching out such nonsense is as easy as running a few commands.
Project tracking these laws and providing patches as needed: https://agelesslinux.org/
I run stagex on servers and workstations baremetal, however admittedly minimal. It can run lots of ways.
IIRC systemd already started implementing some hooks for age verification API
systemd added a field where users can add their date of birth. It's completely optional.
It's not implementing age implementation, but can be used as a place to store a DOB in an age verification system.
NB that you could already add your own freeform fields; it just added that field to userdbctl and friends.
AFAIK they were implemented by Microsoft staff.
It was not. It was implemented by Dylan Taylor, an outside contributor who works at a fintech company in North Carolina, and has made it his hobby to submit PRs implementing age verification to all kinds of projects. The systemd maintainer who clicked "merge" (Luca Boccassi) does work at Microsoft.
Sounds like Dylan needs a better hobby.
how would it work in the age of everything virtual, from containers to VMs, even an OS instance running in a browser, with OS/kernels being spanned in sub-seconds and existing even for just one call with no user interaction. Are they going to inherit age bracket from supervisor/parent process? Which of course wouldn't work for AWS/GCP, and many other cases. It looks to me like it would require something similar to security labels implementation.
Simple. If unconfigured, user birthdate should default to 1970-01-01
No. The stupid-ass law [1]:
> "Internet-enabled device" means a smartphone, tablet, or personal laptop or desktop computer that provides cellular or wireless connectivity, is capable of connecting to the Internet, runs an operating system, and is capable of downloading and running applications.
Enumerate all network interfaces. Are any of them cellular or wireless? No? Then the law doesn’t apply.
[1] https://my.ilga.gov/documents/legislation/104/HB/PDF/10400HB...
Finally, my insistence on wired Ethernet pays off.
It sounds like you could even get away with a wireless USB dongle, as it’s not part of the computer.
Probably stuff it KMS and expose via EC2 metadata...somehow
Maintaining forks is pretty trivial now with AI.
If you're in the USA or plan to visit someday, I would recommend you speak with your attorney before making such commitments.
I am in the USA, but I literally cannot comply because by design it is not possible for me to ship changes without the international maintainer team agreeing to them. And Illinois legislators have no power over them.
Also, we are not a company. We are an independent community owned project. Our code is free speech and I will burn the world down to defend that right.
Truly I dare someone to try to take me to court over this. Would be great publicity for our coercion resistant approach.
They might as well try to mandate code changes to a blockchain and mandate the whole world host them.
There are a lot of remedies available to a court with respect to a recalcitrant party, ranging from an injunction to remove your product from the market to fines and imprisonment. Again, speak with your attorney. Do not try to "hack the law" yourself; many who have tried have regretted it later.
No need to hack the law. Our FOSS code is constitutionally protected free speech and I would defend on those grounds.
The technical design of the project just makes it so no one can force changes on the distro unwanted by the maintainer team regardless of any courtroom outcomes.
Like, what if someone made a law that said Bitcoin nodes must KYC? They could make the law I guess, and the international network operators would just laugh at it.
> Our FOSS code is constitutionally protected free speech and I would defend on those grounds.
You have precisely zero additional speech rights as a FOSS project than any other organization has. If "free speech" was a valid defense for you, then Meta would be doing the same.
> The technical design of the project just makes it so no one can force changes on the distro unwanted by the maintainer team regardless of any courtroom outcomes.
Being unable to comply is not a valid legal defense.
> Like, what if someone made a law that said Bitcoin nodes must KYC? They could make the law I guess, and the international network operators would just laugh at it.
This is the law in various places under various mechanisms. It is handled by putting people in prison or taking people's assets.
Okay well if they want to jail me for being unable to comply with violating the privacy of the users of the Linux distro I work on it. Cool, I guess.
They would sure be wasting a lot of resources and public goodwill with absolutely no positive outcome for their agenda. Which is why I do not think it will actually happen.
But if it does, it does. Not going to live my life in fear, I have more security and privacy tools to ship :)
I don’t think they’re going to spend any resources on going after you because:
* your project might not even qualify under the text of the law
* even if it did, the number of children using it to access social media is likely zero
Oh, we will be supporting desktop/ubuntu style use cases soon. Position will remain the same though. And, agreed, they will still ignore us. But sick of seeing bigger projects cave to this nonsense.
But, none of this was about protecting kids. It never was.
Unless the PGP decision has been overturned, code as free speech is in fact a valid defense. If the government couldn't stop code they claimed were "munitions" from getting distributed, then it seems unlikely that they'll stop a Linux distro.
Corporations do whatever seems most profitable. We can't base our understanding of constitutional rights on whether Meta decides to defend them.
There was no "PGP decision." You're making that up.
Maybe try google before making statements like that. The decision was Bernstein vs. US.
Prior to that, export controls prevented PGP source code from being exported from the US. Advocates printed it in books and exported those, which helped clarify the issue.
Bernstein was a math student who made his own encryption software. The government tried to make him register as an arms dealer, and he sued in 1996, with the backing of the EFF. The result was a landmark decision that established source code as free speech and basically destroyed export controls on cryptography.
In 2016, Apple cited the decision when the government tried to hack a suspect's phone, saying they couldn't be compelled to "speak" by writing code.
It is you who needs to do your research. That was not PGP. The Bernstein case was about Snuffle.
In that very same case, the Ninth Circuit Court of Appeals said:
"We emphasize the narrowness of our First Amendment holding. We do not hold that all software is expressive. Much of it surely is not. Nor need we resolve whether the challenged regulations constitute content-based restrictions, subject to the strictest constitutional scrutiny, or whether they are, instead, content-neutral restrictions meriting less exacting scrutiny. We hold merely that because the prepublication licensing regime challenged here applies directly to scientific expression, vests boundless discretion in government officials, and lacks adequate procedural safeguards, it constitutes an impermissible prior restraint on speech."
Yes, I mentioned that Bernstein made his own software. But that was in the context of a huge public controversy over encryption regulations, mostly focused on PGP, and after the Bernstein decision, the Clinton administration eased up on export restrictions and moved them to the Commerce department. Junger vs Daley strengthened the Bernstein decision, ruling that all source code is protected speech.
https://en.wikipedia.org/wiki/Junger_v._Daley
Yes, Junger v. Daley held that source code is speech for the purpose of First Amendment analysis in the Sixth Circuit. (The question has not yet been presented to the Supreme Court.)
But the inquiry doesn't stop there. First Amendment jurisprudence doesn't stop at asking the question "is this speech?". That's just a threshold question. If the answer is "no," then the case is analyzed one way. If the answer is "yes," then the case analyzed a different way. Think of it like a decision step in a flowchart.
Code being treated as speech doesn't automatically mean that software developers can do whatever they want, just like it doesn't mean that people who write, draw, make music, etc. can do whatever they want. It's not the magic unassailable defense you claim it to be. Courts will apply a balancing test to determine whether the Government's interest in prohibiting the speech outweighs the Constitutional interest in protecting it. The answer comes out different ways depending on the facts and the law, which is complicated.
For example, it's unlawful to make and distribute CSAM. It's unlawful to defame someone. It's unlawful to defraud someone. It's unlawful to violate others' copyrights. You have to label food and medicine a certain way. These are all forms of speech, but the courts have held that none of these restrictions (or requirements) violate the First Amendment. And I don't think we'd all be cheering someone on and claiming "code is speech" for someone who writes ransomware or software whose sole purpose is to drain your bank accounts or shut down power plants.
I didn't claim it's a magic unassailable defense. I claimed, contrary to the previous comment, that it's a valid defense. Maybe the courts will carve out a new exception for some particular type of code, maybe they won't, but what they certainly won't do is laugh at you for defending your code on free speech grounds. Just because a legislature passes a law doesn't mean the courts will agree that the law is valid under the Constitution.
And the bar for compelling any particular speech is generally quite high. Apple could not be compelled to put a backdoor in an iPhone, even though the suspect was the San Bernardino shooter, and this did not result in Apple losing their ability to sell iPhones. The courts may well hold that you can't compel a Linux distro to implement a particular feature either.
This may be a matter of semantics. To me, a “valid defense” is a defense that always prevails—for example, that truth is a defense to a defamation claim in U.S. law. The rest, I call “possible defenses.”
Another possible definition, one you may have meant, is that there's a set of "invalid defenses" that could not possibly work, and the remainder are "valid" even if they might not prevail.
That wasn't PGP, it was Snuffle.
Correct. This is so wildly misunderstood. Zimmermann was investigated for 3 years but formal charges were never filed.
> Being unable to comply is not a valid legal defense.
Sure it is. Lawyers even have a pithy Latin maxim about it: lex non cogit ad impossibilia.
If you could stop doing that thing, it isn't an impossibility under lex non cogit ad impossibilia.
what could they be compelled to stop doing here? Mechanically speaking, I mean. I can imagine fines or contempt of court, etc
But how would you remove an international distro from "the marketplace" if it's free and not operating a business?
It's not that complicated.
If there's a law that says "Anyone who distributes X must also Y" and you can't figure out a way to continue distributing X while also doing Y, the way you comply with the law is that you stop distributing X.
"Distributing" is doing a lot of work here.
A file hosted on foreign server might functionally be a system to "distribute" that file, but it is doubtful if a US state could prevent it from existing.
They could theoretically order US ISP's to cease providing access to said file, but that's a rabbit hole I'm not sure that Illinois or any other state really wants to go down.
Yes, most any law is primary enforced against people within the same legal jurisdiction. It matters less where the server is and more where the relevant people/organizations/assets are.
Major OS providers, including major Linux distributions, are all within reasonable reach of Illinois law.
It’s probably less relevant if you’re a hobbyist working on Hannah Montana Linux on the other side of the planet.
None of this answers the question: even if @Irvick stops distributing or participating in any way with this "stagex" distro, that "stagex" distro continues its life outside of the jurisdiction, at most you start treating it like contraband drugs within your jurisdiction.
With LLM's anyone will be able to disengage such "default wars" in popular software, so there isn't really any border control when LLM's form a large surface area of the border.
That’s always been the case for things distributed on the internet. It’s irrelevant in terms of evaluating one’s personal compliance with the law.
If anyone is distributing it within Illinois jurisdiction (or maybe even distributing it elsewhere while maintaining a business presence in Illinois), they could be at risk of qualifying as an operating system provider under Illinois law.
How does that work with data on a server outside of the jurisdiction, that’s freely available to download and re-upload? The ‘local legal presence’ thing might work, but then what if they only distribute it on (say) a thumb drive, sent outside the jurisdiction, which is then uploaded by a third party? This whole thing seems unenforceable (or worse, arbitrarily enforceable).
A court will care about what you do in the jurisdictions where it has power over you. What anyone else does is their problem, not yours.
Some oddball Linux distro really has no relevance to the larger picture that lawmakers are trying to accomplish though. The vast majority of kids are using iphone/android/mac/chromebook/windows. Basically zero are using esoteric container images to access TikTok.
But wouldn't this type of law drive youth to using more exotic distributions to get around the issue? It's not far fetched to think that kids will just live boot from tails or another distro to visit socials and circumvent this rule. Plus with unlocked pixel bootloaders it would be trivial for them to petition their parents for a pixel, hard reset it, unlock the bootloader, install grapheneos via the web installer, and then be on their way. If parents don't know how to monitor their kids I doubt they'll notice grapheneos not being base android.
Same way anything else gets pulled from distribution. You shut down the servers, destroy keys, remove files, etc. Sure, the files may remain in circulation from unofficial sources, but that's not your problem, as long as you're no longer facilitating it.
> If "free speech" was a valid defense for you, then Meta would be doing the same.
Meta lobbied heavily for this. The fact that they have not decided to use free speech to fight the move that they are lobbying for is not an argument that free speech is irrelevant here.
This is not legal advice but a personal request: please do not get your legal advice from Hacker News. Get it from a lawyer.
Alright, then let me rephrase:
> If "free speech" was a valid defense to any legal compliance laws that affect software, then any software company would raise this defense this rather than comply.
And in fact, Apple in 2016 went to court rather than comply with the government's order to put a backdoor in the iPhone, and they argued their case in part on free speech grounds.
Whether other companies do the same depends on what they consider the most profitable path, including legal fees and risk.
Don’t read too much into the Apple case. There was no precedent set by that. The FBI withdrew their demands after they found a different mechanism to obtain what they needed.
Meta is a company. I am an individual.
>If "free speech" was a valid defense for you, then Meta would be doing the same.
Is that some sort of in joke? Meta loves more surveillance, more data and more info about their vassals^W users.
I'm sure their lobbyists were pushing hard to get this law passed.
The concern here is probably with the shipping of the product (i.e. the binary artifacts), not the code itself. I can imagine a situation in which you could continue to make the code available, but could not produce a shippable artifact from it that Illinoians could access.
If they are successful at doing so, then those distribution methods were too brittle.
I expect in response one of the maintainers outside US jurisdiction of their own volition publishes via bittorrent, tor hidden services, and embedding blobs in public blockchains with no help from me.
Then the problem the legislators sought to solve just got a lot worse, while calling a lot of attention to how little power they actually have to control decentralized FOSS software projects.
Of course another point of the project is building the entire thing from source code with deterministic results only takes a few hours. For many, this would be faster than downloading artifacts.
It is not needed for maintainers to publish binaries at all. Publishing signatures on the expected hashes would suffice at worst.
The person you replied to is using "could"/"could not" to mean "would comply with the law"/"would not comply with the law"
Nobody here is saying that anyone is going to swoop in and physically prevent this software from being distributed on the internet.
> Then the problem the legislators sought to solve just got a lot worse, while calling a lot of attention to how little power they actually have to control decentralized FOSS software projects.
The legislators who passed this don't give a shit about that. Their intended target of this legislation is mainstream devices and mainstream users.
Agreed. They are never going to actually come for niche Linux distros. All the more reason I am pushing back on all the fear.
The correct response from the Linux community is to say "fuck off", and get back to making their distros more secure, more private, and easier to use.
Major distros will comply because they want to sell their services in Illinois.
I don’t think noncompliance of a container image is much of a “fuck you” since I don’t think lawmakers have ever heard of you nor would they really care about your compliance anyway.
