A new California law says all operating systems need to have age verification
pcgamer.com
pcgamer.com
rm - ok for all ages.
grep - 18+, you can obviously use this to search for porn.
find - 18+, see grep.
reboot - ok for all ages.
echo - ok for all ages.
cat - 18+, prints the porn you found directly to your terminal.
sudo - 18+, obviously.
kill - ok for all ages. This is the US, right.
ps - 18+, no peeping at other processes.
reboot - you never know what the sysadmin might have loading on boot, unsafe as it could load porn
echo - ASCII art would like to have a word
kill - I know the US will have mixed feelings, but communicating with other processes might allow them to send you porn
> cat - 18+, prints the porn you found directly to your terminal.
Sound good in theory, until you realise that any teenager knows perfectly well how to trivially get around the lack of `cat` to read their terminal smut:
$ while read -r LINE; do echo $LINE; done <my_porn_file.sextI'm not so sure, who knows what woke UEFI and edgy motherboard vendors are putting up as splash screens these days. And the law doesn't even consider those since they aren't part of the OS!
- Microstamping requirements for guns—printing a unique barcode on every bullet casing (Glock gen3 cannot be retired, thus, the auto-mode switch bug cannot be patched...)
- 3D printers should have a magical algorithm to recognize all gun parts in their tiny embedded systems
- Now, you need to verify your age... on your microwave?
At this rate, California should just go back to the Stone Age. Modern technology is simply not compatible with clueless politicians who are more eager to virtue-signal than to solve any actual problems or even borther to study the subject about the law they are going to pass. There will be more and more technology restrictions (or outright bans on use) in California because it's becoming impossible to operate anything here without getting sued or running afoul of some overreaching regulation.
It seems all at once, everywhere that many groups that have a vested interest in forcing precedent and compliance of non-anonymous access across the computer world. It smacks of something less-than-organic.
TLDR: Evil people be doxxed internally not everyone.
If server side, you already have the heavyweight stuff going on, and yes there is no need to do all the bypassable shenanigans.
These days the name "LLM" refers more to the architecture & usage patterns than it does to the size of model (though to be fair, even the "tiny" LLMs are huge compared to any models from 10+ years ago, so it's all relative).
And when the idiots do, the proposed system locks the fire door for them. That's just dangerous. We'd want them with bunch of confusing options and better illuminated de-escalation paths.
1. When you set up your account and it asks for your birthdate, make up any date you want that is at least far enough in the past to indicate an age older that what any site you might use that checks age requires.
2. Access things the way you've always done. All that has changed is that things that care about age checks find out you claim to be old enough.
The only people it actually materially affects on your new computer are people who cannot set up their own accounts, such as children if you have set up permissions so they have to get you to make their accounts.
Then if you want you can enter a birthdate that gives an age that says non-adult, so sites that check age will block them.
From a privacy and anonymity perspective this is essentially equivalent to sites that ask "Are you 18+?" and let you in if you click "yes" and block you if you click "no". It is just doing the asking locally and caching the result.
This puts the responsibility back on parents to do the bare minimum required in moderating their child’s activities.
Possibly it could be further mandated that the OS collect relevant rating information for each account and provide APIs with which browsers and other software could implement filtering.
And possibly it could be further mandated that web browsers adopt support for this filtering standard.
And if you want a really crazy idea you could pass a law mandating that parents configure parental controls on devices of children under (say) 12 and attach civil penalties for repeated failure to do so.
There's never any need for information about the user to be sent off to third parties, nor should we adopt schemes that will inevitably provide ammo for those advocating attested digital platforms.
Sending all the "bad" data to the client and hoping the client does the right thing outs a lot of complexity on the client. A lot easier to know things are working if the bad data doesn't ever get sent to the client - it can't display what it didn't get.
When you click on a search result, you load a new page on a different website. The new page would once again come with a header indicating the content rating. This header would be attached to all pages by law. It would be sent every time you load any page.
Assuming that the actual problem here is the difficulty of implementing reliable content filtering (ala parental controls) then the minimally invasive solution is to institute an open standard that enables any piece of software to easily implement the desired functionality. You can then further pass legislation requiring (for example) that certain classes of website (ex social media) include an indication of this as part of the header.
Concretely, an example header might look like "X-Content-Filter: 13,social-media". If it were legally mandated that all websites send such it would become trivially easy to implement filtering on device since you could simply block any site that failed to send it.
> A lot easier to know things are working if ...
Which is followed by wanting an attested OS (to make sure the value is reliably reported), followed by a process for a third party to verify a government issued ID (since the user might have lied), followed by ...
It's entirely the wrong mentality. It isn't necessary for solving the actual problem, it mandates the leaking of personal data, and it opens an entire can of worms regarding verification of reported fact.
If you imagine a world where you have a header, Accepts-Adult-Content, which takes a boolean value: you essentially have three possibilities: ?0, ?1, and absent.
How useful of a tracking signal those three options provide depends on what else is being sent —
For example, if someone is stuffing a huge amount of fingerprinting data into the User-Agent string, then this header probably doesn’t actually change anything of the posture.
As another example, if you’re in a regular browser with much of the UA string frozen, and ignoring all other headers for now, then it depends on how likely the users with that UA string to have each option: if all users of that browser always send ?0 (if they indicate themselves to be a minor) or ?1 (if they indicate themselves to be an adult or decline to indicate anything), then a request with that UA and it absent is significantly more noteworthy — because the browser wouldn’t send it — and more likely to be meaningful fingerprinting surface.
That said, adding any of this as passive fingerprinting surface seems like an idea unlikely to be worthwhile.
If you want even a weak signal, it would be much better to require user interaction for it.
https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
Your toaster is not impacted. You’re turning a law that, yes, has some open questions around implementation, into a way bigger scare and conspiracy.
> operating system provider, as defined, to provide an accessible interface at account setup that requires an account holder, as defined, to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store and to provide a developer, as defined, who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface regarding whether a user is in any of several age brackets, as prescribed. The bill would require a developer to request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.
Let’s be honest here. 99% of general purpose computing devices targeted at consumers make an “account” when you setup for the first time. Even Linux if just to name a home directory. It’s pretty obvious what an account is. Especially when it only applies to bundled app stores. What App Store has no account anyways?
It allows the operating system to define the interface. No patent or proprietary system. No surveillance. The law says user interface. Not graphical interface. Do with that as you will. A OS producer who has an App Store probably has a graphical interface, but if not they surely figured out how to interface with users already.
It actually requires operating systems and developers to not abuse this data or use it for anticompetitive purposes.
There is no attestation. It’s entirely self reported and unverified.
Their definition of "app store" is a mile wide: "(e) (1) “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing that can access a covered application store or can download an application."
Grats, github is an appstore. apt-get is an app store. You posting software on your own website is an app store.
Apt… yes is an App Store run by an operating system organization (Debian org). That feels pretty unsurprising. Debian’s parent organization (headquartered in the US) probably needs to comply with this.
And that right there is exactly the fucking problem. A zero profit collective “store” that publishes zero profit hobbyist “apps” is now going to have to invest in some kind of harebrained compliance scheme that will only grow from here.
In a couple of years is my “app” in Debian’s store going to require some goddamn TPS report and certification to tell California that everything is above board? It’s incredibly likely! By itself this law does nothing but lay the groundwork for regulation of “apps”, which by itself might be acceptable, but including FOSS distribution channels and hobby apps in the scope of this law is nothing short of evil. It’s laying the groundwork for a frontal assault on FOSS, and if you don’t see that then I don’t know what to tell you.
My guess is that Linux wasn’t extensively considered in the writing of this law, but when the next stage comes along and people start complaining, legislators will shrug and say “oh well, they need to comply”—and lobbyists for the big 3 proprietary software firms will back that position up. This is setting up a killshot for consumer Linux.
From the bill:
> (3) (A) Except as provided in subparagraph (B), a developer shall treat a signal received pursuant to this title as the primary indicator of a user’s age range for purposes of determining the user’s age.
> (B) If a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant to this title, the developer shall use that information as the primary indicator of the user’s age.
It's not enough to just accept the age signal, you can still be liable if you have reason to believe someone is underage based on other information.
The cheapest and easiest way to minimize that liability is with face scans and ID checks. That way you, as a developer, know that your users won't bankrupt you.
If websites accept this as age verification it could provide a very easy way to bypass it.
In fact, looking at it again, point B specifically says if the "developer" has information rather than the "system" has information. So really sounds like if the developer isn't collecting logs that they can access themselves this wouldn't apply to them.
Reading the first analysis PDF:
> This bill, sponsored by the International Centre for Missing and Exploited Children and Children Now, seeks to require device and operating systems manufacturers to develop an age assurance signal that will be sent to application developers informing them of the age-bracket of the user who is downloading their application or entering their website. Depending on the age range of the user, a parent or guardian will have to consent prior to the user being allowed access to the platform. The bill presents a potentially elegant solution to a vexing problem underpinning many efforts to protect children online. However, there are several details to be worked out on the bill to ensure technical feasibility and that it strikes the appropriate balance between parental control and the autonomy of children, particularly older teens. The bill is supported by several parents’ organizations, including Parents for School Options, Protect our Kids, and Parents Support for Online Learning. In addition, the TransLatin Coalition and The Source LGBT+ Center are in support. The bill is opposed by Oakland Privacy, TechNet, and Chamber of Progress.