This bill is primarily about kids using smartphones.
Containers, desktop, server. We do all of it.
Anyway. Kids are an excuse to get it passed. It is about testing the waters of how much control can be exerted by government on end user devices, and we need all maintainers to hold the line.
It's easy to be an Internet Tough Guy when you have nothing to lose.
I see you’ve moved on to personal attacks, failing the “friendly advice” angle.
"Don't be an Internet Tough Guy" is among my friendly advice. People can see right through it, and it often works against you.
Technical solutions may be seen as kindly as handcuffing yourself to something when told to leave. "I can't, I've made it impossible for myself to obey the law".
They might not be able to break your private keys, but they can fine you or jail you for not complying.
I could, at worst, resign from the project. International maintainers would carry on the work, but I will never be compelled to write code I do not wish to write.
> No need to hack the law. Our FOSS code is constitutionally protected free speech and I would defend on those grounds.
"Der Proceß" [The Trial] by Franz Kafka is just a realistic description of the court system (Franz Kafka studied law).
What if you "complied" and released your personal version/fork with age verification that no one would use?
I could probably play games like this, but I outright do not believe this law is constitutionally valid, and believe it must be challenged by anyone they try to wield it against.
I would refuse to even give the appearance of compliance in hope to motivate others to do the same.
> Again, speak with your attorney. Do not try to "hack the law" yourself; many who have tried have regretted it later.
Also reach out to the EFF, who may be able to help/advise, especially if you genuinely want to fight this.
This is a terrible law. That doesn't mean it's not a law, and courts do not look kindly on people subject to their jurisdiction (which unfortunately often includes state laws to people in other states) who try to dodge the responsibility the court thinks they should have.
If someone is stupid enough to try to target me over my open source Linux contributions, the EFF would be my first call.
Or maybe we're at the point where we'll go to prison because of unjust laws.
You first!
With all due respect I sense that you might be neglecting the big picture. Unjust laws, slopped out illegal orders and an extreme activist court are all in play.
Those are valid opinions. However, I also see a lot of bluster here about going to prison for their beliefs from people who wouldn't last a minute behind bars.
People used to have to die in masses for freedoms in this country. If the worst thing one could face for defending freedoms is some jail time until bail gets posted while the law determines their innocence then anyone who caves to pressure anyway is a complete coward.
And, since you seem to be making assumptions about what people you know nothing about could or could not hypothetically handle, maybe look a bit closer at my history. I have survived WAY harder shit than sitting in an air conditioned box with 3 squares a day for doing what I thought was right, so even if the threat of jail was credible, it would not deter me.
It is the bluster of people that think I even could be jailed for something like this that I am most amused by.
Truly it is fascinating and a bit sad how much fear there is in this thread over upsetting some state level officials.
Given your comment history, I suspect that you are sympathetic to these laws and you’re trying to prevent people from opposing them, using your “friendly advice” as cover.
Believe it or not, there are plenty of people in the US willing to go to jail (or worse) for their beliefs. It’s kind of the founding mythology of the nation.
US history is full of people who successfully challenged violations of their rights and government overreach. Success isn’t guaranteed, sure. It never is. But cowering in fear because the tyrants might put you behind bars is downright un-American.
Not at all! I think these laws are dumb and I don't want my state to pass one.
But when I play, I play to win. Openly thumbing one's nose at the courts and the state is rarely a winning strategy. The way to win is through the democratic process: persuading elected officials to take your side. That, in turn, requires persuading the public to take your side.
Ok, fine, but what you fail to recognize that taking a loud public stance against tyranny provides cover for people who are too scared to stand up for their beliefs.
Successful civil rights activism took place in an environment where people were being arrested, beaten, and even killed for standing up for what is right. You could even argue that this created fertile ground for the success of the movement. Failures of justice create hardened activists and support networks, and eventually public support.
Comparing the "oppression" of a programmer who is forbidden from distributing an OS that fails to ask the user's age to the actual suffering of Black people in the U.S., who were regularly discriminated against and even lynched, is ridiculous. You'll never persuade ordinary people of this, that way.
Since when was surveillance disconnected from civil rights? Since never.
Average people will come around when they start passing laws requiring deanonymization and arresting journalists and critics. (The latter is already happening, but I expect this to accelerate in the future.) Need to lay the groundwork for opposition now, and that means rallying dedicated people to the cause.
On the contrary, civil disobedience involves openly thumbing your nose at the state, and it has a long history of successes.
Going to the courts instead of the legislature is another strategy that often wins. This is how Bernstein ended export restrictions on cryptography, by suing the government on constitutional grounds rather than trying to persuade legislators.
1. Civil disobedience has worked when the timing and circumstances are right, and there is a just cause and clear pattern of oppression that engages the sympathies of a broad swath of people. That is rare. Most of the time, civil disobedience has been ineffective. Remember Occupy Wall Street? Black Lives Matter? The violence that coincided with them was a major turn-off for most Americans. About the only one in recent memory that was successful was gay rights, and even that was a result of evolving social mores and media portrayal, not disobedience. It required a tremendous amount of patience: the Stonewall uprising was in 1969; All in the Family had TV's first portray of an openly gay character in 1971; and the Obergefell v. Hodges decision that legalized gay marriage was in 2015--46 years after Stonewall--and even that was a 5-4 decision.
2. Openly thumbing your nose at the law is not going to serve you well in court. What did Prof. Bernstein do when he was threatened with legal sanctions? He lawyered up and took his counsel's advice. His communications throughout the process remained factual and respectful even though his disagreement was clear. He did not go onto Hacker News and prejudice himself by saying things like "Illinois legislators can eat shit" and "I dare someone to try to take me to court over this." He was patient, let his lawyers do the talking, and did not get the judge pissed off at him.
Civil disobedience, as with the legislative and judicial processes, works through the power of persuasion. If you fail to persuade, your mission fails.
These processes involve emotional and imperfect people, not deterministic logical machines, and success ultimately requires making them happy (or at least not making enemies out of them). The system might not work, but you have to work the system.
I'd trust the judgement on an open source maintainer on how to best maintain their code. Your comment seems like it was made out of genuine concern but I think you need a lawyer too before you can argue this with certainty
There is no "market"
Thank you for fighting the good fight.
Thank you.
Honey, that just means you cannot ship.
If you're in the ninth circuit you're safe because of Bernstein v DoJ.
If you're in the sixth circuit you're even safer because of Junger vs Daley.
Stop it. This is not something either of you are competent to provide legal advice about. Anyone concerned about this should consult a licensed attorney, not get advice from randos on HN.
I respect your principled stance on one hand, while on the other I’m amazed that someone as successful as you hasn’t learned that logic doesn’t dictate how governments work.
Don’t make a target of yourself, there are countless ways for a government to make your life miserable.
I will never show fear to tech-illiterate bullies trying to compromise constitutionally protected rights. That is how freedoms get quietly lost.
Users need to see that the people in positions of influence in FOSS projects they trust are not afraid of this bullshit.
I -hope- someone is stupid enough to take a case like this to court so we can establish some much needed case law here. These overreaches deserve to be contested.
> I will never show fear
"never show fear" and "never engage intelligence" are two different things. Understand what people will do in response to your actions, and act accordingly to achieve the outcomes you want. Please by all means fight the law, and do so intelligently in a way that will actually help.
Can you be specific in how you think he is behaving unintelligently, and what you think that people will do in response to his actions?
I'll bite. His statements in this very forum could he used against him as evidence of intent to violate the law, should he be prosecuted someday.
There's a reason why lawyers generally advise their clients to remain silent.
> There's a reason why lawyers generally advise their clients to remain silent.
Most people prioritize their finances (and non-imprisonment) over their rights, and attorneys will optimize for that expressed preference. GP has clearly indicated his priorities are different. That has nothing to do with intelligence. Someone having a different set of values than you does not constitute unintelligence on his part.
GP said they wanted to take it to court. I presume that means they wanted to win, in which case the best strategy is to discuss the issue in private with an attorney before making public statements that could undermine your ability to win.
If the actual priority here is advocacy, with no real desire to litigate, then I'd buy that.
Exactly. More power to anyone who wants to fight this. But if the goal is to win that fight, do a better job of fighting, rather than acting like "oh, I have a structure that prevents me from complying" will somehow magically make a court go "eh, nothing we can do".
Pretending like technical limitations protect him from being in violation of the law like another commentator made an analogy to handcuffing yourself to property you were told to leave?
His comments on this thread itself which establish intent to not comply with the law?
All power to him for going with his morals but he’s making unforced errors and should instead be contacting one of the several activist legal firms that would at least give him advice on how to protect himself and not follow through with this law if not outright pro bono legal defense.
No one is asking me to add code to stagex right now, so there is no actual legal situation I am in.
I am not even an owner of the project, I founded the project, but am now just one of many volunteer contributors. Are they going to mandate wikipedia volunteers alter pages to state guidelines as well?
We must not be afraid of stuff like this. It is blatant overreach I do not expect would stand legal challenge.
I am simply saying I would refuse to write code I do not want to write. I am honestly surprised people think this is such a scary thing to say.
The point of saying this publicly is not in order to harm or help my own defense of a court order from another state I will probably get.
It is to signal to legislators that if they decide to take this fight, it will be done with people not afraid to do it all in public to establish public trust. It is not even okay that people -think- it is possible for our FOSS projects to be altered or backdoored by any random state officials.
What next, asking Torvalds to add KYC to the kernel?
> constitutionally protected rights
Wait, which constitutionally protected right is that? I'm an attorney and constitutional scholar and am particularly interested in what right you believe is being violated here.
Code is speech. Forcing someone to implement something is legally-compelled speech, assuming no complicating factor like commerce.
I’m not a lawyer and even I know that argument would never hold up given the plethora of other laws that have been implemented through software. Not to mention copyright and patent claims too.
Being afraid and hoping you are never forced to add code to a project you do not want to add is letting the chilling effects work as designed.
We need to all loudly and publicly say "Fuck off, I will defend my rights if needed", so they understand how expensive the fight is going to be.
Fear is power. Do not give your enemies power.
People don’t disagree with your moral position. The problem is you’re bringing a butter knife to a drone fight.
There are more effective ways protest this law than posting punk-rhetoric on a nerd forum for a project that will likely fly under the governments radar anyway.
Public expressions of defiance are motivating to people who don’t yet recognize that they have allies.
At least one person understands my intentions. You made my day.
There are more of us than it appears, but we usually don’t speak out. Thanks for making a stand.
We get their intentions. We just disagree with the effectiveness of it.
Posting rhetoric on an anonymous message board is not making a stand. If and when they’re doxxed by US media outlets, and slapped with life-changing court orders, with their work and families directly affected by their decisions; then they’re making a stand. But until that point, their words are as meaningless as their view of this law.
Eg I can confidently say I’m not going to comply with this law either. But you have no reason to assume that will make any difference nor that I wouldn’t fold the moment I’m put under the slightest amount of pressure.
If people really wanted to make a stand then they’d be drumming up support in real life, not anonymously. They’d be speaking to government representatives. They’d be raising financial support for lobbying change.
I’m old enough to have lived through multiple iterations of unpleasant laws being passed and each time a movement against it has been online-only, that protest has achieved nothing. So I know the real reason this maintainer is speaking as boldly as they are is because they know the government hasn’t heard of them nor their distro. Ie it’s a “making a stand” by doing exactly nothing. But it will also achieve exactly nothing too.
> hoping you are never forced to add code to a project you do not want to add
You keep saying that, but that's not the realistic outcome. The realistic outcome isn't an injunction forcing you to add code. It'd be to force you to pull it out of circulation.
They cannot force me to do either. But it would be a fascinating case study to watch them try. I feel it would only help prove the decentralized censorship-resistant tactics of the project work as intended. Government overreach should be in the threat model of every FOSS project.
That argument has been going on for decades, and has had few victories in the court system. The DMCA, which prohibits trafficking in anticircumvention devices, even though there's a lot of code in them, is still alive and well.
And the DMCA has been rightfully weakened to the point that archive.org has every Nintendo Gamecube game ever made hosted for the public, for years, uncontested.
So too will these other silly laws go I expect.
Not only that, but people like myself are working on underground distribution networks in case they’re ever needed.
Absolute worst case we’ll do sneakernet. More likely we’ll just distribute via overlay networks.
Some of us are crazy enough to be full on free speech martyrs, believe it or not.
There is pretty solid case law for the constitutionality of a variety of compliance requirements. If you can comply by being silent then they aren't really compelling you to do say anything.
Is is also clear that there are major deficits in our Constitution but that the amendment process has failed to survive a modern world.
Any of our original forefathers would recognize today's American federal government as an overreach from their indended form of government.
The only reason we aren't seeing a Boston Tea Party 2.0 over the recent string of coordinated assaults against our inalienable human rights is because surveillance capitalism is already coarsely achieving its goals of suppressing any civic participation which exists between the spectrum of ineffective political protest to the most desperate, radical action.
Some of those among us simply cannot drink this koolaid. A quote from MLK, Jr:
Further reading https://letterfromjail.com/Yeah but most of y’all wouldn’t accept the imprisonment willingly.
Who is "most of y'all"? Sounds like a generalization to me and a poor attempt at an appeal to character in order to undermine the perspective I've shared.
Have you been to prison? I've been incarcerated before already after having my rights violated. Let's not go there. Make less assumptions.
Incarcerated temporarily (e.g. awaiting trial or a prosecution decision), or actually convicted and sentenced to imprisonment? These two things are not the same.
No one is being convicted and doing hard time for refusing to add age verification to a Linux distro. This is just more fear mongering.
It would be a fine or a few days of jail until bail is posted, at worst. And then a media shit show where the public is certain to side with the developer who is having their rights violated to discourage this from ever happening again.
The public even got the back of weev for his bullshit arrest. Weev, one of the shittiest people to ever live. But rights are rights.
> No one is being convicted and doing hard time for refusing to add age verification to a Linux distro.
That's not the point. The point is that people who don't face a real possibility of being convicted and imprisoned are the ones who make the most noise about how they're willing to accept imprisonment (or, worse, are cheering on others to be imprisoned as some sort of Cyberpunk Martyr).
As I said elsewhere - it's easy to be an Internet Tough Guy when you (think you) have little to lose.
This reads like your personal fantasy. It's also insulting to people who stand by these words all the way down the slippery slope. People who spend time trying to make the world safer for you and others.
Instead of positioning yourself adversarially and making unfounded and unwarranted claims about others, it would be more productive to engage in good faith and seek to lend a hand.
You've already made flat-out incorrect assumptions about me, indirect or not. Calibrate yourself.
My "personal fantasy"? Give me a break.
You've gone off the rails. You're not the hero saving the world that you make yourself out to be. Get over yourself.
I'm done with this thread.
You quite frankly have the conversational intelligence of a petulant child and I would not seek your legal advice in any matter if this is how you conduct yourself when discussing law with others online.
I am ok with this. Sometimes a lawyer doesn't want certain clients, either.
A non-practicing lawyer, by definition, has no clients. Just to be clear.
They also just went and silently changed multiple comments in order to make their replies look less edgy, petulant and unprofessional. I'm all for editing out swipes, but the lack of acknowledgement makes it clear that their last resort for turning this one around is manipulating the conversation after the fact to benefit themselves.
The public may have weev's back, but privately the majority of us disavowed him after he went full nazi in prison and doubled down on an alt-right agenda. I personally know people who signed the court petition to get him acquitted and they have rescinded support for him. That said, he shouldn't have gone to prison for that.
Anyway, the nature of a slippery slope like this one is that the punishments will get worse over time as the government further vilifies those who push against things like this and encryption backdoors.
You're right, they're not.
So which was it?
I am amazed that an attorney would ask me to divulge this kind of highly personal information in a public forum when I am clearly trying to be discreet.
I'm not your attorney; I don't owe you a duty of confidentiality. You're not being discreet at all; you brought up your prior incarceration, presumably in the hopes that it would help you prevail in this discussion. By so doing, you opened that door and made the issue relevant.
That has nothing to do with your general professional respect for others and knowing how to read the room.
I've read the room. I think I'm okay.
Is that why you just felt the need to edit each of your comments in an attempt to make them less petulant and more substantial?
Are you seriously comparing the "oppression" of a programmer who is forbidden from distributing an OS that fails to ask the user's age to the actual oppression of Black people in the United States before the Civil Rights Era? The oppression that involved lynching?
Jesus H. Christ.
You have no idea who I am, what hardships I have dealt with, and clearly don't have a complete understanding of civil liberties if you cannot make the connection between the violation of two different Constitutional rights.
Your current negativity is not welcome, if you are an attorney then please conduct yourself with more professionalism. If you want to seek to understand, great, but now you are being aggressive and negative and making a host of unfounded assumptions.
I'm happy to let the court of public opinion settle this one.
Is that your legal advice? Has this strategy worked for your clients before?
Edit: Poor taste to edit out your original comment with no acknowledgement. That was inappropriate and you know it, which is why you've now changed your comment.
While they may take you to court over this, make sure you can survive sitting in jail at first if government decides to make an example of you.
And where code is speech, is a distribution speech? There's a lot of places for this to go sideways on you personally.
The fact people are scared, or scared for me, is in and of itself a problem.
But lets all wait for nothing at all to happen. Then confidence can grow over time that this is unenforceable in any effective way.
They should go back to trying to police piracy via bittorrent (lol).
I think the issue here is that while the people here are aware of the history and "utility" of laws like the one above, most people aren't and right now "regulate social media, the internet, and what my kid does with computers" is having quite a day. Inevitably all of this is framed in terms of keeping children safe, whereas piracy is at most a misdemeanor of very little consequence.
Although I have no doubt that courts would ultimately side with you, the chance of becoming even a transient focus of a frustrated AG or congressperson looking to pin blame on "Out of touch and recalcitrant techies, the very ones who created this problem," is chilling. It's meant to be chilling, but it often works because he reality of what you'd go through on the way to eventual victory isn't trivial. Maybe you're willing to go through the courts (public opinion and otherwise), but if so the first thing any attorney you employ will beg you to do is stop talking the way you are.
tl;dr I think taking a stand is great, I support that, I think doing it now is a good idea. I don't think you should talk about it in public though, especially not in a literal, "Come and get me" way.
Ya, I think op needs to study the history of civil rights in the US on how to do these things. Quite often the people that were getting arrested and challenging the state were specifically chosen because they didn't have any kind of dirt to dig up. The state is perfectly fine with playing dirty inside and outside the courtroom. The state would love the person brining a constitutional challenge to suddenly be marred in the eyes of the public as some kind of deviant.
Good news: the legislation doesn't target you as an individual.
stagex accepts tax deductable donations via opencollective but we do not actually have a registered legal entity, so yes, probably fine.
I mostly just want to make it clear this type of legislation is unenforceable and a waste of everyone's time.
How are you deducting the taxes without a legal entity? Or did you just mean that they would be tax deductible but not that you are necessarily deducting anything.
> accepts tax deductable donations via opencollective but we do not actually have a registered legal entity
that, uh, sounds sketchy
Opencollective collects funds to distribute to open source project maintainers. Not that it matters. We have never collected a single donation, but figured it was worth a shot. lol.
I don't really get how that works in terms of being tax-deductible. So I looked it up, and lo and behold:
> Contributions to Collectives hosted by OSC are not deductible as charitable contributions for U.S. federal income tax purposes.
So, uh, no longer sketchy but not tax deductible in the US. See https://opencollective.com/opensource#category-ABOUT
So OEMs will only be shipping Windows and that's more or less it.
And it will be wiped immediately as usual, so sure whatever.
Or it will have some new TPM/SecureBoot guard rails to not let minors install unapproved systems. Think of children again ;)
I specialize in TPM security and know plenty of ways to bypass it with physical access to consumer laptop hardware, and would gladly make that easy for the public if needed.
But I hope they try this. It will be funny to watch the public humiliation of how hard it fails at scale.
Some of us hoard stacks of old computers (and lots of source code) in case they ever try this! ;)
> ”Linux distro founder here (stagex)… designed to work offline-first, with some variants not even supporting network drivers”
If your OS doesn’t access the internet or isn’t intended to run browsers / social apps, then you are outside the scope of this legislation. That would be a bit like requiring a toaster to ask for your age before letting you operate it.
But someone could attach a GPU in the offline OS and use it to generate porn with local AI models! Oh no! How will we stop them?!
They can stop you from doing any work on the project. They can even fine or jail you for work done after the law takes affect that the international committee doesn't allow. Which is to say you can be forced to stop work.
Though if you don't live in IL it is unclear how this affects you.
Some time in jail or having to fight a fine for refusing to implement features in the constitutionally protected free speech code they author? If that is what it takes.
I do not want to go to jail, but if that is the only way to get to an outcome where people have confidence they can not be forced to add unwanted code to open source projects, so be it. But that is a pointless thought experiment because it will never happen.
I do not think anyone would be stupid enough to jail a FOSS developer for not agreeing to compelled speech, and if they did, an army of lawyers would be lining up to take the case I expect, with the full support of the public. It would be an insane thing to attempt.
We must loudly push back on the chilling effects intended here. Our free speech to write or not write any code we want will not be compromised.
This thing where you keep saying “it will never happen” is why you’re showing your ignorance.
Can someone who knows the law explain to me how someone who lives in California, and hooks his computer in California, to a wire in California, from a company in California...
At what point do they become subject to Illinois law?
And can Illinois prosecute someone for doing something that is legal in California while they are in California?
>At what point do they become subject to Illinois law?
When they sell to someone in Illinois, although there is probably some bullshit case law out there that says the website owner has to take basic steps to block Illinois users to avoid all IL jurisdiction.
>And can Illinois prosecute someone for doing something that is legal in California while they are in California?
No.
But CA cannot stop IL from demanding someone be sent to IL courts if they think an IL law was broken.
IL laws can't be broken by someone not in IL that does not interact with anyone in IL.
Presumably, there is a defense available in court that would prevent CA from extraditing someone to IL who is innocent because they have nothing to do with IL.
Governments can hire a hitman to go after you, if you say something wrong. So can international crime syndicates. Will this have a meaningful effect on chilling your speech?
https://abcnews.com/amp/US/children-recruited-criminals-indu...
Pretty far fetched an Illinois legislator hires a hitman for a FOSS developer.
But to humor you, if they did, the distro would carry right on, so they would be taking a lot of risk with no progress on their objective.
I only sign like 1/3 releases these days so I am replaceable now. Decentralized control and decentralized trust was the whole point of stagex.
Representatives of the US government threaten to drone bomb anyone they disagree with all of the time now
i like the cut of your jib
Just wait until all vendors are required to lock down their devices like Apple does. Apple has shown that it is possible, thanks Apple!
How many jailbreaks has Apple had now? I even have an Apple DRM bypass not public yet. We will be fine ;)
THIS. PLEASE THIS.
> Linux distro founder here (stagex)
What does it mean to "found" a Linux distro? Can you describe it?
https://stagex.tools
Brother you are doing the worlds work stopping this type of "law".
If we don't like the law we keep doing the thing and enough people join and it gets changed to our liking.
I feel like all of these laws are being designed backwards. Content providers, like MPAA films, should have to identify what sort of content they are providing. Then I can give my kids a device configured to allow some or all of that at my discretion.
Requiring my kids' devices to advertise their age (or their age "bucket", as if that was a meaningful difference) to protect them is not doing me or my kids any favors.
Having the ability to identify who is watching or saying what on the internet would be immensely useful to the government; the justifications are really meaningless.
Anti-money-laundering is a comparable field, as all the AML regulations and laws are ineffective at identifying money launderers, but they're wonderful for verifying (auditing and prosecuting) tax compliance.
> Anti-money-laundering is a comparable field, as all the AML regulations and laws are ineffective at identifying money launderers, but they're wonderful for verifying (auditing and prosecuting) tax compliance.
As someone who’s implemented AML, KYC, and tax reporting functions in a bank. I think you would be very surprised at how shit they are for tax auditing at scale. Unless the tax man is specifically auditing you, and basically requesting all your transaction details, the reporting that banks do would only allow tax agencies to catch the most brazen and incompetent tax dodgers.
All of the tools however do make much harder to perform money laundering, forcing criminals to recruit and pay huge numbers of naive bank customers to allow criminals to launder money via their personal accounts, using them as money mules. Which then gets flagged and shutdown pretty quick by banks because the behaviour is generally pretty obvious.
Unfortunately (or fortunately depending on your perspective) banks can’t/don’t coordinate on identified money mules or know launderers, so criminals just move on to other banks and repeat.
Criminals don't have to "recruit and pay huge numbers of naive bank customers"; in my jurisdiction, they just walk into a casino with a few hundred thousand dollars, exchange for chips, pretend to gamble for an hour, then exchange the chips for cash, and walk out with a nice receipt. There're more complex schemes involving real estate and other mediums too.
That’s cute, but it doesn’t really scale. Organised crime groups aren’t interested in laundering a few $100k at a go. They’re moving and laundering millions, you can’t put that through a casino without it being very obvious.
There is a huge international criminal industry that exists to find and hire money mules, and launder eye watering amounts of cash. Where I worked, we broadly assumed that the police weren’t interested in fraud or money laundering unless it was measured in 10s of millions. We reported everything, of course, but we only got call backs for really big schemes.
If you’re just committing fraud measured in $100ks, the odd of anyone bothering to investigate, and attempt to bring criminal charges, was basically zero.
The 'small-scale' 100k-1MM per participant per day per casino laundering can add up to 'real money' quite fast.
The larger-scale money laundering in my area is a but more complicated, involving import/export schemes, real estate transactions, and property developments. I'm not in a mega-city, so I assume these schemes are taking place at a larger scale in those. I have only ever heard of very basic and stupid schemes (which didn't provide any tax revenue to my goverment) being detected or prosecuted.
> Unfortunately (or fortunately depending on your perspective) banks can’t/don’t coordinate on identified money mules or know launderers, so criminals just move on to other banks and repeat.
Or criminals just get a bank like HSBC to do the money laundering for them.
> Having the ability to identify who is watching or saying what on the internet would be immensely useful to the government
This sounds unconstitutional.
> Content providers, like MPAA films, should have to identify what sort of content they are providing. Then I can give my kids a device configured to allow some or all of that at my discretion.
If the intent were to actually protect children, then this would be what was done.
"Protect the children" is just a subterfuge to get electorate support for voting for the foundation for a "1984 thought crime" style monitoring of the internet.
Do folks realize how many people would need to be a part of this conspiracy to get these laws passed at the state level? Maybe some people actually want to do good and are just misguided. And responding to those people as if they are evil government stooges certainly isn’t going to help them find the light.
The adtech companies need human verification so they can keep selling ads. Age verification is a way to get that under the radar because normal people are pissed off about "the children" and "the social media". You've also got cultural warriors who would love to censor speech on the Internet championing it, too.
This kind of age signalling with no verification whatsoever does not help the adtech companies at all.
This is step one. The next step is to say that it's not working and we need hardware attlestation or some such nonsense.
You don't think knowing a users self disclosed age-group would be beneficial to adtech? A) they shrug any liability for showing inappropriate things to minors when all the onus is on the OS to provide accurate info, and B) they get a highly-likely to be accurate piece of profiling information to add the the already huge pile they collect from spying on people 24/7 and harvesting microdata from browser APIs and mobile apps.
It helps soften people up for nastier stuff later.
As an example: Decades ago CPUID and a machine readable processor serial number was massively controversial. Today burned-in device IDs being sent to websites is status quo.
On the other hand, I don't know a single person or have even heard of people or organizations who are advocating to pass these laws. They want the war in Iran to stop and for costs to go down. How is there so much political willpower for the former and almost none for the latter?
> Do folks realize how many people would need to be a part of this conspiracy to get these laws passed at the state level?
Not many.
> Maybe some people actually want to do good and are just misguided
Yes. That's why it doesn't take many to be part of this conspiracy. You can just get people to play a part in the conspiracy by rallying supporters under the guise of good intentions.