I think you’ve nailed it here. How many of these people campaigned on this issue? Where were the grassroots to push this? Where did this even come from?
Somebody, somewhere - with a heck of a lot of money - wants to see this happen. And I don’t think they have good intentions with it.
Of course they are copying the play everywhere.
I'm no democrat, although I'm sure as hell no republican, and as a resident of the state, I'm also a routine critic of the California state government.
I agree that a lot of their activities are indeed, performance art in nature.
However I do agree with the identification requirements on guns and ammo.
You can't shoot someone with a computer, no matter what OS you run.
The idea that lethal weaponry is the same as any other consumer product is just not accurate.
You can't put the genie of firearms back in the bottle any more than Hollywood can put the genie of p2p file sharing back in the bottle. Trying to do so is like trying to unscramble eggs. It doesn't matter how valid your desires or justifications for attempting to so are, it's an act of banging your own head against the cold, hard wall of reality.
I don't have a stance here on what "the right" policies around gun control are but it is clearly a much wider field than just a preplanned assassination with diy parts.
A non-exhaustive list of a few very different scenarios that are all involved with anything touching or rejecting gun control:
- highly motivated, DIY-in-the-basement assassination plots like you mentioned - hunting for food - hunting for fun - wilderness safety - organized crime and gang related violence - mass shootings at things like concerts, sporting events, colleges. Sub point of mass shootings at schools where the law requires children to be. - gun violence involved with suddenly escalating impromptu violence like road rage and street/bar fights - systematic intimidation / domestic terrorism of particular groups or areas - gun related suicides
All of these are very very different. None of them have perfect answers but that doesn't make thinking about it "an act of banging your own head against the cold, hard wall of reality" nor does it make anyone interested in working on some of these problems naive or stupid like you imply.
If you're being earnest or maybe jaded, I'd say dont give up hope and don't let perfect be the enemy of good.
If you're just being a dick then so be it, maybe someone else gets something out of this comment.
That kind of mistake is common here, but I don't think it is due to a failure of logic. I think it is something deeper.
I've noticed that people who have worked deeply and/or a long time as developers tend to lose the ability to see things as a continuum. They see them as quantized, often as binary.
That's also why there are so many slippery slope arguments made around here that go from even the most mild initial step almost immediately to a dystopian hellscape.
This is prevalent enough that it arguably should be considered an occupational hazard for developers and the resultant damage to non-binary thinking ability considered to be a work related mental disability with treatment for it covered by workers compensation.
A way to protect against developing this condition is to early in your career seriously study something where you have to do a lot of non-binary thinking and there are often aren't any fully right answers.
A good start would be make part of the degree requirement for a bachelor's degree in computer science (and maybe any hard science or engineering) in common law countries a semester of contract law and a semester of torts. Teach these exactly like those same courses are taught in first year law school. Both contracts and torts are full of things that require flexible, non-binary, thinking.
No, you can just target-lock them. The computer database (and now, LLM) is probably the biggest threat to freedom in existence. You can keep your popgun. They'll know where it is, and come with bigger ones.
China be doing some pretty heavy-duty damage with computers, but age-gates won't stop them.
Anyone buying or selling a microwave with an app store deserves this mess.
You can remove the in California
Older people have already seen all the patterns, and realize you have to focus on specifics, and that helps clean up the general issue.
A realistic dynamic is the old people are comfortable with the general problems and have positioned themselves to benefit from them. Indeed, they solved the general problems that troubled them in their youth with political activism in their middle age. The young people have different political needs that require general problems to be solved.
Also young people have a terrible track record of actually identifying problems, they are pretty clueless in the main.
Or they just realize that the general problems are insoluble.
So we don’t have professional legislatures with long-term electability incentives or leadership goals, we have a resumé-building exercise that we call the legislature. They’re all interchangeable and within 12 years, 100% of it will be changed out.
There, the professional legislators can't get anything right either.
Do you think there's a middle ground of increasing the term limits to, say, 18 or 20 years?
That's at an age where wizened legislators can move into advisory roles, instead of needing to find a next career.
A much more real issue is actually age limits. If someone starts in the Senate at 40 and serves for 24 years, term limits hardly seem to be the big issue. They are retiring at a normal time, and they should still be functioning at a high level.
Conversely, someone who gets elected at 70 and then gets term-limited at 82 is still over a normal, reasonable retirement age. The typical 82 is not in the physical or mental condition to be taking on such an important, high-stakes role.
Both of my parents are in their mid-70s and are in very good mental health for their age. They are very lucid, and my Dad still works part-time as a lawyer. They are also clearly not at the same intellectual powers they were a decade or two ago. Some of it can even just come down to energy levels. I have to imagine being a good legislator requires high energy levels.
Many public companies have age limits for board members, and they even have traditional retirement ages for CEOs. In the corporate world where results matter, there is a recognition that a high-stress, high-workload, high-cognitiative ability job is not something that someone should be doing well past their prime.
Al Gore had to leave the Apple board because he turned 75. In the U.S. Senate, there are 16 people 75 and older.
That is one aspect, but not the important one. The most important element is anti-corruption. Legal bodies can always entrench themselves and their own interests. Term limits significantly weakens entrenchment...excepting when the same legal bodies inevitably gut it.
That's in fact not at all what the research says. There's a decent amount of research that suggests that they actually increase corruption. There's overwhelming evidence that they increase the power of lobbyists and interest groups.
This is a classic one of those ideas that many people intuitively "feel" makes sense but is actually just terrible policy.
> There's overwhelming evidence that they increase the power of lobbyists and interest groups.
There are a lot of factors beyond term limits that influence this kind of research. The most important detail is to remember that corruption spans more than external influence. Institutional ossification has benefits and drawbacks. The drawbacks have outweighed the benefits, historically in the US and England. It was literally baked into the US Constitution to ensure this would not repeat for the US head of state. Notably the Supreme Court was baked in as a lifetime appointment. Granted, the remaining political bodies have not followed suit, I think it's clear that this has had a negative consequence due to the aforementioned entrenchment of the political parties.
> There's overwhelming evidence that they increase the power of lobbyists and interest groups.
It is incorrect to claim that is the only effect. I also don't believe that the conclusion is correct. I do believe it's closer to your initial statement.
> it's just a way for [legislators] to not take responsibility for their voting.
ie It shows a lack of care in executing the responsibilities of the elected position, which is why they barely do anything but campaign at the federal level.
IMO, the real issue is that voters are coerced to accept candidates put up by the parties due to FPTP. The threat of the wrong side winning gets people to accept someone they don't want. The primary process does not need to be democratic, and the results are pressured by the future threat of losing to the other side in a head-to-head.
US is running on beta version democracy; it was wonderful for a trial run and we learned a lot from it, but unfortunately the country has been stuck without upgrades for a while. It'd be like trying to connect a Xerox PARC desktop to the modern internet.
Obviously it's absurdly nontrivial to shift it at this point but I do agree that age and term limits both seem to be stopgap solutions due to the challenge of implementing more effective strategies.
Consider Australia: of 226 parliamentarians, there's one aged 75+: Bob Katter.
I'd say there's three features of the au system that keep us relatively free of the absurd incumbency advantages in USA:
1. Compulsory voting makes it harder to solicit votes from a subset of the populace.
2. The Australian Electoral Commission is highly trusted as a neutral body, so Gerrymandering is rare.
3. None of our voting systems use First Past The Post; it's all ranked choice, babes!
Plenty of shitty ideas are popular based on a hope and a prayer. That’s why you don’t give in to populism. If we’re to impose any kind of limits on Congress, it has to be more intelligent than term limits.
If the problem is representatives using insider knowledge to enrich themselves then just hire more Inspectors General. If the problem isn't insider knowledge specifically then make whatever allows them to get rich illegal.
I think its more :
if your taxable income during OR post-office exceeds (some 1,3,5 yr average) prior high watermark income, or the officeholder's salary (whichever is higher), every penny over high watermark is taxed at 99% tax rate.
That should take care of those pesky "speaking fees" and other nonsense that makes politicians rich.
Raises an interesting question of who is less popular, the Californian government or the US Senate. The experiments with long-term professional legislatures have generally not been very promising - rather than statesmen it tends to be people with a certain limpet-like staying power and a limpet-like ability to learn from their mistakes. In almost all cases people's political solution is just "well we didn't try my idea hard enough" and increasing their tenure in office doesn't really help the overall situation.
The result is that you can stay as long as people keep voting you back in, but you lose the incumbency advantage and end up with a higher turnover rate without ending up with a 100% turnover rate. And you make them learn how other parts of the government work. It wouldn't hurt a bit to see long-term members of Congress do a two-year stint in an administrative agency once in a while.
I think I'd suggest a more generous Senate term limit. Three terms (18 years) would allow for someone to see out a complete Presidential super-cycle, for example.
The word Senate is etymologically related to "senior", it's a place where you _want_ people to be able to develop a lot of institutional experience.
edit: I see the "term limits are anti-democratic" takes elsewhere in the comments, so I guess let me narrow the above ask to "someone who isn't opposed to term limits, but thinks this idea is flawed."
Put the electables in isolation cells fromwhere they one by one end up on the Tee Vee, give voters an app with AYE, NEY and Uhh? The questions are red by the winning HR lady but also appear on the app.
The applicant writes the fizzbuzz etc etc
Then, after the job interview, we give the job to the most satisfying candidate!