> And responding to those people as if they are evil government stooges certainly isn’t going to help them find the light
Most of those people will probably die not finding the light. They are people who won't have to live with the long term consequences. Most of the Illinois House (~70%) is 46+ [1]. The senate statistic is even worse sitting at almost 75% for individuals 46+. If life expectancy in the US is around 80, that means people who are in the first half of their expected life are drastically underrepresented (especially considering Illinois's 46+ demographic only occupies around ~45% [2])
[1] https://cypp.rutgers.edu/age-in-the-2025-illinois-general-as...
[2] https://www.impactdupage.org/demographicdata?id=16§ionId...
And surveillance capitalism
Can we extend that beyond just parental controls? I'd love to permaban 90% of the internet from ever reaching me. But the laws are designed backwards because they're probably written for someone else's benefit.
If this age verification stuff ever becomes plausible we always have the option of distributing actual Linux ISOs over bittorrent. Failing that, source code in RAR'd archives distributed across IPFS nodes and Tor. I feel like many of us would welcome the challenge if it were under better circumstances.
I'm now pretty convinced that this is the best argument for persuading non-technical and non-internet-privacy minded people why this is a problem. It's hard to explain all the technical factors that make it impossible to implement without compromising privacy... but it's pretty easy to get them to understand the real intent. If you start them thinking through what mechanisms would make sense _if_ the original premise truly was protecting kids from content they aren't ready to see, it's easy to arrive at that answer, and equally easy to see why "everyone must provide their ID so we can verify their age" probably comes from other motivations.
> "everyone must provide their ID so we can verify their age"
but that's not this law. This law requires self-declaration by whoever creates the accounts on the device.
and that's as useful as self-documenting "i am over 18" or "over 21" for things that require that, without any document checks.
this is a way to get something legal on paper, the rest of the stuff (patches, if you will) comes later. This asserts that age is important enough to force an operating system to comply, this opens the door.
> and that's as useful as self-documenting "i am over 18" or "over 21" for things that require that, without any document checks.
No OS I'm aware of allows non-admin users to add new users to the system. Parents that care about these sorts of things don't give their kids admin access to their computers.
> the rest of the stuff (patches, if you will) comes later.
Unless the legislation allows for such patches through non-legislative process, patches to legislation generally happens on a ~20 year cycle in my experience.
Maybe. I give kids more credit than most people on here, i guess. All it takes is one moment for the kids to see the password, guess the password, or whatever. if there's a physical key involved, parents sleep.
A determined kid will find a weakness in the pursuit of freedom.
also nintendo's OS lets users add users to their heart's content. At least i haven't found a way to stop a toddler from adding 6 avatars....
All I claimed is that as passed it is more effective than a "check this box if you're over 21" on forms. Not that it was fool-proof. I don't think any legislation would be fool-proof. Certainly not the privacy-destroying "upload your ID", which this isn't.
They're actually designed quite well for the intended purpose: mass surveillance and suppression of speech.
Don't ever for one second pretend this is about anything else.
Why then did this completely leave out verification? Parents want and accept the out-of-box declaration idea. It requires no ID, no face scans, no "ID dot ME" or whatever. As parents we are more than able to open the box before giving our kids a laptop or phone and entering their DOB, and also able to see with our own eyes if the kid suddenly turns up with a second cell phone that they bought and configured as an adult.
Any parents who are pathetically absent from parenting their kids, well, they can just go right on ignoring their kids and letting the kid themselves put in 9/9/99, and consume all kinds of inappropriate crap.
This particular law is respecting everyone's rights.
I would argue the reason is so people can make arguments like yours.
Step 1: get easily passed, simple looking laws passed to 'protect the children' Step 2: 'oh look at all these people bypassing the law. It's so simple for a child to watch porn with this.' Step 3: increase the requirements bit by bit on the verification
By letting something simple pass, they can claim it's not thst bad, and anyone who argues against it is being hyperbolic.
Can you back that up?
> Step 2: 'oh look at all these people bypassing the law. It's so simple for a child to watch porn with this.'
This would be a demonstrably stupid argument. A parent who simply opens the box and does 5 minutes of setup before giving their child a new $300-2000 device, and maintains the most basic awareness of any rogue devices (i.e. ask questions if a new phone appears) is all it takes to make sure no "bypassing" takes place in your home.
Anyone claiming "all these kids are bypassing it" would be lying, unless the law isn't even being enforced or sites aren't cooperating. And no law can overcome those problems.
Do you have children? Have you witnessed what they can do with restricted $300-2000 devices? My kids hack restaurant tablets at every place we go. I don't even know how they do it most of the time.
This is going to be one hell of a slippery slope. And the actual publisher-driven proposal in this thread is so much more useful; I would love to filter out anything with excess violence and generally NSFW content from my view of the Internet -- and I am over 18.
The idea of a 'user agent' where the 'device owner' decides 'what should be displayed and how' is ancient history, grandad.
Modern social media is delivered through 'apps' which are like web browsers, except without ad blockers or privacy settings, and with push notifications to make them more addictive, and they only show one website, and they're each 5x the size of a web browser for some reason.
This is definitely not about "protect the kids" or age verification, this is a stepping stone to full identity verification to use the internet at all.
> I feel like all of these laws are being designed backwards. Content providers, like MPAA films, should have to identify what sort of content they are providing. Then I can give my kids a device configured to allow some or all of that at my discretion.
This was tried in the past:
* https://www.w3.org/2007/powder/
* https://www.w3.org/PICS/
Or anyone else!
This isn’t for the protection of kids. It’s for the protection of profits by surveillance capitalism.
I think you’re missing the real purpose vs the stated purpose.
The point is monitoring everyone, age verification requires you to share who you are.
It seems like after Epstein was gone a lot of politicians in many countries suddenly want to identify children, take photos for "age identification", and their ages and what apps they use. Very strange.
How dare you try to use a system that we've used for generations!
Did you read the law? It actually imposes very (in my humble opinion) good rules on the content providers, specifically social media. We know why social media is addictive - the personalized feeds are highly optimized to extend usage time, with no amount of time being "good enough." Social media sites would be banned from using this type of feed, limiting it to feeds of content you've subscribed to or requested only. Instead of seeing mainly influencers and viral videos, people might even start seeing their friends' own content.
> Requiring my kids' devices to advertise their age ... to protect them is not doing me or my kids any favors.
Idk about you, but it'd be doing me favors because my kids will not be physically able to use the most addictive platforms that exist today in their current form. It would be a major disruption to the behavioral manipulation that Meta, TikTok, and X do.
Right, I'm saying that if the goal is to keep kids off of addictive social feeds, it would be better to have social media have to say "this site implements addictive feeds" and then I can configure my kids' devices to disallow that. The decision should be happening in my house on the devices I control, not in a Meta data center. The current law just gives Meta a way to start building a shadow profile early.
> then I can configure my kids' devices to disallow that
C'mon. We all know parents are far more likely to tap "OK" for "Allow personalized social feeds?" than they are to knowingly falsify their kids' age. The kids will be begging them to and saying "It's just to personalize it, Dad! There's nothing scary or bad on Tiktok - all my friends are using the personalized feed and mine is BORING!"
> The decision should be happening in my house on the devices I control, not in a Meta data center. The current law just gives Meta a way to start building a shadow profile early.
The decision would still be in your hand. If you want them to be using all the max addictive crap, just fake their age on the device that you bought them.
> The current law just gives Meta a way to start building a shadow profile early.
Whether or not they can start building a profile to start using at 18 is unrelated to this, and depends on data protection laws. There's no use tying the two together.
> We all know parents are far more likely to tap "OK" for "Allow personalized social feeds?" than they are to knowingly falsify their kids' age.
I know lots of parents and lots of kids, and I don't think this is accurate. In my experience the breakdown is parents who care what their kids are doing online, and parents who assume it will all turn out fine because they had AOL or even Facebook as teenagers and didn't get into too much trouble. The first group is already keeping an eye on their kids and might even have decent parental controls set up, and the second group doesn't care what happens as long as charges don't show up on the credit card.
These bills punish the first group of parents and OS/device makers for the transgressions of social media companies. The uninvolved parents won't even be in the room when the age question comes up.
Yeah.
And there is also the group of parents that at the moment have decided no device is safe enough to be given to a child or adolescent.
They are a good litmus test of the bill; would they be happy to provide devices if there was age verification built in?
I am in this group and I wouldn't.
Controlling my information consumption is not a legitimate function of the state. If algorithmic feeds get a lot of use, it's because people like them. Is that so hard to comprehend? That your preferences are not universal? And that you shouldn't use the government to bludgeon people into accepting the kind of information feed you, personally, would prefer for them? What gives you the right to do so?
What you calling "addictive" is just revealed preferences of the populace.
Great, let's legalize recreational fentanyl too, since 'whatever people seem to like' is good for society.
In this case, unless you're a child, nobody's trying to control what content you consume. And if you are a parent and want to make sure your children can continue to consume the most addictive possible social media, by all means lie about their age. The law does nothing to stop you from doing so.
By contrast, having zero mechanism for the rest of the parents to control this, as is the current case, does impose your "do whatever feels good" values on the rest of the world.
> By contrast, having zero mechanism for the rest of the parents to control this, as is the current case, does impose your "do whatever feels good" values on the rest of the world.
Parental controls? They take 5mins to setup.
I use them. First of all, they're still absolute dogshit (but Apple promises good changes in next OS?). And the choice is to either allow social media in its current, extremely toxic form, or ban it entirely. There's no "Allow Instagram but only let them see the content their actual friends post." No "Allow TikTok but let me allow-list the influencers that show up in For You." The peer pressure on kids to be on those platforms is intense though, and many parents seem to be allowing it.
I think the theory behind the law is that experimenting on children to optimize (without any ceiling) for increasing watch hours, which 100% of the social media sites are doing at all times and have been for over a decade, is unethical and should be illegal.
If adults want to subject themselves to that, it's their business, but for children, we restrict all kinds of things from even being marketed towards children. Things (especially addictive ones) that are very obviously bad for humans, like cigarettes and liquor. Why? Because otherwise there's a huge incentive for the makers of those things to do so, because of how naïve kids are.
A wildcard here is how if at all to address careless, negligent parents of course. For the things so obviously harmful like drugs, it becomes criminal to give those to your kids. But perhaps social media falls into about the same category as R-rated movies, where we just say "it's bad parenting to take a 6-year-old to one, but not illegal." Another area where we have 'censored' things for children for decades - without any kind of scary police-state regime materializing and forcing biometrics and recordkeeping at the box office.
The difference is that those other things in the past didn't really place an undue burden on everybody else. Whether a child is allowed to watch an R rated movie or go to a pub has no effect on how I conduct myself, age-gating computers or the internet does affect how I use things.
> I think the theory behind the law is that experimenting on children to optimize (without any ceiling) for increasing watch hours, which 100% of the social media sites are doing at all times and have been for over a decade, is unethical and should be illegal.
I agree, and I think this is where the focus should be. It places no burden on any regular consumer to do anything and all the burden on the platform providers.
Information that enters the mind through the eyes and ears is nothing like a drug that alters consciousness at a low level. Words are just words. You don't get to control the words people choose to hear.
Parents already have the ability to do this, at least when it comes to porn. The fact is that most parents aren't doing it. Hence the push for legislation that increase the uptake of content blocks for minors.
Not that I'm condoning it, but this law requires self-declaration, not verification. It might sound pedantic but the practical difference is huge.
Self-declaration means that the system asks the user to declare if they are a minor. Nothing is verified.
Age verification typically means a system which checks ID or has other enforcement measures to try to verify age.
It is a technical ratchet. Once you accept part of the implementation it will never be undone, more will be added.
Very true, though this is something thats pretty difficult to get to by tiny increments, which is usually how these nefarious means are accomplished. One tiny thing is asked after another, each one too small to put up a fight against, and then suddenly they've crossed your line and you didn't even notice. Thats not particularly easy to do here, so the line will remain just as strong.
Maybe next they'll ask maintainers to go from a bracket to a specific age, and then next ask for verification, but the jump from specific age to verification is big enough that there'll be just as much resistance to it.
I don't think this is a safe assumption.
As a counter, actual age verification is being rolled out in other places. I really don't think we're in a position of choosing between no age-based access mechanism, and age-based access mechanism. Between the anti-porn types and public demand for some kind of regulations on social media, regulation of some kind is inevitable.
Our actual choice may only be what type of restriction we can live with, and I much prefer this type to the kind that requires websites to demand my id and photos of my face. Especially since some implementations of this concept (the California one, I think) declare that websites aren't legally required to look deeper than the attested age, which is a very nice feature.
Mind you, I don't know why the legislators are bothering mandating OS support for these features. It would be much easier to mandate that websites support the feature, make it clear to them that supporting the feature appropriately will free them from liability for children accessing content, and then wait as users demand that their OS support the feature.
Re: your last paragraph
I actually agree with you, if you mandate that the site has to look for an affirmative signal and if it doesn't get one, has to assume the user is the youngest possible age group. Users would demand the proper support for it.
Although it would have to have some teeth capable of biting the client software companies, because for instance, if browser(s) chose to on their own simply send "I'm over 21" to every site this becomes a pointless exercise and that applies whether the browser makers do it out of frustration that the OS support hasn't landed, or out of malice (imagine a browser that misreported age on purpose, specifically targeted at kids who want to bypass the parental controls).
Honestly though - because kids (especially the younger set) are hard pressed to buy their own hardware, a property that can only be set up out of the box, and can only be undone by using the account password of the parent who set it up, it is the perfect level of security here. And as for browsers, all you need is the gatekeepers (Apple, Google, MS) to agree not to ship in their "stores" browsers designed to evade it. Yes, you can totally compile your own browser, but most kids are using locked platforms like iOS and Android, and are by default denied permissions to run arbitrary software on platforms like Mac and Windows, so that's fine.
Yeah, that's pretty much what I am imagining. You're right about needing some teeth - maybe the legislature could define a spec, and penalties for implementing the feature in a commercial product without actually following the spec.
I really think all we need is what you describe in your third paragraph. It doesn't need to be bulletproof, it just needs to be an easy way for parents to set the level of content their children can access without them having to hover over their children at all times. Something like that could easily be set up in the Genius store when someone gets a new iPhone, or set up at first boot on an Android phone. That's like 90% of the devices anyone is actually worried about. Windows support of the feature would take it to like 99.9%.
Exactly. Fortunately, the kids we're most concerned with - young ones who just want to access their brainrot - has very little overlap with Linux users anyway. So, while I hate this hysterical propaganda portrayal as "aGe vErIfIcAtIoN," an "OSS operating system" exception doesn't really bother me, as long as it doesn't let the usual suspects make an end-run ("Darwin is OSS! See! iOS is exempt")
> if browser(s) chose to on their own simply send "I'm over 21" to every site this becomes a pointless exercise and that applies whether the browser makers do it out of frustration that the OS support hasn't landed, or out of malice (imagine a browser that misreported age on purpose, specifically targeted at kids who want to bypass the parental controls).
If it's a header, you can strip it out at the browser level, the user level, the kernel level, the hardware level, the router level, the router OS level, the router hardware level, or at the ISP level, depending on what a parent (or a state) desired.
The teeth are only necessary for the websites, which are never going to conform to the law anyway, whether through a header or through device attestation, without draconian Chinese-level enforcement that has never been seen in the West before. This new contract will have to be enforced at both endpoints. You will need the ID (whatever you want to call it) to get onto the network, whether you're an individual or the site being visited.
The idea that device attestation is going to bother the Moldovan tube site your kid gets pirated porn through is a surprisingly ignorant fantasy, especially when it comes from technical people. The Pirate Bay is still up. Megaupload is up and runs better than ever. People have 20 year old torrent site accounts. OS-level age attestation must be a first step, because it won't work.
And as to it not being enforced either by the hardware or by identity verification of the user, that's an impossibility. A kid can also overwrite an operating system, or even just overwrite the important part; so that means that either only attested operating systems can be installed, or no user is trusted at any time without state verification.
This sounds like a hot take, but I'm way less concerned with sketchy porn sites (mostly for the kind of reasons you say which boil down to ... they're sketchy).
I'm more concerned with deliberate manipulation of young people by social media. TikTok and its clones especially have demonstrated an incredibly strong ability to not just addict and brainrot kids (which is bad enough -- and it's really, really bad), but also to shape their opinion. All that discussion about the CPC having complete control if they wanted to exert it wasn't BS. Whoever controls them absolutely can use an algorithmic feed to astroturf "viral" videos pushing any narrative they want. Think of Elon Musk in his role as owner of X if you like the CPC.
Anyway. Most tweens and young teens don't know how to use Bittorrent. They use iOS and Android all day, and Chromebooks. These function as closed platforms, and macOS is as well unless you go out of your way. And Windows unless you make your kid an Administrator. Linux and other noncommercial OSS operating systems can have an exception if it makes it less burdensome on the maintainers. This doesn't change the fact that a law like this still solves a ton of problems that parents otherwise can't solve, and that big tech could only solve independently today by very privacy-invasive means.
> because it won't work.
It sounds like you think "work" means "prevent 100% of minors from seeing even a single frame of Bad Stuff anywhere online on any device"
To me "work" means "prevent most children (who aren't extremely technical) from mainstream social media sites openly experimenting on them daily to build a paperclip maximizer, where the paperclips are 'watch minutes' (as a proxy for ad revenue) and the planet being dismantled is our society."
It would "work" by this definition.
> device attestation
this specific term means something specific and is not what this law is about - not sure if you meant to tangle that idea up with this.
> I really don't think we're in a position of choosing between no age-based access mechanism, and age-based access mechanism.
It is impossible to win a battle you stop fighting.
But it's possible to lose a battle you were never going to win in the first place, and end up in a worse place.
I think that if these types of laws (illinois, california) don't hit a critical mass, we're going to see ID verification become the dominant method of age verification. Most websites will use it, and it'll become global because it's easier to just demand an ID and a photo for every user through some third party provider than to offer looser restrictions for the handful of states that have different demands.
This is especially true since it's now been demonstrated that states (like Texas) can go after out-of-state sites serving people in Texas. Sure, you could scrupulously try to identify which state someone is in and use the appropriate level of verification, but then you might be liable if it turns out it was someone from Texas or Georgia or Britain using a VPN.
> I think that if these types of laws (illinois, california) don't hit a critical mass, we're going to see ID verification become the dominant method of age verification.
You are assuming that age verification must necessarily happen. It needs to be destroyed at every possible juncture.
What is your objection to the California law?
A summary for those not familiar with it:
• Operating systems on devices whose primary user is a child must provide a way for the parent to provide age bracket information about the child.
• They must also provide an API that apps and app stores can use to find out that age range if they need to have limits on what children can do with them.
• They amended it to not apply to most open source operating systems.
Note that there is no actual age verification. It just uses what the parents put in. It is really just requiring each OS to have a standardized parental control system.
Among many other things, privacy. If you know an age range that's more information about the user than you should have, and you can use it for marketing. And if you can ask for an age range, then in practice you know a birthday; just keep asking until the range changes and record when you saw it change.
It's also the wrong way around: apps shouldn't ask for an age range, apps should provide one and the OS should do the checking.
I also object to it because it's a foot in the door for demanding that websites and apps care about that age range.
And most importantly, devices already provide parental controls in practice, and this law doesn't make those any better, it just unnecessarily cements one aspect of them into law. You can, already, on many devices, say "don't allow installing apps without permission", or "don't allow installing apps except those with this rating".
A headless server operating system does not need those steps. It does not need the bloat of prepping an API to communicate with websites.
> This is especially true since it's now been demonstrated that states (like Texas) can go after out-of-state sites serving people in Texas.
Hey, give credit where credit's due.
The first to try that was NJ going after 3d printed gun developers.
Yeah, I'm not super happy about all the 3d printing control legislation going around, which I frankly think is a lot more overreaching than these age declaration laws.
Stronger: Once you accept their right to ask, then you open the door to their right to a truthful answer, and thus to a verified answer.
Hasn’t the right to ask existed since the invention of consent laws?
The state being able demand a persons age, and gate their behaviour based on that, has existed for hundreds of years so far. During that entire time the requirement to be truthful has also existed otherwise the laws would be meaningless.
All that’s changing now, is figuring out how that extends into the digital realm. I personally find the argument that the digital realm is somehow special compared to the physical realm, and thus certain laws simply shouldn’t apply when “done on a computer”, difficult to reconcile.
Hard agree. I don't think we allowed video store operators in 1995 to just let kids wander into the back room and rent porn, but we're so used to there just being "no rules" online, it is coming as a massive shock now when it's being suggested that maybe there should be some basic guardrails to discourage that.
Let me be clear, I don't want face scans, or more of those creepy companies that operate this age verification crap for Discord, etc. Because I know it's not going to be implemented in the privacy-preserving way it could be, if there's ANY involvement with identity documents. Not least because we don't even have any proper cryptographically useful identity cards, so everything like that operates on a "trust us bro" basis where they pinky promise not to accidentally store everyone's raw face scans / ID cards / numbers / etc and inevitably leak them.
But out-of-box age declaration is not extreme and is not slippery-slope, any more than out-of-box user account creation 25 years ago has led to out-of-box ID card checks.
This is a nonsense argument considering over half the states have already put actual ID verification requirements in front of "adult content". Blue states are trying to ratchet to what red states just pass? Why? They could just follow suit and require you to upload your ID to a 3rd party service and scan your face. Your conspiracy theories don't seem to hold up to reality.
Literally a slippery slope argument
Sometimes when you see your opponents getting out a ramp and a barrel of lube, you can call it a slippery slope.
Or alternatively - you could recognize that normal people are getting more and more pissed off by the fact that social media companies are force-feeding garbage into their kids eyeballs 16 hours a day.
We could give them a reasonable solution that demonstrably preserves privacy and doesn't inconvenience anyone else (Suppose you want to see all the uncensored everything, you open your new PC or phone and say your DOB is 1/1/1900. Done. Status quo.)
Or we could be alarmist about that, torpedo that plan, and then in 2 more years when people are even MORE pissed, a horrifying new plan comes out, where the government scans your photo ID (with the help of some crappy private contractor of course) and both of them promise to probably not store the info and log your access. And that one manages to scrape by because people are at that point even more pissed and are determined to solve the problem somehow.
The actual 'bad guys' just wouldn't be able to get the public support for that second, shitty plan, if we basically solve the problem now with this very modest plan that's on the table now. Parents can handle this simple one-time out-of-box prompt and it makes sense. Device owner, the parent, that's the one who should make the call.
I actually agree with you, but you have an optimism about the ability for open source maintainers to have achievable political aims, in a way that I haven't seen happen for decades.
What your happier future looks like requires both a technical solution, but more importantly political wins to sell that solution as the better one.
The current operating systems weighted by users, are entirely under the control of three major players, who are incentivised to further centralise things.
( I'm counting the three operating systems as Google Play Services, IOS and Windows. Yes, AOSP exists, but it's useless without Google Play Services. ).
I also don't think a device level switch would stop anything for a second, given the number of stories of parents who seem to hand their children their credit card, then complain about them racking up thousands of dollars on Roblox or whatever.
When the light-touch measures fail, the framework will be leveraged to start requiring more centralised and less private solutions.
> given the number of stories of parents who seem to hand their children their credit card, then complain about them racking up thousands of dollars on Roblox or whatever
Sure, but you hear about those because of how shocking they are to all sensible people. Actually I bet a lot more kids rack up those charges using cards they stole from mom's purse. Same kids will start trying to sneak mom's old iPhone out of the desk drawer to install "Adult TikTok" on. But again, this is not more concerning than the way my generation rooted around on the top shelf of Dad's closet to find the old Penthouse magazines.
I just don't accept the absolutist idea that if anything can be gotten around by any means, that means it can't still be sensible policy. Which seems to be the attitude taken by two separate groups -
1. Your and my common enemy -- the ones who are eager to enact "Show ID to access this site (trust us!)" verification schemes
2. And the freedom-loving hackers I've been arguing with today, who also detest those schemes but also don't want to see any scheme of any kind.
> I just don't accept the absolutist idea that if anything can be gotten around by any means, that means it can't still be sensible policy
Now on that I agree strongly, there is a crowd on here that believe that technical weaknesses defeat political strengths, and focus all their effort into proving a technical workaround only for the political juggernauts to continue crushing their freedoms.
These are arguments which often flow, "This law is impossible to enforce in totality, therefore the law will fail", which fails to understand what law really is, and how much people abide to even bad laws.
I think we disagree on what's actually needed to defeat the increasing centralisation of the internet, I think it really needs a movement to wake people up, it needs skilled political operators, and it needs passionate orators, to spread the message that we're increasingly operating in a controlled space which every year has greater hurdles to communicate outside of the bounds which those who control it allow, rather than the open internet we used to enjoy and need to fight to defend.
And, most importantly, that that fight needs to be political and not technical. Being seduced by the appeal of technical solutions is unhelpful distraction. Cryptocurrency will not keep you free. Duress pins will not keep you free. It is political will that will do that.
It's a fallacy when there is no cause and effect for each step. This, however states the steps.
What? The GP comment is one single line which states that it just "will" happen.
Slippery slope actually works though.
Makes no sense to treat it like some unwelcome argument
Slippery Slope is the assertion that A therefore B therefore C therefore D.
It is frequently a fallacy because D isn't predetermined by A when humans are involved. If you believe in free will, each of B, C, D are independent decisions. Sometimes we stop at A. Sometimes we pass Prohibition as a Constitutional Amendment, and later roll it back.
Only if it was not something they constantly already do.
In a philosophy classroom, it’s a fallacy. In a courtroom, it’s called precedent.
it is the thin edge of a slippery wedge..
slippery slope is if you say 'if a therefore d' not 'a leads to b leads to c leads to d'
"Slippery slope" is a term like "conspiracy theory". Tarnished by overuse, often misapplied, but they absolutely exist.
I would rather call it the boiling frog. But hey, whatever floats your boat.
that is the start of a lot of bills like this... they really only ever increase in scope and invasiveness.
On the contrary in my experience once a legislature passes a bill to "fix" a particular problem they consider it fixed and don't update it for at least 20 years.
it depends on whether or not there's someone who sees it as a crusade (rare), sees it as a way to get political clout (very common) and/or is getting a lot of lobbying money (extremely common [1]). see, for eg, the anti-trans bills that are being passed
this is the same rhetorical and political strategy, that there are 'dangerous' people who will exploit your children so please vote for me, the person who cares the most about children and will go after the 'dangerous' people
[1] https://themarkup.org/privacy/2021/04/15/big-tech-is-pushing...
What is the connection to “anti-trans bills”?
they're both grounded in fearmongering that's led to cultural panics and utilize the rhetoric of 'protecting children' as the sell
https://www.law.georgetown.edu/gender-journal/wp-content/upl...
"Overwhelmingly, state legislators behind recent anti-trans legislation have argued that they were introducing these bills with the intent to protect children – whether that be “protecting children” from “profoundly unethical and morally wrong” medical practices"
https://www.eff.org/deeplinks/2026/06/eff-gov-pritzker-veto-...
"Much of H.B. 5511 is modeled after controversial legislation passed in California (A.B. 1043) and New York’s Stop Addictive Feeds Exploitation (SAFE) for Kids Act"
there's also the rampant astroturfing
https://www.theguardian.com/world/2023/jun/30/christian-hate...
"The surge in funding to the ADF, which has been termed an “anti-LGBTQ hate group” by the Southern Poverty Law Center, saw it record revenue of $104.5m in 2021, according to filings with the Internal Revenue Service."
ADF's main funders being the Servant Foundation or a single billionaire family's pet foundation (https://en.wikipedia.org/wiki/Servant_Foundation) and the National Christian Foundation which receives large donations from multiple extremely wealthy individuals like David Green, co-founder of Hobby Lobby (https://readsludge.com/2019/03/19/americas-biggest-christian...)
this is very much like the funding of these 'privacy' acts by Meta, Alphabet, etc - lots of money directly into the hands of local legislators across multiple state legislatures with the ultimate goal of providing institutional power over individuals, one just has a slightly more Machiavellian economic logic foregrounding it but the strategy, tactics, and overall erosion of civil liberties make for very similar outcomes
Unless there is a big lobby behind getting more "fixes".