It's not necessary but I would also add a series of certificates and diplomas for the voter to show they actually have some kind of idea what the job involves. The level 1 certificate should be supper simple and easy to create. It will grant you 0.1 extra vote power. There could be as many levels as we want but to grow beyond [say] 50 votes should require a mythical effort impossible to attain for 99% while we aim to reserve the right to cast 5000 votes for 1 to 5 people with supper human abilities.
The top 20 should have to explain their AYE's and their NAY's to the Tee Vee audience.
I’m not disagreeing with the rest of your comment, but I’m going to challenge the notion that this etymological connection carries meaning. The word comes from Roman Senate, and in that context in Latin “senior” really meant people with higher status rather than age. Latin is full of these weird double meanings. Compare to seigneur in French or señor in Spanish. Also, the House of Lords in the United Kingdom.
All those using it to mean 'factually' are out there making a farce of the language. A farce!
Everyone would like to term limit other people's politicians but they like experience for their own. The length of terms can't resolve that one way or the other.
With the Supreme Court we tried eliminating terms altogether, in the hopes that it would give people a chance to bond away from the necessity of appealing to the public. That just pushed the problem back to getting the most ideologically committed judges on the bench... through the Senators.
I haven't heard any structural solution to the problem of Americans just not liking each other.
That should not be a profession.
Decisions should be made by people who are the most informed about the subject matter. By definition you cannot have someone who is the most informed about everything.
We elect the way we do and empower the way we do because it empowers voters to choose on a regular recurring basis who is going to provide oversight that way. When you start screwing around with the basis tenets of electoral democracy, you distort and pervert the value of an actual legislative seat and undermine the value of holding people directly responsible through elections.
Another good example is the ballot proposition system. Some things must go before voters—which is another separate wrong which would be righted—but apart from those, the ballot proposition also presents legislators an opportunity to outsource decision-making risk to voters where instead of having to take a chance of being wrong on a piece of legislation with a roll call vote, they can pass the risk off to State voters. If people voted on the issue directly, they’re not as empowered to hold the people who only put it on the ballot rather than making the decision as someone whose job is to make & pass legislation.
You want legislators to be empowered to serve their role in society so that they are also taking real risks every time they take a stand on an issue that risks pissing off their constituents.
This is not true-by-definition . It may be true, but not by-definition. If there were an omniscient person, they would be the most informed about everything.
I don't know what the solution is for California, but I don't think it's that.
Overall, if the objective was to have a non-identifying age flag in operating systems, this isn't the end of the world (though I would have preferred enabling other things I've mentioned here in the past like opening up OSes). If there were younger people in the legislature that tried to understand this better than octogenarians, I think term limits are working fine.
Hopefully parents can use the parental control tools built around this non-identifying flag for some good.
I think the answer may be that the difference in political systems (parliamentary vs presidential) and party systems (less two-party but with greater party discipline) solves many of the problems term limits are intended to solve in completely different ways.
Maybe a better answer would be for US states to adopt the parliamentary system? Although there is some debate about what the "republican form of government" clause means, it arguably doesn't rule out parliamentary republicanism, and Luther v Borden (1849) ruled the clause wasn't justiciable anyway. Added to that, the widespread practice in first half of the 19th century, in which governors were elected by state legislatures, was de facto the parliamentary system. I don't think there is any federal constitutional obstacle to trying this – it is just a political culture issue, it currently sits outside the state constitutional Overton window.
While you could adopt the Australia/Canada model of a figurehead state governor/lieutenant governor with a state premier, I think just having a premier but calling them "the governor" would be more feasible
Maybe. Maybe not. I don’t think it would change outcomes as much as people would think, but to scope limit this back to California again because electoral law discussions just fucking spiral anytime there’s no geographic constraint, the root of California’s lawmaking problems is that the legislature is both poorly structured and poorly balanced against the direct democratic approach we have taken for so much of our lawmaking. I don’t think that’s inherent to the non-parliamentary system we have in place, but a result of incremental rule changes stemming from decades of ballot propositions that are supposed to solve a problem, but don’t and tend to have negative knock-on effects that fly under the radar.
Or put another way: the legislature is for legislating. It doesn’t need a competing power structure, and it doesn’t need to be balanced by anything other than a good functional Executive power and a good functional independent Judiciary. If you have that as your starting point, then maybe there’s room to discuss if there are any real advantages of a Parliamentary system instead.
Presidential systems have had a terrible run if you look at Latin America. The US seemed to be an exception to the rule, but maybe recent events have shown that the US got away with a substandard political system for so long because they had so many other advantages to make up for that, now their other advantages are weakening and the US is slowly converging with Latin America
If California moves to a Parliamentary system but maintains the popular ballot initiative that has undermined legislative power and allowed legislators to disclaim & dodge responsibility, or maintain the system of term limits I originally called out, then it doesn’t matter whether it’s our current bicameral legislature plus 5 Constitutional officers in the Executive branch or a full on Westminster Parliamentary system or anything in-between: you’ll still run into a lot of the same issues because there are no silver bullets.
So I’m not saying it should never be up for consideration, but as a list of changes to make go? It’s too far down the list of serious considerations for me to view it as anything other than noise right now.
At least something like "adopt the Australia/Canada model" is easier for people to understand, because while a radical change, they can point to somewhere else that has been doing it successfully for decades. Incremental tinkering with the current rules can make unengaged people mentally switch off by comparison; radical changes can be easier to understand because they can be simpler to explain.
I think one problem with the Australia/Canada model, is even though constitutional monarchy isn't essential to it – both countries could arguably function just as well if they were federal parliamentary republics – many Americans mentally conflate the parliamentary and constitutional monarchy aspects. If eventually either or both countries became republics, that would probably make it easier to sell the idea to Americans.
Germany is a living example of a federal parliamentary republic – but the language barrier limits its accessibility as a model for Anglophone emulation.
One backdoor way it might happen – although no doubt quite unlikely – would be if Alberta seceded from Canada, got admitted as a US state, but kept something close to its current parliamentary system.
Flipping the table because it’s dramatic is not my first choice.
While you are correct with this statement in this context, I would say it applies to most things in government in general.
The vast majority of lawmakers have zero experience solving any real world problems and are content spending everyone else's money to play pretend at doing so.
The reality is, most government "solutions" cause more problems than they solve, after which, they blame their predecessors for all the problems they caused and the cycle continues.
Zero basis in fact. We’re in the wealthiest nation on the planet. Most of us live better than any previous generation. To claim all that success is completely in spite of government is ridiculous.
Who do you think printed it. Who signed the bill?
The US can just print money and receive goods in exchange of literal paper. Or just put an extra zero in a bank account and receive goods in exchange.
And if a certain yahoo decides they want in the money printing scheme...who do you think is going to send the goons with guns to prevent the government monopoly in creating literal wealth.
U. S. by far the largest current-account deficit (over $1.2 trillion).
U.S. has the largest goods trade deficit (over $1 trillion).
Things work here and nobody seems to be passing the "oops my unintended side effects and clueless regulations messed things up horribly." Or, if they do, it is at something like 1/10th the level.
We didn't start warning label spam everywhere. We don't have weird propositions that are causing run-away housing prices. There aren't bar codes on our 3d printers, or cookie banner requirements on every website. Well, ok we do, but that nonsense all came in from other places.
We did pass laws to lower PFAS/PFOAS. That seems reasonable. Government can work.
Most of those are a reaction rather than the cause. People want to move to california, it creates a different set of problems for california vs Massachusetts
The sheer size, economic volume and cultural diversity of CA presents a pretty unique set of issues.
I wish I was joking. They get audited yet? Pretty sure that was a ballot measure that passed by a huge margin years back and last I checked they were stalling...
The "reality" is that propaganda heavily encourages you to ignore the government successes and only focus on the failures. I'll leave it as an exercise for the reader to determine who benefits from that.
Please, name for me one product or service that the US government has created, that people willingly buy, that has made your life tangibly better.
I can list a billion made by businesses.
Please, go for it. Just one.
Medicaid
The National Park System
I know that the next step is you explaining why these don’t count, or saying “wow only 3” or whatever, but
Oh, there's more: Medicare, Social Security, the highway system.
The whole food/medicine regulatory system is also a big one, and it's the reason a lot of US (and European) products like baby formula are imported into China, because they can be more trusted.
My bet is the GP's going to weasel out using his "that people willingly buy" language. The flawed assumption there is the government should be conceptualized as just another company selling in the market, when the government's actual role is very different.
Airlines are a great example of this. They have changed very little in the last 30 years (again, thanks to all the government regulation and red tape).
Smartphones, TVs, (and literally anything else not in the hands of the government) has also seen rapid improvements.
Anything the government handles is always rife with overspending, inefficiency, and corruption.
A company must maintain profitability to stay alive.
The government on the other hand, is $38 TRILLION dollars in the red.
Yes, the things that "people willingly buy" are the literal engine that makes all of this possible. It is not the reverse.
> A company must maintain profitability to stay alive.
Yeah. And once it becomes a monopoly (like Comcast), it can just keep raising prices.
I "owe" Comcast $200. They say I didn't cancel at an old apartment. I say I did. I have the email. They insist. They've sent me a letter once a year for a decade. About 2yr in it went to collections. They're still trying.
Imagine the consequences if I did that with government.
Say nothing of the fact that if I tried to pay it, Comcast would be able to take my money no problem. The government would take a check, ACH or charge me $5 to use a buggy 3rd party CC processing service.