Who's the lobby?
i mean with the rise of flock ad campaigns of "think of the children" and them installing platereaders all over the place this kind of thing is something that people want to capitalize on and make a buck. i can definitely see the lobbying pushing for more and more invasive versions of this.
Think of it like a foot in the door.
Everyone else is arguing slippery slope.
I don’t even get that far, the proper response to my operating system asking me if I’m a minor or not is: fuck you. It isn’t a harmless question. We aren’t friends, I don’t want an algorithm of news and content, it’s an OS.
I don't see the argument here. You can easily adjust the law to force verification.
You seem to assume that "this is now final, nothing will change after that". Why would you assume this to be the case?
But they could also just implement verification now, which many governments are trying to do. The idea that you shouldn't let a government do one thing because they might do another thing is flawed if they could already do the other thing.
The danger of a slippery slope comes when one change enables the next change - for example, a law mandating certain kinds of data collection enables a future decision to discriminate or control based on the collected data. But in this case, no data is being collected, there's no step happening here that enables a more dangerous later step.
If anything, I'd argue this makes it harder to implement more invasive measures later, because rather than arguing that some form of age control is necessary, Illinois will specifically need to argue that age verification is necessary over the existing anonymous system. That's harder than saying "there is no protection for children right now, age verification is the only way forward".
'AnimalMuppet has the right take upthread (https://news.ycombinator.com/item?id=49249774): "Once you accept their right to ask, then you open the door to their right to a truthful answer, and thus to a verified answer.
> But they could also just implement verification now, which many governments are trying to do.
That itself is a proof: the voluntary age declaration was and is common on all the services that governments are now trying to force to do age verification, and it wasn't enough.
EDIT: in more general terms, and going beyond age verification thing and over many recent developments in information security, the Internet as a culture is missing an on-line equivalent to a key real-life social feature: the ability to answer with a shocked "gross!", followed by slapping the asker in the face.
Nope. It's a stupid take. Especially considering over half of the US states have jumped right to looking for that verified answer but no one on HN gives a shit when red states do things. They only ever bitch and moan when a blue state is doing something far less invasive and then they have to turn it into a conspiracy theory that the blue states are secretly trying to do what the red states are just blatantly doing in the open with zero push back.
The slope is only slippery if the change in question makes it easier for future changes to be bad. Otherwise you're only arguing for no changes to ever be made. Does this law make forced verification easier than if this law didn't exist?
Once you go up the first step of a ladder, the second step is now easier. It's a shifting of the Overton window. You can't enact full surveillance in one move - no-one would accept that. You can boil the frog over a few decades, though.
Potentially. The existence of the law exemplifies the idea the law is there to protect someone; all you need then to upgrade it is to argue that the current method is insufficient protection. Spirit of the law has been established - letter of the law will follow.
Seems so - it builds in the verification infrastructure requirement, making it dead simple to change whether it is opt in or opt out at any time.
It's actually pretty hard not to have a change be part of a slippery slope. It requires including blocks for further behavior as any subset implementation is hard to sell as not being a slippery slope path otherwise.
As someone who's pushed on a technical law change.... "easily" DEEPLY, DEEPLY misstates the challenges of getting the law changed. Fun fact: people who oppose something tend to get in the way.
So in red states porn is being used, and in blue states TikTok and Instagram are being used. Is anyone tracking who is behind the concerted efforts here? For example, which organizations, executives, lobbyists and politicians are valid and responsible parties?
Meta is one of the biggest ones pushing for this, because they don't want to be accountable so these types of laws pass the buck onto the delivery platforms (Apple, Google, other OSes)
Meta is then funding/lobbying alongside a bunch of other conservative groups like Heritage Action, and the digital childhood alliance (also made up of a ton of other conservative lobbying groups)
> Separately, and for very different reasons, NetChoice, the trade group that counts companies like Google and Meta among its members, filed testimony opposing the same bill. Its objection was First Amendment law and the risk of exposing sensitive user data, not open source specifically. It’s an odd pairing: a digital rights nonprofit and the lobbying arm for the platforms the bill is supposed to be regulating, arguing against the same bill for opposite reasons. Illinois lawmakers passed it unanimously anyway.
Sure, but Meta also wouldn't mind if age verification of some kind were used, because it would just increase the moat they already have. Meta or Google would have no difficulty complying with any of these laws regardless of how extreme they are, while the mom and pop shops can't comply and are forced out of business.
Tech incumbents whose businesses are reliant on selling ad space need to designate who is a verified human on the internet as soon as possible or their businesses go to zero once the entire web is AI bots and all the traffic is fraudulent and worthless, so they have to play as many angles as they can to achieve this.
That's not how ads work. They're done on a bidding system. If the value of each ad impression / click goes down, the bids will go down, but their total revenue would stay the same. It'd have basically zero effect.
Its ad tech, as always.
This seems to have more information. https://www.reddit.com/r/linux/comments/1rshc1f/i_traced_2_b...
The Reddit post you linked to was hallucinated by Claude, see https://news.ycombinator.com/item?id=47659552
Their website (now offline) also added this page since I posted that comment: https://web.archive.org/web/20260411112604/https://tboteproj... where they claim their website is under "surveillance" because it got a few thousand requests from Google Cloud et al, most of them to a single page. This shows how low their standards are.
TL;DR: They claim it's Meta (which yeah it would make a lot of sense).
These bills all suddenly appeared, as if by magic, in multiple state houses only a very short time after Zuck was on the stand in the Facebook trial early in the year testifying that "the right place to do age verification is in the operating system".
Now, granted, correlation is not always causation. But it sure stinks of something Meta had their lobbyists push just after Zuck's testimony so as to shift the liability risk of handling age appropriate material away from Meta properties and onto operating systems (Microsoft, Apple, Google (Android)).
You raise an interesting point in the first sentence. It might be that age sniffing could actually violate the US constitution.
As for lobbyists: I think we can probably determine the key lobbyists, e. g. if we map the data and names. And ideally also the money given to them. Ultimately they are faceless though, because corruption is easily exchangeable. The issue here is systemic though. The US "democracy" no longer exists due to that corruption. It is not rule by the people but rule by bribery.
IANAL but there have been some attempts to argue that forcing operating systems to add any age attestation etc. is compelled speech. Guess the question is which Distro will foot the bill to test this in actual court.
I used to run a parental controls startup and after talking to lots of parents, I can tell you this sentiment is shared among most parents. Parents on both sides of the isle think they're going to keep their teenagers off the internet forever, I had parents look me straight in the face and say their child wouldn't be allowed online until she was 16.
Parents aren't interested in the nuance of good and bad guys, they see the internet, think it's too much trouble to keep around, and want it blocked. I suspect politicians are just mimicking this sentiment after talking to thousands of parents
Any advice on how to dismantle and counter such arguments, individually and at scale?
Perhaps they shouldn't be allowed to school until 16? School and other kids can expose theirs to many detrimental things.
> they see the internet, it's too much trouble to keep around, and want it blocked
I can sympathize with this sentiment
in my work and life and personal life the internet is very useful, but as a parent of children and young teens, the internet is really just a PITA that I wish would go away along with all of the games, social media sites, and everything that I have to expend so much energy educating / arguing / instructing / fighting / blocking with my kids about.
It's exhausting because it's everywhere pushing at them from every direction. It's like trying to teach your kids the hazards of cigarettes or vaping to your kids while cool cig pushers are standing in their bedroom talking to them and waiting for them every time they walk out the door.
So yeah, expect exhausted parents who never asked for the deluge of slop, to be supportive of bills -- as ill-conceived or intentioned as they may be -- that provide relief.
And lest you say, "oh but it's always been that way, before this it was the early internet, and video games, and cigarettes". I grew up through all of that, and I can tell you it is not at all the same today. The ubiquitousness of it is what makes all the difference.
I agree with literally everyone who thinks this is pointless and probably malignant. The problem isn't the visibility or the fact that weird stuff "exists" on the internet. The problem is advertisers "showing" it to people who didn't go looking for it. Ads and algorithms that decide what a person to see are 99.8% of this actual problem, and meta lobbying for something like this is just obvious self-interest to absolve them from any liability for showing kids damaging material, and to hit 2 birds with one stone, they get more PII to add to their "anonymized" aggregate data.
No good will come from this for the consumer. Websites are suddenly all going to start accurately reporting their content rating, especially ancient documents that have been "online" since before css and javascript were a thing. The only ones that will be implementing these checks will be adtech people that shouldn't have it in the first place. Letting out of touch geriatrics make tech policy decisions in a time when the bleeding edge is moving faster than ever is going to be disastrous for generations to come.
What does that mean, practically? The person who installed linux on that particular device is liable?
>no algorithmic feeds for minors by default
Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm?
> Any choice of what content to display is an algorithm.
You could argue about the language and the meaning of "algorithm", but for practical purposes I'd consider a manually-curated feed to be non-algorithmic.
sure, if we can make words mean whatever we like, yeah
"Illinois now requires operating system providers, open source projects included, to build age verification by 2028"
however
"nothing in the bill has teeth against someone with no business presence in Illinois"
Companies like Red Hat/IBM operate in Illinois and for better or worse have controlling interests in Linux and across open source projects pretty broadly. Wouldn't they be forced to include the capability in their products, which then percolate out to everyone just by network effects?
I don't see how they enforce it though? Isn't this saying every linux instance needs basically a backdoor network access? How would verify the 30 pods on my node are from minors or adults without that? Or this is more about a user facing node? So my aws nodes need to verify my age before I ssh in?
Remote desktop services?
Sounds so complicated to actually do.
I suppose they only have to confirm that the OS supports age bucket reporting... not that you're using it.
finally the die hard systemd haters will have an actually valid point.
I’m unfamiliar with systemd’s haters or why this would give them a valid point. Could you please elaborate?
systemd is a massive blob of code that infects every part of a system and all of its subsystems. It completely changed the way system administration was done, the way init scripts work, and added tons of things to init that some argue aren't necessary, like dhcp and DNS.
Newer linux folks like it because they're used to it, people who don't like it use devuan, gentoo, or one of the others that still lets one use openRC or whatever else.
upthread someone mentioned that systemd already has the ability to store the birthdate of a user. Why would an init system need that? It doesn't, but here we are.
Maybe I'm about to be too pedantic, but I never quite got the argument of systemd being massively bloated based on examples of it including DNS and DHCP. Sure it's a mono-repository that includes all these services, but in the end you do run them separately? The actual "systemd, the init system" doesn't have DNS, DHCP or a user birthday database built-in, those are contained in their own services, namely systemd-resolved, systemd-networkd, and systemd-userdbd respectively, and, although systemd does genuinely lead you down the path of using them (which might be a real problem!), there isn't actually a definite requirement to do so. systemd will gladly run your BIND, ISC DHCP and NetworkManager for you if you tell it to, no? In fact we do so at my place of work. Just because they are under the same project as the init system doesn't mean they are one monolith, I think. To me that feels like saying "Why does the GNU C library include a bootloader!".
Now it's not like there's not plenty to dislike about systemd, it is a wide-reaching project that has managed to get a huge mindshare of the lower-level services needed to run a basic Linux server or desktop, and that has caused many utilities and services to appear that have a hard dependency on it, which is obviously bad for anyone running services that aren't part of the systemd package set, just take a look at NixOS, it's practically built purely on systemd, with efforts to support alternative init systems essentially archived at this point. Plenty of people also quite dislike Lennart, or how involved corporations are in the systemd development, and other people have loads of other reasons. One of my own gripes is speed for quite a few basic procedures in networkd. There's enough stuff to hate about it! I think it's not really necessary to pretend that your init system runs a DNS server and stores birthdays.
> Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm?
Phrases can have meanings beyond just a naive combination of the words in them. And indeed "algorithmic feed" in the bill means what what we all understand that term to mean when we aren't paralyzed by pedantry.
> Under the law, [...] these users will only be shown content they request or search for or that is posted by a creator or friend they follow.
You may disagree with the motivation behind the bill, but you do the discussion a disservice to assume the people writing it are incompetent enough to not define their terms.
Algorithmic feeds are just search algorithms based on what the user is asking to see with their behavior.
I think it's pretty obvious that your explanation cannot be complete or accurate. Algorithmic feeds usually have a strong influence of what they want to show you, commonly pushing stuff you aren't interested in, or anything that will keep you on their app/site longer so they have more opportunities to show you ads. There are strong conflicts of interest here.
Presumably this means no targeting the user's preferences and just showing everything by newest/most liked.
"most liked" won't work. has to be chronological, and manually curated. the way fediverse works. when you make an account somewhere, you can choose to see the local people, or the entire network, but it's all chronological.
There's things like hashtag searches and whatnot, but none of it is algorithms; in the sense we understand it to mean, here, these are not manipulative algorithms designed to keep people on a site and keep ads rolling by.
on the fediverse, there are bots to curate content such as "most liked", one can subscribe to these bots to see such "views" of the feed.
there's absolutely no reason for any of that crap to be built in, other than that's how reddit (and HN) do it.
There's a "trending" feed on nearly every implementation including the official Mastodon one (hashtags have their own "trending" too), and chronological definitely fits "an algorithm" imo - it has all the hallmark problems of one, such as encouraging bad behavior (frequent spamming is the most effective strategy to be seen). Lemmy is even further down this path, with "hot", "controversial", "active", etc, and defaults to "algorithmic" sorts for its front page and all comments.
Fediverse absolutely has "algorithms". People generally want them. I agree that it's broadly less user-hostile (I'm very much a fan), but it's very much moving down the same paths as twitter (mastodon), reddit (lemmy), etc.
chronological feed nuisances can be blocked or not followed in the first place. It is absolutely not an algorithm by the definition we're all using here.
It is an algorithm on a data structure, but it is not an algorithm to drive ad impressions.
do you see the difference?
this is why people say "Algo" when talking about the latter, and "Algorithm" when talking with other like-minded people about data structures and algorithms.
Someone chose "most recent" when implementing "most recent", and then that decision automatically controls what is shown next. They could have chosen "most recently liked" or "most liked" or "minimum MD5 checksum" or "alphabetical" or "most liked in past 24h" or "likes / hours * followers / followee_ratio * poster_birthdate_days_diff(admin_birthday) * tfidf_rank_matching_books_published_in_1885" - all of those would be algorithmic sorts in my book. "Most recent" is just one (among multiple) of the simplest ones to predict the behavior of.