I've had the irs write me a letter saying I owed them money. They were correct and I paid them in a couple of months. It wasn't very hard.
I don't enjoy paying taxes but I do very much enjoy the things they buy.
And their websites are well-designed and functional. There are customer support emails and phone numbers.
> Say nothing of the fact that if I tried to pay it, Comcast would be able to take my money no problem.
About that... A couple of years ago I got locked out of AT&T because I forgot to update my credit card. And I couldn't log in because it required a (you guessed it) one-time SMS password. Their "pay your bill" needed a bill number, for which I needed to log into their website.
Their fix? Visit the store.
> Imagine the consequences if I did that with government.
A couple of years ago I accidentally overpaid the IRS (I paid the capital gains tax twice, as it was already deducted during the sale by the broker) to the tune of $10k. A year later, they sent a letter asking me for clarifications. I called them, and they sent me a refund check.
> The government would take a check, ACH or charge me $5 to use a buggy 3rd party CC processing service.
And what's wrong with a check or ACH?
Listen, I'm sure if all you do is straight down the middle of whatever the DMV thinks a median peasant does, then I'm sure it works fine.
But on that same note, if all you do is sign up and then just keep paying them money forever, Comcast works fine too.
Neither of these organizations works worth a shit outside the default path. But only one of them will threaten to really screw up your life over it.
Where I live now, I paid $50k to get a private fiber optics line just not to deal with Comcast anymore. There were no other options. We _might_ get AT&T fiber, eventually.
But today there are other options. Starlink, for one.
But it was not profitable for them to expand normally. They can't offer drastically cheaper service than Comcast, the installation costs in cities are huge. I also have Starlink as a backup, and it's even slower than Comcast.
So yeah, government actually works better than commercial companies for most infrastructural needs. And in particular, municipal broadband is usually head-and-shoulders better than anything from large commercial companies. It has higher consumer satisfaction ratings and is cheaper on average.
> Anything the government handles is always rife with overspending, inefficiency, and corruption.
Boy will you be surprised when you get a job.
> Airlines are a great example of this. They have changed very little in the last 30 years (again, thanks to all the government regulation and red tape).
And thanks to regulations, we have less airline accidents than ever. Private companies are more than willing to "externalise" any accidents from cutting costs otherwise.
> Smartphones, TVs, (and literally anything else not in the hands of the government) has also seen rapid improvements.
So does government funded medical research, which improves the quality of life of people corporations deem "unprofitable".
> Anything the government handles is always rife with overspending, inefficiency, and corruption.
Because large corporations and rich donors lobby them to do so.
> A company must maintain profitability to stay alive.
So does a government, debt only lasts as long as the lender believes in your ability to pay it back.
> The government on the other hand, is $38 TRILLION dollars in the red.
And which of the Mag7 are not in debt? I remind you that if you wish to compare the USA to companies, they are literally an entity of over 300,000 people. No company employs that many people.
> Yes, the things that "people willingly buy" are the literal engine that makes all of this possible. It is not the reverse.
No, government enforced order is what allowed the engine to exist to begin with. No one would innovate if their IP could not be protected, and we would regress back into cartels if the government could not enforce private property.
The prosperity of the modern world is build upon a foundation of solid governance.
When I ship packages, I could choose to use a service other than USPS, but I don’t, because USPS is generally cheaper and more reliable.
I strongly prefer Medicaid to my employer-provided healthcare plans because of ease of use, and if I were allowed to I would willingly pay more money into it, either via taxes or direct premium payments, when I am making too much income to qualify.
I gladly give money to the NPS every year, even though I have a choice to pay for a private campground, or other public lands agencies.
I answered the question. You can choose to believe I didn’t all you want.
Well, they aren't willingly buying it. They are funded with taxes.
That's because the question is bad. It was meant to challenge the benefit of government, and a non-answer was meant to be interpreted as "government < business." But at its core is was fundamental misunderstanding of government, so if the question was answered mindlessly, it was unfairly biased towards the asker's biased conclusion.
> and to refuse them is not "weaseling out".
It'd be weaseling out of the faults of the question.
Medicaid - funded by the government, meaning people are not willingly paying for it
The National Park System - funded by the government, meaning people are not willingly paying for it
Medicaid is hardly a competitive market, but medication pricing alone says it is a failure. On Medicaid, my FIL can’t get his prescription for G7s filled by anyone.
https://www.energy.gov/hgeo/articles/does-early-investment-s... https://en.wikipedia.org/wiki/Fracking_in_the_United_States https://clearpath.org/tech-101/hydraulic-fracturing-a-public...
Human genome - J. Venter was the first to sequence the human genome, privately funded.
the entire space industry - Liquid fuel rockets were pioneered by Goddard, through private funding.
Radar - originated from late 19th-century experiments on radio wave reflection, pioneered by Heinrich Hertz in 1886. While Christian Hülsmeyer patented a "telemobiloscope" for ship detection in 1904
The proto-Internet - Pioneered by Samuel Morse, see "The Victorian Internet" by Tom Standage. Privately funded.
Optical data storage - Invented by D Gregg, https://en.wikipedia.org/wiki/David_Paul_Gregg, at a private company.
Nuclear energy - a very long list of contributors. See "The Making of the Atomic Bomb".
And so on.
Quite a stretch to say the Atomic Bomb was privately funded!!!
The original Whittle engine was developed with private funds.
From "The Development Of Jet And Turbine Aero Engines" by Gunston:
pg 123: of which £200 came from an old lady who ran a corner shop near Whittle's parents in Coventry
pg 123: But a direct request to Air Ministry for a research contract in October 1936 brought flat rejection,
pg 124: Whittle could see that the only possible way to proceed was to take the gigantic gamble of running a complete engine.
pg 125: Indeed, there was little money for anything. While the RAF backed Whittle in every way they could - for example, by not requiring him to take the usual examination for promotion to Squadron Leader - the Air Ministry contributed nothing to Power Jets until May 1938, and Whittle had to watch every penny. He nearly cracked under the strain, which in fact was to get worse for seven years, not because of the Problems in developing the engine, but from the suspicion and enmity with which he was regarded by officials and manufacturers, and by the outrageous behaviour of the Company picked by the Air Ministry to produce his engine.
(Whittle's engine first ran in 1937).
It isn't possible to untangle its development and claim one or the other.
Sure, some companies participated in the process. But it was a government that did it.
It's been more than 50 years and private companies haven't been able to match it.
The greatest technical achievement of mankind was done by a government. Private industry could, at best, help.
Sorry all the other things you name are great. But the winner is government.
And it is particularly ironic to select that since the government’s attempt to return is the most expensive, slowest, least tested launch system possible, and still needs help to get to the Moon.
Technology has never been tge limiting factor. Politicak will is.
If California starts knocking on the door of random distros and hobby OSes designed for power users or servers with 2000 average monthly downloads then I'll go to bat defending them.
Though to re-iterate, I'm pretty sure the requirements here are for asking a user to set an age, not to do age verification, so if you did want to comply it would mean adding a Date field to your setup flow and then wiring that up to applications that ask for it.
it is because any government regulation over user identifiers in an operating system (and left to grow and fester according to political wont) will chill free speech (code, data) and assembly (the ability to share code and data with others unsupervised).
Simply stating something you apparently see as self-evidently true in the abstract doesn't really make much of a point. Especially when said something is unironically just "but the slippery slope!"
age is an identifier as part of a ‘digital fingerprint’. a fingerprint is used to track you. your fingerprints are attached to the things you criticize online. you must temper your criticisms. end of story.
your ‘o noes another slippery slope arg’ falls flat on its ass when you look outside at what your government is patently and evidently doing. you paying any attention to the anthropic ‘mass surveillance’ canary? how about the ice app? threats to legally prosecute protesters of ice? no? god, you really need to be led to water huh.
maybe look up how the persona company aggregates data for the government and get back to me as to whether you think that has a chilling effect on speech and assembly (when droves of people are leaving discord)
ah maybe too “abstract” for you. How about this:
a/s/l? :3 don’t worry, im just a dev, i won’t bite. unless of course, you disagree with me o3o
> (3) (A) Except as provided in subparagraph (B), a developer shall treat a signal received pursuant to this title as the primary indicator of a user’s age range for purposes of determining the user’s age.
> (B) If a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant to this title, the developer shall use that information as the primary indicator of the user’s age.
Developers are still liable if they have reason to believe someone is underage, even if the age signal says otherwise.
The only way to truly minimize that liability is forcing users to scan their faces and IDs, that is why age verification systems are already implemented that way.
eg: you let your child use your laptop for a bit to play Roblox. The child logs into the Roblox account which has their real age. As per the law Roblox is required to use their inner age signal instead of the OS provided one.
I suppose it could also go the opposite way: if your steam account is 18 years old by itself then probably we can treat you like a grown up and ignore the OS provided signal.
I guess the latter form would be quite rare for anyone to implement.
All this does is require the user to select a non-verified age bracket on first boot. You can lie, just like porn sites today. I thought HNers wanted parents to govern their children's use of technology with these kinds of mechanisms.
> There's an obvious theme with lawmakers in California—they pass laws to regulate things they have zero clue about, add them to their achievement page, cheer for themselves, and declare, "There! I've made the world a better place."
There's an obvious theme with HN posters about politics—they make cheap drive-by comments about regulations they have zero clue about, based on articles they haven't actually read, cheer for themselves, and declare, "There! I've shown why I'm smarter than all these politics people."
This is the age verification requirement which you rudely and incorrectly said doesn't exist. Nothing is done with the data (for now) but age is in fact verified on the assumption that the user doesn't lie.
Instead of lengthy condescending missives about the behavior of other users, you should instead write "I'm sorry for being negative and bringing down the quality of discussion."
The original post was low effort flame baiting. There's an argument to be made that it should be ignored, but it's hard to say.
No. The OS does literally nothing with the age information other than water it down to a few pre-defined age brackets and pass that on to applications. There's nothing in this law that says any action has to be denied. It's information collection and reporting, with no verification, accepting the information reported by the user as-is. The law does not require the information to be true or accurate, and explicitly removes liability from app developers when their users lie about their age.
Even applications don't need to do anything with the age information, unless there's a different law already on the books saying something needs to be age-restricted. And in those cases, getting the information about whether to apply restrictions from the OS instead of however they're currently getting age information is not "verification".
"Verification" necessarily implies at least two pieces of information or steps in the process: first, an assertion of something as fact, then something to confirm that fact. This law omits the second step. There's no confirmation.
Just delete your account.
When the law and it's execution are undermined and weak, it becomes the cudgel of fickle changing power, i.e. it is applied selectively and it means nothing to people except when they are being beat in the head with it, at which point they only regret having been caught, successfully undermining the social and political fabric of a nation.
Having a bad law with a weak enforcement mechanism isn't quite the thing to be boasting about you seem to think it is.
> 3D printers should have a magical algorithm to recognize all gun parts in their tiny embedded systems
Color scanners and printers have long had algorithms to recognize currency and prevent its reproduction, implemented with the technology of decades ago. It seems relatively simple to implement gun part recognition today, especially with the recent leap in image recognition capability.
(Rants and takedowns, IME, may entertain fellow believers, but signal a comment that's going to go well beyond any facts.)
With 3d shapes of non-governmental origin this is at best difficult and at worst intractable. Consider the fact that many parts of a gun can be split into multiple printable pieces to be later assembled, making it very nontrivial to decipher the role of the shape.
With currency, the government has the controls for the supply of the target shape (it can encode hidden signals onto banknotes) and effectively controls the relroduction side (through the pressure on printer manufacturers). But it cannot control the supply of gun-part-shapes (it is not the only source for it), and since the problem is likely intractable - neither can it enforce the control on the 3d printing side.
Paper money being almost non-fungible is a great achievement, but is it as easy to make any mesh nonfungible as well?
> Paper money being almost non-fungible is a great achievement
Going off on a tangent: Many people in technology and in the public look at cash as backward, boring, even socially embarassing technology. I think few it's amazing technology, an incredible hack: tech we struggle to implement in computers is implemented highly successfully and reliably in a piece of paper.
Not doing anything and preserving maximum agency is an entirely valid choice.
And it's sits fine with you because you are the one who wouldn't pay the price for this "simple image recognition capability". Except you would pay of course, indirectly but at least you wouldn't know for sure so your conscience would feel at ease.
come to think of it, maybe there is something good about this law. :D
Not to mention all the printers, routers, etc that run freertos/thread x/vxworks.
What it takes to become a “successful” politician is typically not what it takes to define good policy.
Eh, sounds kinda reasonable. Ammo already has unique serial numbers embedded in the butt of every cartridge (in some countries, not sure about the US), and guns do leave somewhat unique marks on the bullets upon firing so... sure, why not. Surprised it took that long TBF, the necessary technology has been commercially available since the early 90s, I think?
> 3D printers should have a magical algorithm to recognize all gun parts in their tiny embedded systems
Yeah, this one's seems unnecessary. Is weapon manufacturing without a license a crime? If yes, then whoever 3D-prints a gun can be prosecuted normally.
> Now, you need to verify your age... on your microwave?
Or on your gas stove. A travesty, really: I was taught how to operate a stove when I was in the second grade and never burned any houses down, thank you very much.
Even people who didn’t want to break the law might find themselves on the receiving end of law-enforcement if the firing pin wears such that the micro stamping is no longer identifiable.
The micro stamping law does nothing to prevent the flow of guns to people who should not have them, and does everything to prevent the use or purchase of guns by people who can lawfully own them - which is the whole point of a law like this. The people who make these laws are well aware of this.
The age verification law, coupled with the proposed hardware attestation that our good friend Lennart poettering is working on will ensure that anonymity on the Internet is gone. This is precisely what lawmakers are aiming for. And just like the micro stamping law, the intent of the law is not the literal word of the law.
I'm curious, so if (when?) California ends up successfully hunting down some criminals with this, what is your new position going to be? They were going to get caught anyway, or something like that?
Legitimate gun users will, at best, use their weapon in self defense, in which case they'll be sitting there waiting when the police arrive, so no need for microstamping.
The "crime of passion" so popular in TV shows are few and far between, and there's usually a huge amount of other evidence.
If it were possible to do, it'd help.
Also, removing the marking mechanism would be a process crime. Process crimes are very useful for catching criminals.
Are you against serial numbers on guns too? You can always file those down.
I don't know much about guns, but I assume that would be on the hammer? Couldn't you remove that "microstamping" by lightly filing down the hammer or just using it a bunch and causing some wear?
I think they've learned from the anti-gun lobbyists and are now pushing to end anonymity on the internet the same way.
Children Now (co-sponsor). International Centre for Missing & Exploited Children (co-sponsor). AAPI Equity Alliance. California Parents for Public Virtual Education. Parents Support for Online Learning. Protect Our Kids.
There is a layer of indirection at work here. Fake-democracy.
What's even more curious is that the California voters seem not care at all. As long as the government can collect more taxes with more altruistic slogans, the voters will stay happy.
Some people think all problems should be fixed with regulation.
Some people think all problems should be fixed with free market / responsibility.
California and liberals tend to lean to the former. A place like Texas and conservatives tend to lean to the latter.
I think both camps are crazy because it’s a case-by-case basis where you need to consider second and third order effects. But man talk to a die hard regulation supporter or die hard free market supporter and you just want to say “the world isn’t just simple rules like that.”
He may be our next president and this becomes an executive order.
People who dont understand the problem must pass a solution that makes people feel good. Clean needles, homeless hotels, etc. If they dont make things worse, that is a win.
What part of the bill makes you think this would apply to a microwave? https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
And what part makes you think you need to verify your age, as opposed to just specifying it? Nobody is requiring any verification. The only requirement is on there being an interface for you to input whatever age you want to input.
A Spanish venture-backed firm is developing some vaporware called Print&Go and has convinced the NY DA's office that it'll permanently solve the Luigi problem.
The best part? This company is drooling at the possibility of getting a permanent rent-seeking license for printers they didn't design, for nonexistent vaporware software that reduces its capabilities.
They frame it as "enhancing 3D printer capabilities," the way a slaveowner would frame putting chains on a slave's wrists as an "employee retention innovation."
Is everyone involved with promoting this software and these laws lying? Of course.
https://blog.adafruit.com/2026/02/08/any-user-who-has-a-3d-p...
Someone has fallen victim to Politician's Logic: https://www.youtube.com/watch?v=vidzkYnaf6Y
The "why" is also clear: deflecting/shifting responsibility.
The goal in my mind is to have an account a parent can setup for their child. This account is set up by an account with more permissions access. Then the app store depends on that OS level feature to tell what apps are can be offered to the account.
Let say the the age questions happen when you install the app store. That means if you can install the app store while logged in as the child account the child can answer whatever they want and get access to apps out side of their age range. The law could require the app to be installable and configurable from a different account then given access or installed on the child account, however at a glance that seem a larger hurdle than an os/account level parental control features.
The headline calls this age verification, but the quote in the article "(2) Provide a developer who...years of age." Make it sound way different and much more reasonable than what discord is doing.
I would much rather have OSs be mandated with parental control features than what discord is currently doing. I am going to read the bill later but here is how discord age verification could work under this law.
During account creation discord access a browser level api and verifies it server side. discord no knows if the OS account is label as for someone under 13 years, over 13 and under 16, over 16 and under 18, or over 18. Then sets their discord account with the appropriate access.
No face scan, no third party, and no government ID required.
That sounds like an OS feature that parents would like to have. Probably has some market value. Maybe just let the market figure that one out.
Or, we could have an overbroad law passed that torpedoes every open-source OS in existence. If I were MS, Google, or Apple, that'd be a great side benefit of this law. Heck, they probably already have this functionality in place.
The problem here is legally-mandated age verification, not where it is placed (although forcing it into all OSes is absolutely ...). The gains are minimal for children and the losses are gigantic for children and adults. I'm not keen to have children avoid blisters by cutting off their feet.
Put control back with the parents. Let them buy tech that restricts their children's access. This law doesn't protect children from the mountains of damaging content online.
And let all the adults run Linux if they want to without requiring Torvalds to put some kind of age question in the kernel and needing `ls` to check it every single run.
If there was a competitive market for OSs this probably would work, but we do not really have that. Getting the market to be competitive likely either takes considerable time, or other forms of government intervention. If there really was a competitive market then this would have been a solved problem ~15-20 years ago since parents have been complaining about this for ~25-30 years at this point.
> Or, we could have an overbroad law passed that torpedoes every open-source OS in existence. If I were MS, Google, or Apple, that'd be a great side benefit of this law. Heck, they probably already have this functionality in place.