A fully human-curated feed would not be "algorithmic", in contrast. Print newspapers do this, and sometimes online ones to varying degrees, and most blogs. You could even let people build their own (e.g. "boost to my popular feed [at position X/newest/oldest]"). Essentially none do this though, they all choose algorithmic ones of varying complexity - it doesn't make them non-algorithmic to choose a simpler one.
oh, you're a pedant and didn't read what i wrote at all, so i will confer the exact same respect for your thoughts.
They want an explanation of what an algorithm is. The world is full of people using words they don't understand and sometimes of them work in legislatures.
> Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm?
That's a paraphrasing of what law says. The law is more clearly defined:
> "Addictive feed" means a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met: (1) the recommendation, prioritization, or selection is based on information that is not persistently associated with the user's device and does not concern the user's previous interactions with media generated or shared by other users; (2) the recommendation, prioritization, or selection is based on data controlled by user-selected privacy or accessibility settings or technical information concerning the user's device; (3) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information that is not permissible under this definition; (4) the user expressly and unambiguously requested the specific media by a specific author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to as described by paragraph (3), be blocked, prioritized, or deprioritized for display, provided that the media is not recommended, selected, or prioritized based, in whole or in part, on other information associated with the user or the user's device that is not permissible under this definition; (5) the media is direct and private communication between users; (6) the media is recommended, selected, or prioritized only in response to a specific search inquiry by the user; (7) the media that is recommended, selected, or prioritized for display is exclusively next in a preexisting sequence from the same author, creator, poster, or source; or (8) the recommendation, prioritization, or selection is necessary to comply with the provisions of this Act. "Addictive social media platform" means a covered platform that offers users or provides users with an addictive feed as a part of the service provided by that website, online service, online application, or mobile application.
> (3) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information that is not permissible under this definition;
incoming wave of "follow back"-encouraging UX patterns, "subscription packs", and "you might like [add all]" buttons in 3... 2... 1...
That part hasn't really been decided since it's a regulatory question.
Basically the bill defines
> "Operating system provider" means a commercial or non-profit entity that controls the Internet-enabled device's operating system, including the design, programming, or supply of operating systems for the Internet-enabled devices.
Which is an extremely broad definition that could be interpreted in a whole bunch of ways.
The text of the bill is here: https://ilga.gov/Legislation/BillStatus/FullText?GAID=18&Doc.... There's about 3.5 pages of text defining this.
The relevant text doesn't call it an "algorithmic feed" for what it's worth. They define an "addictive" feed and it's essentially any kind of personalized recommendation.
> "Addictive feed" means a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met.
It seems that it mostly bans behavior-based personalization that is opaque to the user. It seems to allow for several types of personalization where the user has agency.
Since TFA can't be bothered, here's the text of the actual bill: https://my.ilga.gov/Legislation/BillStatus/FullText?GAID=18&...
Serious question: This is a out-of-box "ask for age" requirement. No one is "verifying" anything. Why are we using this misleading headline? Face scans, ID cards, all that stuff that makes everyone nervous, are specifically not a part of this. To imply that it is verification is propaganda.
As a parent, I'd be very happy with this "age declaration" method, as I also don't think the 'verification' others push for is at all worth the risks. All parents want is to put the devices permanently into a mode that flags it to third parties as belonging to a minor, so they can't just hold up their hands and say "idk they said they're 18" like they do today.
Two reasons people are arguing against it:
It moves the Overton window, making worse things easier to pass in the future. And it enforces requirements on projects the state should have zero jurisdiction over.
Yeah this is just step one and the evidence to support this is simple: history.
Governments very, very rarely give up power. Once they have it they only work to expand that power.
Next will be stronger and more restrictive shit.
Step 1: Shift the burden from service providers to OS providers (on devices owned by individuals).
Step 2: Recognize that the system is trivially bypassed by a kid who sets up their own device without their parents' oversight or parents who just think this is a stupid law and lying for their kids. Or bypassed by anyone using open source operating systems which are (for a feature like this) going to be trivial to amend to always claim the person is an adult regardless of which account is being used.
At this point there are three possible futures that are worth considering:
1. Throw out the rules because they're stupid and everyone with any common sense or sense of decency has been saying it since the start. The service provider is responsible, not the OS developer or device manufacturer. (Best case)
2. Keep the stupid rules on the books and pretend they work. Let the service providers off the hook. (Second best case)
3. Create more rules that effectively cedes more control of personal devices to the government to make this actually work, but the effect of this is to essentially outlaw OSes like Linux and many, many devices and even raw hardware without a government permitted OS pre-installed. (The worst case)
(3) is extreme, but it's the only way that this law actually has the desired effect. (1) and (2) are the most likely outcomes, but reflect that this whole exercise is just a waste of time.
Your Step 2 assumes complete idiot parents. Parents who hand their kids a new device without adding any parental controls (A) are already in the minority today - I know a lot of parents and none of us would do that, and (B) can't be helped anyway under any scheme other than invasive identity "verification" (which this law isn't).
> bypassed by anyone using open source operating systems
You know what? If millions of tweens develop a keen interest in building Linux and Firefox from source just to get "the good TikTok" I'm fine with that. In reality 99% of them use iOS and Android nearly exclusively, so Linux is irrelevant to the conversation.
> The service provider is responsible
We tried that. That's the status quo. There are only two options I know for this, both stupid. 1. (the current model) Just trust the user. Talk about 'trivially bypassed'! 2. Invasive ID checks - with the camera, identity documents, and government databases.
If parents want to go out of their way to irresponsibly give their kids unmonitored access to content that is bad for them that's on the parents. If you try to make service providers "responsible" for it, they WILL build invasive, corporate-controlled systems to cover their asses. Basically option 3 but controlled by shitty companies that get hacked, instead of even a theoretically accountable government that will get hacked. Note that I am not saying your option 3 would be acceptable, just that a private version of it would be even grosser.
> Parents who hand their kids a new device without adding any parental controls (A) are already in the minority today
If this were actually true then the law itself isn't needed because kids are already getting filtered access to social media sites and other things. Right?
So then what is the point of the law if parents are already setting age filters for their children's devices?
1773350468 | Illinois introduces OS-level age verification law | https://legiscan.com/IL/bill/SB3977/2025 | https://news.ycombinator.com/item?id=47357294
1773770767 | Illinois Introducing Operating System Account Age Bill | https://www.ilga.gov/Legislation/BillStatus?DocTypeID=HB&Doc... | https://news.ycombinator.com/item?id=47416131
1786248239 | Illinois just told every operating system to start reporting your kid's age | https://itsfoss.com/news/illinois-age-verification-bill/ | https://news.ycombinator.com/item?id=49228350
> The signal itself isn’t a birthday, it’s a bracket: under 13, 13 to 15, 16 to 17, or 18 and up. Operating systems have until January 1, 2028 to have this built.
> Nothing in the bill requires a passport scan or a face scan at setup. It’s self-declared, the same way most apps ask your birthday today, just centralized once at the OS level instead of repeated app by app.
Maybe this is just a badly written law or purposefully designed to have basically no impact on anyone?
Or maybe the age bracket self-declaration part of this might make it a legitimately useful mechanism when a parent sets up a device for their kids. Their device declares “under 13” and apps and sites have to then follow the more strict social media laws which themselves should be relatively beneficial to the target audience.
In other words, the part that’s really privacy-destroying is the age verification, but that’s not part of this bill. The part that could be a benefit is the part where companies need to respect an age flag set by parents and comply with a concrete set of parental controls.
In other other words, it’s not left up to operators like Meta and Roblox to decide what age their users are, parents can set that device-wide and know it can’t be circumvented.
I love how everyone knows this has nothing to do with kids safety. However no one can or is willing to put up a fight. In the UK where I live its the same. Government does whatever they want and most of us just shrug our shoulders and say "that's messed up" and go on about our day.
The reason is ridiculously simple: people don't put up a fight because they don't want to be labelled as a peto or as someone not in favor of the protection of Children. This is primarily why this cudgel is brought out so often: it's very difficult to oppose because you risk getting shunned for it.
How has this fatalism been working out for your society?
It sucks for sure. But how is it going for yours or any other country?
I can't even get the politician of my city to reply to me in email because of his arrogant persona.
How am I suppose to change something when I can't even get the local politician to listen? Cash would; but I'm stripped for that. You have any?
The UK is relatively small and I see surveys suggesting 70-80% of the population think the country is on the wrong track. Perhaps you should have a national strike or something, make the politicians come crawling to you instead of the other way around.
Don’t worry. It will all burn down soon. This administration is preparing the narrative to "cancel the midterms" if they lose the senate and house. Using the illegal war as cover.
I'm surprised we're not seeing heaps of lawsuits here. Age verification in general violates privacy.
Nothing in this bill requires age verification. It just requires the OS to have a way to specify the user’s age (not necessarily an exact birth date), so that it can be provided to apps and websites that ask for it.
lawsuits for what? AFAIK you have no right to privacy in this sense
Legislating that all complex computing devices must give out your birthday (technically a "signal" of which bucket you're in, but sites are absolutely going to keep track of which bucket you where in, keep asking, and see when it changes).
It's constitutional case law that there's an implicit right to privacy in the constitution. I don't see a law that you must wear a band with your birthday out in public passing muster based on that. I don't see why existing in cyberspace changes the inherent privacy question, and in fact makes it more meaningful given ease of automation.
> It's constitutional case law that there's an implicit right to privacy in the constitution.
Constitutional scholar here! I mean, yes, that's true in a very general sense, but no court has held that age verification to gain access to a service, or even a device, is unlawful in practice.
Novice, but I'd argue that Dobbs has seriously eroded that case law. The right to privacy used to be pretty settled law, but now the foundation of that settled law is on sandy ground.
It was never really all that settled, IMO. Roe v. Wade (which is now dead) was built on a pretty shaky foundation that was inspired by emanations of privacy rights like the Fifth Amendment, in the absence of clear Constitutional language that made a privacy right explicit.
Not yet they haven’t. Not yet.
> I'm surprised we're not seeing heaps of lawsuits here.
Why do you think that is?
You don't have a right to privacy. It should be covered under the 9th amendment, but the supreme court generally just ignores that amendment.
Edit: I see people don't like this comment, so here's an article about it from Wex law [1] (read under "Roe's Overturning"). The part of the Dobbs decision was removing a right to privacy and promising that it could be revisited in overturning other cases like Griswald.
The 9th amendment has never been used to establish a right to privacy, but then I don't think the 9th has ever been used to establish any right. We've used the 14th in the past to establish that right and now it seems that's no longer good law.
> While it is unclear to what extent that may have on the right to privacy in the current time; it is likely that the case law around this right will continue to evolve with more recent Supreme Court decisions.
[1] https://www.law.cornell.edu/wex/right_to_privacy
I don’t think the Supreme Court as a whole wanted to overturn Griswold. At best, specific justices like Clarence Thomas wrote in a concurrence that he would want to overturn it, but that’s still far from the opinion of the court. Given the character of Thomas, it’s safe to say that most of his opinions don’t become opinion of the court.
2 days ago, 123 comments: https://news.ycombinator.com/item?id=49228350
Cool. I'd like to propose a federal law wherein every lawmaker, state or otherwise, musts either demonstrate they correctly enough understand the subject they're legislating over (for every single instance of legislative act they perform) or get approval from an actual accredited expert panel before being allowed to push any more inane bullshit that will help noone in the future.
It’s a series of tubes! It’s not a big truck!
The law: https://www.ilga.gov/documents/legislation/publicacts/104/10...
Thankfully for now this dragon is a hydra. Too many paths to block for now. The whole TPM fiasco with windows is preparation to put the genie back in the bottle. Soon, much sooner than I would like you will need a Global ID to access the internet, which will require an "internet safe operating system". It's only a matter of time. Get your sneakers ready folks.
How about a second internet ?
Does it even ask for verification? If not, the problem with it is that it seems to require the OS provider (not the local installation) to store the age.
No, no verification. From the post:
> "Nothing in the bill requires a passport scan or a face scan at setup. It’s self-declared, the same way most apps ask your birthday today, just centralized once at the OS level instead of repeated app by app."
I think this is a bad thing overall, but if the OS is responsible for reporting my age, that means I get to pick my own age... I'll take what I can get.
Some states will pass laws that companies cannot show advertisements to minors. So...
I think I'm about to become a bit of a minor myself, at least whenever it serves my interests.
How old is the root user? How about the nginx user? How about “nobody”?
Not surprised - I live in IL and almost every SaaS I pay an extra "15% Chicago Lease Tax". Politicians hate tech here.
as Linus would say, that is a userland issue, not a Linux issue
as Stallman would say, that is a userland issue not a GNU/Linux issue ;P
Incorrect. GNU/Linux includes userland while Linux doesn't.
However, unlike GNU plus Linux plus systemd plus FreeDesktop.org, it does not constitute a usable Operating System for a Desktop computer per se. Merely having a notion of userland isn't sufficient! Is age verification to be placed within the coreutils? I think not! Hyperfocusing on putting the API in systemd should be sufficient....
Pay no heed to anyone saying anything different, regulators!
This renders all servers in Illinois illegal. Thanks.
I would like to take a break from all the complaining and point out how hilarious it is that this law does not apply to any computer that can only connect to the internet via an Ethernet port.
> The bill’s own text caps penalties at $7,500 per affected child.
If the distro does not ship with any hardware, it could only be attained via download? So how would this imperil Linux distros?
Not to defend the law, it's comically pointless. Conservative states demanding ID verification for anything 'pornographic' and progressive ones trying to limit anyone under 18 from having any social media access at all. Clownish.
https://agelesslinux.org/
Can someone tell me why all of the sudden everyone's totally cool with letting political hacks choke the internet to death?
We used to make fun people like Ted Stevens for calling the internet "a series of tubes" and now we're just totally cool with letting a failed, bankrupt state in the US dictate what code needs to go into voluntary open source software. We need to fight back, now.