I do not think the law does that. Either a additional feature making age/birth date entry and age bracket query available, or indicated the os is not intended for use in California, both seem to let developers continue along like normal. edit Or, I think, indicate that it is not for use by children.
> The problem here is legally-mandated age verification, not where it is placed (although forcing it into all OSes is absolutely ...). The gains are minimal for children and the losses are gigantic for children and adults. I'm not keen to have children avoid blisters by cutting off their feet.
In this case the mandate is entering an age/birth date at account creation where you can lie about said age/birth date. The benefit is the ability of an adult to set up parental controls for a child account.
> Put control back with the parents. Let them buy tech that restricts their children's access. This law doesn't protect children from the mountains of damaging content online.
This puts control in the parents hands. When they set up their child's account they can put in their child's age, or not, they can make it an adult account.
> And let all the adults run Linux if they want to without requiring Torvalds to put some kind of age question in the kernel and needing `ls` to check it every single run.
So from the literal reading of the law the age checks are only required when "a child that is the primary user of the device". It does not need to effect accounts where the primary user is not a child. Nor does it seem like any application needs to run the check every time the application is launched.
The law unfortunately does require:
> (b) (1) A developer shall request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.
So in the case where a child is the primary account/device user. The app needs to request the signal at least once when first launched, though it is not required to do anything with it. Delegating that to the package manager would make sense, but this part of the law should be modified, apps that can not use the signal for anything should not be required to request it, 'ls' for example.
It's just asking for some OS feature to report age. There's no verification during account setup. The app store or whatever will be doing verification by asking the OS. Still dumb to write this into law, but maybe not a bad way to handle the whole age verification panic we're going through.
Well, the politicians probably meant to say “Apple, Google, Microsoft, plus maybe Sony and Nintendo”
i.e. the companies that already have biometrics, nigh-mandatory user accounts, app stores linked to real identities, parental controls, locked down attested kernels, and so on.
If phones had workable parental controls that let parents opt their kid into censorship, that’s better than the give-your-passport-to-the-porn-site approach the UK have taken.
Of course if they have applied it to every OS, not just the big corporate-controlled options, that’s a dumb choice.
I guess we'll just have to trust that our legislators are technologically savvy...
Look at the thread on Block’s layoffs while they are profitable.
What I did say was:
>if there has to be age verification
That is far, far different than saying I want that shit. I do not make the laws, and I wouldn't vote for it either, so please, get your head out of your ass.
I'm not the one making laws about age verification, so I'm not sure how you get off blaming me for anything.
Like, I’m not American and in Germany we have ID cards that actually have your age encoded on an NFC chip in the card and an ID number that encodes the age. Like, age is part of the ID number and checksum.
You could totally do all of this age verification offline on device and just expose an API that offers the age of the user to applications. You’d never need to talk to the internet for this, the API just says if you are a minor or adult, the browser can pass that to websites who don’t need to collect personal data and everything is fine.
But that’s not going to happen. It’s gonna be some AI facial recognition kinda garbage that is gonna send your face in every angle to Apple or Microsoft or another third party.
As is common these days they are going to try really hard to absolve you as the user of any responsibility for the sake of protecting kids so they can’t let this be a simple offline thing where your personal information never ever have to leave the device because what if kids find a way around it? Well the obvious answer is don’t let your kids just use a computer without supervision but if people would do that we’d not be in need of this garbage anyway.
have you literally ever met a kid?
It doesn't. The device (not the "OS") is registered with government authorities. The device is associated with a single human for the purposes of age verification. And it's a one time action at the time of association.
> Android
> iOS
> MŚ Windows
:)
There is no reason to tell the application, and by extension their developers, how old the user is. The application should tell the user what bracket it is appropriate for and then the operating system could filter appropriately without any of the user’s identifying information leaving their system.
This is also technically superior because it moves the logic for filtering out of being custom implemented by each and every single application to a central common user-controlled location; you do not have to rely on every application developer doing it right simultaneously.
And your point about fail open versus closed also makes no sense since if there are zero repercussions to not writing filtering logic then nobody would even bother. If there is liability, then obviously everybody will fail closed and every application developer needs to evaluate and change their application to only allow acceptable usage. This is much harder if they have to write custom filtering logic instead of just publishing their data categorization.
How does this work with applications that have a wide array of content of varying appropriateness, for example web browsers? The obvious thing to do is for sites to self-report for 18+ content and have the browser query the OS using this newly mandated API and refuse to download/show the associated content. You really need both sides here for this to work well.
I do wonder who benefits from all the propaganda causing this kind of kneejerk reaction though.
Age verification is the quickest road to ending general-purpose computing, because it plays on people's knee-jerk emotions. It won't do it by itself, but it'll goes a long way towards it.
There are essentially two desktop operating systems, Windows and macOS. Linux is a decimal point and too fractured to worry about.
There are essentially two mobile operating systems, Android and iOS. And while Android is fractured, Google still has reasonable control they can exert.
This is (weirdly) the smart way to do this type of law.
Make the consumer OS providers add an age signal. That property can be bound to an account with the inability to change it.
Behold, "universal enough" parental controls which will require only a handful of lawsuits to litigate.
What I don't get is why it can't just all be client side. An app will just signal "I am going to show 16+ information" and the OS will either show it or not show it. No need to communicate anything.
Giving people the choice to limit a device for their children is okay by me.
Reaction 2: it's open source, make the lawmakers do submit the changes.
Reaction 3: how would this ever be enforced? Would they outlaw downloading distributions, or even older versions of distributions? When there's no exchange of money, a law like this is seems like it would be suppression of free speech.
Reaction 4: Someone needs to maliciously comply, in advance, on all California government systems. Shutdown the phones, the Wi-Fi, the building access systems, their Web servers, data centers, alarm systems, payroll, stop lights, everything running any operating system. Get everyone to do it on the same day as an OS boycott. And don't turn things back on until the law is repealed.
I doubt the california legislature knows what a Linux even is.
they would never need to know it once they learn what SecureBoot is. Any device with 1+ Gflop must have SecureBoot, and goodbye general computing.
All Congress critters have staff to help write the bills and fill out the policy. You can bet your sweet bippy that there are people on staff in the California legislature who know what a Linux even is.
All three already have identity linked accounts. Windows practically shoves it down your throat on install, for example. They'll love the excuse to finally disallow web-free accounts.
Windows servers are so back baby!
It defines operating system in the law. This wouldn’t apply to embedded systems and WiFi routers and traffic lights and all those things. It applies to operating systems that work with associated app stores on general purpose computers or mobile phones or game consoles. That’s it.
Enforcement applies as civil fines per-child usage. So no suppression of speech by banning distribution.
(Also it’s not age verification really, it’s just a prompt that asks for your age to share as a system API for apps from above app store, no verification required)
> “User” means a child that is the primary user of the device.
It’s definitely more vague that necessary, but I’d imagine courts would readily find automated software deployment by an adult or corporation does not constitute a child using the device. Especially if done for servers or a fleet. Because then it’s pretty obvious that a child is not the primary user of the computer nor the software. Even if that software is a server that involves childish activities (eg game servers).
But I’d imagine that Linux package managers associated with a desktop operating system provider would fall under this law. And that raises questions about the software distributed by said package managers.
What’s going to happen when there’s no UI, just a shell, and they pacman -S <mything>? This law is unconstitutional based on criteria of vagueness. If they want it to stick, they need to call out the commercial app stores of Microsoft, Apple, Google, etc where a credit card is attached. Otherwise it’s too vague a term unless they define “store”.
If the distros ship this mechanisms enabled in their binaires, but the users install circumvention tools (e.g. a package manager without checking mechanisms) from a thurd party, the distro provider should be off the hook.
Android has associated app stores, therefore Linux must follow this at account setup ..
(I'm mostly hoping I'm just jesting here, that they'd surely not enforce it in this way, plus, who "provides" my Linux OS?)
In any event, it does seem like a very silly overreaching law, that should be highlighted, pointed out, and laughed at.
PS I have not read the law in question. I have read a PC Gamer article though, which is surely much the same.
Do you remember this copypasta?
I'm not sure that ART/Linux is any more catchy than GNU/Linux, but just as GNU wasn't the OS, neither is ART.
Don't get me wrong, these are all very silly pedantic arguments in the face of such a law.
Not yet, but it will be one day if it passes
If the First Amendement is to prevent a government from letting you speak, shouldn’t that also concert a government from letting you hear that speech?
If so, then this seems to go against the Forst Amendment.
Sorry, Australian here so just speculating
So, all of us-west-1?
Everything is a general purpose computer. Just look at how many things have been made to run doom. I haven't read the law specifically but if it actually does say this then that language is useless and means practically everything.
Frotz and Zork/Tristam Island and tons of Z3 machine games cna run on a pen, on a FPGA based display and even under a PostScript file where the interpreter was done in PostScript. Heck, with Subleq and EForth some Z3 interpreter can be coded to run the games on simple hardware made with high school/advanced trade electronics kits.
If people with power over you want to "selectively punish you" they don't need new laws.
And if you want perfectly proscriptive, defined laws in all situations with no "human interpretation" you're in the wrong universe, and may as well be shouting at clouds. The world, and especially human society and interactions, just doesn't follow strict definitions like that.