The interesting part here is enforcement. Linux isn't controlled by a single vendor, so I'm not sure who the law would actually target.
A Linux distribution is
So presumably the next step is they move their servers out of the US and then DA's target the Linux Foundation directly (e.g., coerce the kernel to take a change by some Meta engineers that "attests" a device when said option is compiled in, then force it as default on.. so in Debian you'd get an "Illinois"-kernel variant).
At which point the only move is to relocate the foundation to another country, which will then of course be hit by tariffs and sanctions.
"another country" is drafting this same law right now.
There are 189 active legislative bodies to choose from; it's hard to imagine, but yes in the worst case they all fall in lockstep on this issue and none of them provide this kind of freedom. The obvious next step is to buy a remote island (better yet: some foreign body in Space) and form "Freedom (tm) Republic".
Remember that "pirate" guy buying an oil rig and building "freedom" crypto / torrent "country" there, with Datacenter running on the rig? That did not end well. Another case is Kim DotCom. And just look at the "success" of UK's freedom. TBH, we all are f...d.
Yeah. This is basically why we need to "accelerate"..
Backdoor way to get data centers out of your state.
Democrat Representative Jennifer Gong-Gershowitz in the House
Democrat Senator Willie Preston [D] in the senate
This is unconstitutional. Code is freedom of speech and cannot be censored in any fashion. Period.
Declaration, not verification
Ok so, all the appliances and cars and TVs and who knows what other embedded electronics sold in Illinois will require the user (?) to verify their age?
Not verify. Voluntarily attest an age bracket.
Here's my slight defense of something like this, in theory. I have not read the text of the bill.
If OSes build a standards-based way to query age of user that is logged-in, where non-admins are not allowed to adjust the age bucket, then parents can configure devices on first use to have an OS-wide enforcement of age controls.
Apps and sites would query the OS, not individual app/site accounts, for user age and act accordingly.
Apps can then lock out certain features like algo feeds and adult content more consistently.
Responsibility for proper use is still on the parent, and no verification process is put upon the operators of sites.
Not sure how I actually think about this; I'm only putting this out for discussion.
Storing age is no different to storing name or address to me, it’s just a field in /etc/passwd, and root can change it.
I would disagree. First, passwd(5) is a venerable and rigidly-defined format. Can we please stop abusing poor GECOS for everything?
Second, storing PII in a world-readable file is unacceptable. Linux is multi-user so the administration needs to be responsible about sensitive data like that! Find somewhere else to stash it!
TL;DR: learn how to live without computers.
This will end Linux as end user OS, it will stay only in Cloud and containers. Arguably, the goal here is to destroy home PC altogether. maximum we will be allowed is a laptop with endpoint verification and mandatory touch ID, locked boot and non-replaceable hardware. If you think Linux is the end of it – think again. The same crap will be implemented in BIOS/UEFI, on "HW management" level. Essentially, your bare HW only laptop will not even start without you touching fingerprint sensor and allowing it to "validate your age" against – of course government approved – HW manufacturer.
Same with smart phones – it's already here, if you tried to activate iPhone.
And projects like Open/Free BSDs? Government will sure their leaders happily retire and ... well, the community will just "die" naturally.
Okay, go scorched earth with malicious compliance.
These laws are so short-sited and willfully ignorant of the unintended consequences. The constitution provides rights and protections, and the government cannot compel speech. This will be appealed on consititional grounds and reversed. If not, I'd ban any Illinois resident from being able to use the site and redirect them to their local government representation. Compelled speech is just one attack the law is open to.
Insert X reason to steal user freedom
[dupe] Earlier: https://news.ycombinator.com/item?id=49228350
What does this have to do with us?
Illinois can put up a great firewall like China and search citizens devices for contraband operating systems. The onus is not on tech to enforce it, it's on them.
Unpopular opinion, but this is objectively better than having to upload your ID to every random website that requires an age check (if that's what the end result is).
In the sense that a website could just ask your OS if you are over a certain age and that age was self declared? That seems fine to me, but why can't the websites just ask me for my self declared age?
That's how things used to be and that makes more sense in my opinion because an OS isn't the thing displaying content. It just run whatever it is told to run.
>but why can't the websites just ask me for my self declared age?
Because children just click through the age gate when it suits them. With this legislation, a parent that purchases the device and creates an account for the child can set the age once and take the decision out of the kids hands. It's a huge improvement without any significant privacy issues. I can't fathom why the tech crowd is having a collective aneurism over this.
>OS isn't the thing displaying content
But the account on the OS is the right place for the single source of truth of properties of the current user.
I hope i can find this comment in a few years.
Also children can "come upon" devices, so this is still completely pointless unless there's a way to ban devices that don't have this ability. and the only way to do that is to ban devices that cannot verify the user's age. since a device can't really verify an ID, some third party (ideally meta, but also the government works) needs to verify id and age, write something to the secure enclave of the device, and now that's stuck with the verified age set.
If "just let someone report the age" worked, pornhub wouldn't be blocked in TX.
>Also children can "come upon" devices
Yes, this mechanism isn't perfect, but is a substantial improvement over the status quo.
>and now that's stuck with the verified age set.
This inference is nonsensical.
>If "just let someone report the age" worked, pornhub wouldn't be blocked in TX.
Also nonsense
How do you propose that a child's device will remember their age in a "legally distinct" way for the life of the device? You ought understand what i am asking here, as it directly follows what i said before. You have a child, somehow the device knows how old the child is. An adult sets it? great. What if the device wasn't set up by a responsible adult?
You don't foresee a black market of "no-age-audit" devices? How do you prevent that? Well, one way is to use the secure enclave and write the birthday in it so that it cannot be tampered with. How is that written? who writes it? Who verifies the ID?
TX passed a law stating that adult sites like pornhub must verify age. I hope you understand what "verify" means in this context. It isn't "i promise i am over 21 or 18 or whatever" - because if that worked, TX lawmakers wouldn't have made the law say "verify" https://journals.law.unc.edu/firstamendmentlawreview/screeni...
In the future, casual dismissals are viewed negatively.
I really don't know where you're coming from. You seem to be imagining that the law requires some kind of cryptographically validated age attestation. The law requires nothing of the sort. It's just an age field associated with the account. There are many ways to get around it, none of which the law demands protection against. It's simply a standardized way for parents to ensure a modicum of reasonably effective age-discrimination for online services.
There are no secure enclaves, no verification, and certainly no black markets. I really don't know where you are getting any of this from.
>TX passed a law stating that adult sites like pornhub must verify age.
Yes, when states are left to their own devices to come up with laws, some of them will be more onerous than others. But I don't know what you think you can infer from this. Casual dismissal was warranted.
The computer owner can set the age, not the user.
I am root on my computers. My 11 year old isn’t root on my computers.
Most kids are and this law won't change that.
> My 11 year old isn’t root
that you know of. when you were 11 could you get root? I could. I got expelled from a highschool for getting "root" on a DOS machine by holding down the shift key (at 13).
All it takes is one moment of weakness from a parent or not blocking the kid's view of the keyboard, or the kid getting an app that figures out possible passwords from keyboard sounds (it'll be here someday), or any manner of other things, like you forgetting to close your session.
11 year olds aren't stupid.
also there's nearly weekly exploits that get your root on a linux machine, so unless you're blocking arbitrary code downloads, which means you're going to have to whitelist sites you allow your kid to visit, which means they're probably just going to get that stuff elsewhere, as is customary. Again, 11 year olds aren't stupid. any one of them could tell another "here's a script that gets root" and spread it around school. If it became a thing.
I just had a vision of linux being outlawed because it's too insecure
Instead of the client sending the user's age to the server, why not make the server send a minimum age to the client? The client is welcome to block content without disclosing personal information to the server. This is as secure as sending an unverified age to the servet.
Because the requirements being placed on social media sites are much more nuanced than simply allowing or blocking content... to implement this all in the OS or browser would require an exponentially more complicated API.
It started with showing ID at airports and now we have to take off our shoes. Slippery slope is the actual modus operandi of government.
That argument might work better if just recently we no longer have to take off our shoes.
25 years later and we still have a ton of other restrictions.
Come on. Now you get face and body scans. That's not better. And when the machine randomly selects you, you take off your shoes anyway, and then they frisk you.
because of the backscatter machines? I'm not sure you understand what is being claimed.
...we don't have to take off shoes anymore at US airports though.
Because they can just look at pictures of you naked now. Much better!
Making a stupid idea more convenient does not make it less stupid.
Dystopian nightmares are built from tiny "oh, that's not too bad, just a little step further. Not much different from what we already have"
You can personally avoid those websites, if you philosophically disagree with those terms. Good luck avoiding the operating system.
Including Tails?
This is worse than the California one. Since this applies to all Internet-capable operating systems, it's effectively forcing people to utter their age bracket in order to communicate digitally, which is compelled speech - a violation of the First Amendment.
Here's an idea for the lawmakers that actually want to solve the digital parenting problem: fix the mobile OS duopoly with antitrust. Most kids only know how to use touchscreen devices. If you force mobile hardware vendors to ship smartphones without an OS, then we will get plenty of forks of Android and even entirely new OSes as a result of natural demand, some of which will be toy OSes with all of the child features built in. We'll also get scam-proof OSes for the elderly as a bonus. There is no good reason for the entire population to use the same OS.
Does this mean you need to register your children and their ages with your smart fridge?
The Epsteinocracy wants to know how many children you have and exactly how young they are.
“You may not be interested in politics, but politics is interested in you.”
Gross. Age verification is a completely degenerate level of privacy violation
It’s bonkers that 50 states all decide to make their own set of rules for this. Maybe talk to each other?
It's a feature that states can (mostly) decide for themselves what laws they want to live under.
when it comes to commerce it isn't because it makes doing business impossible. How is this practically going to look, Canonical, Red Hat and open source maintainers are going to ship 50 different Linux distributions in the United States?
The reason the US has fairly robust interstate commerce laws is because if you don't you'll have trade barriers between states. Even the most well intentioned internet company can't operate in that ecosystem
Yes the constitution specifically identifies commerce as something Congress has the power to regulate. That doesn't mean states can't have their own rules. Many states have various forms of legalized cannibis, different laws regulating firearms, or automotive emissions.
But this is clearly interstate commerce, given the global nature of the Internet and the distributed nature of development.
I look forward to these laws being shut down in the courts.
Fuck that. Competition and diversity is way better. Anyine who fucks up can just change their laws later.
So that includes Android? What about the Unix of iOS?
You can also thank big tech for this because they'll do anything to not verify age on their platforms they want to push it onto devices and OSes.
Our political and business elites need age verification added to their penis.
I hate that news you can’t ignore comes packaged as obvious slop you have to trudge through to to comprehend.
It's none of your business. Go pound sand.
I don't understand how you are actually going to be able to enforce this when Linux is not "owned" by a single company.
Also how is that fine going to work if you don't have any children?
Seems impossible to enforce but the goal I suppose is to hit the biggest players to force a trickle down on average users.
These laws still do not sit well with me. This is just going to create endless lawsuits. In my opinion the safer choice would be to avoid doing anything with current teens, that's just a non starter. Instead think of sliding windows of time and sandbox small children on a child account that if all goes well will one day be a teen and then an adult. They will thank you when they are an adult for looking out for them when they were too young to consent to the data leaked by these laws.
Why not just signal age ranges? Simple, the way the legal system works is one puts in a benign sounding law, then tweak it every year since the mechanism exists. (scope creep) "Now add city, state", "Now add DOB and address", "Now add your federal wallet ID."
- For small children set an RTA header (previous discussions) [1] for any URL that may potentially contain content not appropriate for small children. Give site operators 1 year to implement this. Not counting QA and change control this takes minutes.
- Require app and device vendors to create a properly sand-boxed child account. Pen test it but it does not have to be perfect. This is for small children and default installed applications. If the child visits a URL that contains the RTA header then trigger parental controls. It is entirely up to the parent when that child is ready for mature content. It must be impossible for the child to install any applications, addons, etc... There are a myriad of ways to accomplish this.
- How is this enforced? Same way as any other parenting issue. If there is an incident that involves law enforcement, then social services can investigate and determine if negligence was occurring. When the child is mentally mature enough to deal with all the crap that is the internet their account is converted to an adult account. If the parent is giving the child an adult account before they are ready then the parent(s) go to mandatory parental training. If the child was being bullied or groomed, redirect law enforcement to go after the bullies or groomers.
- Set the laws to be active for any small child that would be under 13 as of the year 2034. Presto! One need not try to confine teens. When these small children are teens they will either be used to the sandbox account or the parent may have converted the account to adult.
As a side note all public and private schools should be legislated to have classes on dealing with all the crap the internet has to offer. Bullies, Cry-bullies, Trolls, Groomers, Scammers, Devious companies, Astroturfers, Gas Lighters, Propagandists, NGO's and so on. Also teach and help them build friend networks so there is protection in numbers. No child should be friendless.
[1] - https://nochan.net/b/Internet-Crap/20230829-Think-Of-The-Chi...
Just make it a liability for social media companies. Let them figure it out. This is how we age gate everything else.
Why are you people in such a hurry to have facebook et al collecting government IDs?
> Why are you people in such a hurry to have facebook et al collecting government IDs?
I want kids off social media. I don't care what happens next. If we're really concerned about this, also make it a legal liability for social media companies to retain IDs collected to verify age.
I predicted this would happen. Others also predicted this would happen.
I think now even the last person realises that this has nothing to do with age "verification". They simply hate us for our freedom. And it is clearly a move coordinated by private business here; their lobbyists are acting. This is also why it is the same law essentially in so many different countries at the same time. It is quite fascinating to watch, actually. People used to say "conspiracy nut!" - well, the facts are too clear now. That's no longer a conspiracy.
Is being concerned that this article is obviously AI slop matter anymore?
It's only ever brought up by people with absolutely nothing to contribute to the conversation. So you've got that going for you.
Oh come on guys, don't...
Can't believe all this shit just allowed to happen then Muricans still claiming to have more freedom than China or Russia for long..
Lets check how that state votes. "Solid Democrat". Yep.
One doesn't make Linus disappear for some time and then arrive apologizing for stubborness and embracing the imposed CoC just for the heck of it.