There are degrees of vagueness, but laws generally attempt to avoid being vague with many definitions and strict construction. If a law is sufficiently vague it may be invalidated, or it is at least required to be interpreted to the benefit of the defendant under lenity.
Make it unambiguous that 100% of people are criminals, and all you have to do is control the prosecutor’s office.
This law seems to be in that category.
Laws are interpreted by people trained to fill in the blanks[1] with a best guess of the legislative body's intent. And the intent here seems pretty clear: to regulate computing devices that let end users easily install software from a centralized catalog.
[1] which we all do subconsciously in day-to-day speech, because all language is ultimately subjective
I guess Linux native games on GoG might be covered. All windows and wsl programs run in userspace compat layers. iOS might be covered. Snap, probably not (containers), AppImage? Maybe?
Nix, and brew? Probably not.
Seems to me this would include TVs, cars, smart devices, etc. The Colorado version of this bill excludes devices used for physical purchase, so your gas pumps and POS systems would be excluded in CO. But I didn’t see that in the CA bill.
They’re both overly broad, ill-considered, frankly terrible bills that make as much sense as putting your birthday into a brewery site or Steam. Enter your birthday and we trust you. Now do that for every single one of those 100 VMs you just deployed…
No, it doesn't.
It defines the following terms: "account holder", "age bracket data", "application", "child", "covered application store", "developer", "operating system provider", "signal", and "user".
> This wouldn’t apply to embedded systems and WiFi routers and traffic lights and all those things. It applies to operating systems that work with associated app stores on general purpose computers or mobile phones or game consoles.
Presumably, this based on reading the language that in the definition of "operating system developer", and then for some reason adding in "game consoles" (the actual language in both of those includes "a computer, mobile device, or any other general purpose computing [device".
(I've also rarely seen such a poorly-crafted set of definitions; the definitions in the law are in several places logically inconsistent with the provisions in which they are applied, and in other places circular on their own or by way of mutual reference to other terms defined in the law, such that you cannot actually identify what the definitions include without first starting with knowledge of what they include.)
Do you really think a pool of 12 people off the street is going to consider an embedded system, wi-fi router, or traffic light as an "operating system" under this law? Particularly since they don't even have accounts or users as a common-sense member of the public would understand them?
The hope is that twelve of your peers will at least avoid being able to persecute you for political goals. I hope neither of us ever has to find out.
> Particularly since they don't even have accounts or users as a common-sense member of the public would understand them?
Not sure what having accounts or users “as a common sense member if the public would understand them” is relevant to since, to the extent having a “user” is relevant in the law, it to is defined (albeit both counterintuitively and circularly) in the law, and having an “account” isn’t relevant to the law at all.
To dumb down "operating system" for normies, they're probably going to say something along the lines of "the software that makes your computer work.. like Windows." If it stays at that level, we'll have a specific, discrete definition in play.
A broader, equally correct definition could be "the software that makes technology work.. there's an operating system on your computer, your cell phone, your Alexa, and even your car." Then yes, some people will think of their Ring doorbell, the cash register at the coffee shop, and other embedded systems, even if they've never heard the word "embedded."
The definition that shows up will depend entirely on a) the context of the case and b) the savviness of the attorneys involved.
Not a bet I want to take.
At that point, what the law actually says matters a lot (unless the judge is corrupt, which is becoming more common in the US, but with corrupt judges, it doesn’t really matter how good or bad the laws is).
> "Covered application store” does not mean an online service or platform that distributes extensions, plug-ins, add-ons, or other software applications that run exclusively within a separate host application
There is a reasonable argument that a linux distribution is, itself, a host application. This is clearly an argument against their intention... but makes perfect sense to me. With this argument, the law does not apply to pretty much any environment where the applications are scheduled and run by a supervising process, at least by my reading.
So I guess that excludes all windows apps and app stores.
It's not enough to adhere to the age signal:
> (3) (A) Except as provided in subparagraph (B), a developer shall treat a signal received pursuant to this title as the primary indicator of a user’s age range for purposes of determining the user’s age.
> (B) If a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant to this title, the developer shall use that information as the primary indicator of the user’s age.
Developers are still burdened with additional liability if they have reason to believe users are underage, even if their age flag says otherwise.
The only way to mitigate this liability is to confirm your users are of age with facial and ID scans, that is why age verification systems are implemented that way: doing so minimizes liability for developers/providers and it's cheap.
This is true, but
> The only way to mitigate this liability is to confirm your users are of age with facial and ID scans,
This doesn’t follow. It says “if” the developer has clear reason, it doesn’t obligate the developer to collect additional information or build a profile.
I read this as - if you in the course of business come across evidence a user is under age, you can’t ignore it. For example - “you have to ban a user if they post comments saying they are actually underage”
As a developer, that is not the kind of liability I want to take on when I can just plug ID.me, or whatever, into my app and not worry if someone writes "im 12 lol" in a comment on my platform.
Internally from the perspective of the developer implies: on the platform in question.
Most parents lack the technical expertise to police digital devices.
Well said. Parental controls are really nothing more than parents are root and kids are mere users. We shouldn't let the state or corporations be the parents, nor is it necessary.
Age verification by governments or corporations isn't a substitute for parenting. And with parenting age verification by governments or corporations isn't necessary.
They're doing this for some other reason than protecting kids, as usual.
Doesn't the bill explain all this pretty clearly? https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
>> An operating system provider shall [...] provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user [...]
>> “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.
Your hypothetical "embedded system" almost certainly neither has an account setup process in the first place, nor is it a general-purpose computing device, a mobile phone, or a computer.
> Reaction 3: how would this ever be enforced?
Pretty easily? They enforce it against the OS vendor for not providing such a process. They aren't enforcing the correctness of the age, nor are they claiming to.
> Someone needs to maliciously comply, in advance, on all California government systems.
...what? This is a law demanding compliance from OS vendors. Whose compliance is it even demanding in government systems for them to be malicious about it?
This term doesn't seem defined in the law at all. How general is general?
Graphing calculators that support apps and Python? Of course, they don't usually have "accounts" either. But to a technologist it's a "general purpose computer" insofar as it can run new code that the user loads into it, it can definitely run games that it didn't come from the factory with, etc. It's a tiny multipurpose computing device.
https://en.wikipedia.org/wiki/Common_law
I often see laws discussed here and people finding some edge case and presenting this as a gotcha. The reality is that it's unlikely to matter.
That's not what will happen. We've already seen examples of what will happen. So let me just list them instead:
1. The Secure Boot chain for UEFI initially mandated that only OS that were signed by Microsoft would be allowed to boot on PCs where SB is enabled. This was partially rolled back after public backlash.
2. iOS devices and majority of Android devices already don't allow you to install an alternate OS or distro.
3. Platform attestation proposals like Web Environment Integrity and its Android version.
4. Mandate that every developer must register with and pay an MNC to be able to release any app on their platforms.
Basically, they'll just take away your ability to control your device in any way. Don't be surprised if it turns out that these MNCs were behind such legislations. But this legislation is especially dangerous in that it will effectively kill user-controlled general-purpose computing, even from vendors like Pine64, Framework, System76, Fairphone and Purism who are willing to offer those.
Considering the amount of damage caused by these sort of legislative BS, those who propose and vote for such bills should be investigated publicly for corruption, conflict of interests and potential treason. They should be forced to divulge any relationship, directly or indirectly, with the benefactors of these bills. On the other side, rich corporations should be banned from 'lobbying' or bribery more appropriately, in matters that they have a stake in. And they should have stiff penalties for any violations. Not those couple of million dollar slaps on their wrist. At least 5% of their annual global profits, incarceration of top executives and breaking up the company. There has to be a consequence that's uncomfortable enough, for any fairness to be reestablished. This should apply even more for those professional lobbying firms and 'industry advocacy groups'.
People also need to start strongly opposing, rejecting and condemning justifications like this that rely on the cliche tropes of CSAM, terrorism, public safety, national security, etc. None of those measures are necessary or even useful in preventing any of those. Insistence on the contrary should be treated as an admission of inability and incompetence of the respective authorities in tackling the problem. In fact, why do they assume that kids, especially teens, are unimaginative and incapable of working around the problem? They should at least be starting with awareness campaigns to get the kids and the parents on their side and empower parents to enforce parental controls, instead of reaching for such despotic measure right away. This is like banning drugs before the problem of drug addiction is addressed. Black markets exist, even for cyberspace. It will just make the problem a whole lot worse.
And finally, don't let people without clearly proven vested interests anywhere near such regulations. And choose professionals or at least competent people for taking such decisions. You can't rein in this attack on ordinary people without stemming the uncontrolled corruption in the public offices that deal with it.
They can outlaw you from using those distributions and/or scare the maintainers so there won't be distributions anymore. And if you want to use a desktop computer rent one from an hyperscaler, tied to a credit card and access it from a tablet with age verification. I don't know if I should add /s
the point of laws like these isn't to make sense, it's to be annoying
i.e. this doesn't require age verification at all
just a user profile age property
> [..] interface that identifies, at a minimum, which of the following _categories_ pertains to the user [..]
so you have to give apps and similar a 13+,16+,18+,21+ hint (for US)
if combined with parent controls and reasonably implemented this can archive pretty much anything you need "causal" age verification for
- without any identification of the person, its just an age setting and parent controls do allow parents to make sure it's correct
- without face scans or similar AI
- without device attestation/non open operating systems/hardware
like any such things, it should have some added constraints (e.g. "for products sold with preinstalled operating system", "personal OS only" etc.)
but this gets surprisingly close to allowing "good enough privacy respecting" age verification
the main risk I see is that
- I might have missed some bad parts parts
- companies like MS, Google, Apple have interest in pushing malicious "industry" standards which are over-enginered, involve stuff like device attestation and IRL-persona identification to create an artificial moat/lock out of any "open/cost free" OS competition (i.e. Linux Desktop, people installing their own OS etc.).
---
"causal" age verification == for games, porn etc. not for opening a bank account, taking a loan etc. But all of that need full IRL person identification anyway so we can ignore it's use case for any child protection age verification law
----
it's still not perfect, by asking every day daily used software can find the birthdate. But vendors could take additional steps to reduce this risk in various ways, through never perfect. But nothing is perfekt.
---
Enforcement is also easy:
Any company _selling_ in California has to comply, any other case is a niche product and for now doesn't matter anyway in the large picture.
This is usually how they do it though. First make a dumb law with poor enforcement. People don't push back about it because it obviously won't be enforced. Wait a bit, then say "people are flagrantly violating this law, we need better enforcement". At that point it's a lot harder to say "it shouldn't be a law at all!" because nobody complained when it was brought into law.
There is certainly a risk of what you’re describing with KYC tech that coming online, but I don’t know if that means it will happen.
To play devils advocate; It’s a reasonable demand from parents to control what their children are exposed to. This seems to support that.
This is considerably better than all of those.
Which isn't to suggest that it's a good law, just not really "age verification".
[1]: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
* The signal has to be made available to both apps and websites
* So if you dutifully input valid ages for your computer users, now any groomer with a website or an app can find out who's a kid and who isn't. You just put a target on your kid's back.
* A fair share of parents will realize this, and in order to protect their children, will willfully noncomply. So now we'll have a bunch of kids surfing the net with a flag saying they're an adult and it's okay to show them adult content.
* Some apps/websites will end up relying on this signal instead of some real age verification, which means that in places like porn sites where there's a decent argument for blocking access from kids, it'll get harder. Or your kid will get random porn ads on websites or something.
So basically unless this thing is thrown out by the courts, California lawmakers have just increased the number of kids who get groomed and the number of kids who get shown porn.
Mind boggling that something this bad passed.
Then, software on the user's computer can filter without revealing any information about the user.
Since I do not see a solution, and you see identifying children as a risk, what do you see as a solution for kids being in the same spaces as adults? Do you see a reasonable implementation to separate them, that doesn't have the "we know which accounts are children" problem? Maybe there's something in between?
Also, I think it's important to understand the life of a modern child, who's in front of a screen 7.5 hours a day on average [1], with that increasingly being social media, half having unrestricted access to the internet [2].
I hate government control/nanny state, but I think 5 year olds watching gore websites, watching other children die for fun, is probably not ok (I saw this at the dentist). People are really stupid, and many parents are really shitty. What do you do? Maybe nothing is the answer?
[1] https://www.aacap.org/AACAP/Families_and_Youth/Facts_for_Fam...
[2] https://fosi.org/parental-controls-for-online-safety-are-und...
It's ironic that people supposedly care about this when there's also a child rapist/murderer being kept safe as President without being held accountable for his crimes.
I suppose this law could be used as a defense against getting caught grooming minors - "I thought they were adult as surely a kid wouldn't be able to access that chat group"
How, exactly, does one accomplish "robust detection of a child"? I assume your answer would include complete surveillance of all internet communication? Could you expand on your idea of the implementation?
What I propose is rather than putting all the effort into preventing children from entering dangerous adult spaces, it's better to put the effort into ensuring that sex criminals are prosecuted and trying to make adult spaces less dangerous.
How is it detected? A police report is for after it's detected.
Preventing the crime from happening is out of scope of the government, as it should be.
The affected parties are unsupervised children, who are accessing adult spaces and content. Are you saying the children will tell on themselves?
Maybe take a moment to re-read this comment chain.
I'm not going to say that's impossible but the number of sites that do the right thing and reduce risk are going to vastly outnumber that. And 90% of those kids already have targets on their backs by virtue of the sites they visit.
This smells strongly of I just made it harder for those that do the right thing and did nothing to solve any problem.
To be clear, I'm talking about sites for adults that are doing their best right now, but have no idea who is 18 and who is 8. If they have communication between users, it's not set up to be filtered and moderated in a way that protects an 8 year old. If they could cut out a big majority of 8 year olds with the flip of a switch, that would be a good thing.
That's a lot of risk that exists right now and could be reduced.
> This smells strongly of I just made it harder for those that do the right thing and did nothing to solve any problem.
There is no meaningful difficulty in storing two bytes of extra data on the OS account and turning it into a two bit flag that programs can access and pass on to websites. And for most websites that let users communicate it makes their job a lot easier, even if the flag isn't always right.
> good faith effort to comply with this title, taking into consideration available technology and any reasonable technical limitations or outages
could easily be read as meaning "facial recognition technology exists and is available, not using it is a business decision, failure to use it removes the good faith protection".
If the lawmakers didn't intend this, then they didn't need to add all the wiggle words that'll let the courts expand the scope of this law.
This is how people bought personal computers when the mainframe priesthood banned them.
It appears that very soon, young people will "de facto" need to have this level of competence in order to survive and thrive in a world of "in loco parentis" operating systems and apps.
The latin reveals my age, but one thing about my age:
People my age did exactly that. We built our own hardware when there was none. We compiled (or copied) operating systems and apps. A couple of my friends wrote an operating system and a C compiler.
"My generation" created this entire internet thingy, installed and web-based apps.
Indeed, dumb-asses are going to level up young people.
Before they do this, it will be easy to lock the internet to only allow attested operating systems online.
Nah. It follows that computers will be required to only boot age restriction compliant operating systems, as verified by digital signatures.
This is of course just MacOS and Windows.
So, this makes desktop Linux illegal, but all the software-as-a-service like Microsoft Azure and OpenAI get off scott-free?
Fantastic.
They absolutely want to make it illegal.
The sentence you quoted says that folks who are required to comply with the law are not also required to ensure that the person currently using the device or application is the same one who entered their age or birth date into the OS's "how old are you?" database. [0]
It is true that this law is as bad as the recent Oklahoma one for small, non-corporate Linux distros... but that sentence you quoted has nothing to do with that problem.
[0] If we were speaking in person, I'd love to have you walk me through that sentence and explain to me, piece by piece, how you came to the conclusion that you did. Doing it remotely like this would be too tedious.
The narratives are changing. All these locks and controls used to be about curbing copyright infringement. Now that AI has more or less rendered copyright irrelevant it's turned into a straight up attempt to control the population. They're barely even making excuses anymore.
Mind boggling right about not allowing GCC to be used as a library, his comments on Jeffrey Esptein, a refusal to in any way compromise (e.g. the GNU/Linux meme), etc...
Oh and a recognition that free software, while nice, does not in any way solve the underlying issues he claims it does. Similarly to how letting everyone walk around their local water treatment facility and perform chemical tests doesn't really work and instead the state regulates and hires experts to monitor the water supply...
Nothing wrong with that move from a strategic point of view. The objective was to leverage GCC and make others play ball. People who wanted GCC should have been forced to do things the free software way.
Only problem with this is it turned out GCC didn't provide enough leverage. Replacing GCC wasn't difficult enough. People implemented LLVM instead and the rest is history.
Compare that to Linux which literally leaves companies behind in the dust when they refuse to merge. No kernel ABI stability: if out-of-tree stuff gets broken it's not their problem. Companies have a choice: play ball or pay the maintenance costs required to keep up with the biggest free software project ever. That's how it should be.
> his comments on Jeffrey Esptein
By "everything" I of course meant his ideas on computer freedom which is the context of this thread. I don't know or care about his opinions on Epstein.
> a refusal to in any way compromise
As he should. If anything he's not extreme enough. Compromise is the root of many evils.
> a recognition that free software, while nice, does not in any way solve the underlying issues he claims it does
Elaborate.
Do you disagree with his description of Epstein as a serial rapist? Do you disagree with Stallman's position that Epstein should be described according to the specific crimes he committed: rape instead of using much more vague terms that also encompass much less severe crimes which Epstein himself used to downplay and obscure the actual crimes he committed?
If so, why?
- servers living in datacenters
- realtime operating systems in embedded devices
- the Intel Management Engine
- the OS on every smart chip in credit cards and debit cards
- wireless cameras, roombas, smart TVs, smart fridges
- cars. Those automotive systems have OSes too right?
- all those IoT devices, including California’s traffic cameras
What age signals should those devices send out? Is there an exclusionary clause?
I think mistercheph is right to be concerned. This bill applies to all "operating system providers", defined thusly:
(g) “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.
Regarding penalities:
1798.503. (a) A person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) per affected child for each negligent violation or not more than seven thousand five hundred dollars ($7,500) per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought in the name of the people of the State of California by the Attorney General.
Not really.
>...for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
So the OS has to provide an age signal to apps from a "covered application store" defined as:
e) (1) “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing that can access a covered application store or can download an application.
(2) “Covered application store” does not mean an online service or platform that distributes extensions, plug-ins, add-ons, or other software applications that run exclusively within a separate host application.
So things like Windows, Android and iOS...
They are publicly available online services that distribute and facilitate the download of applications from third party developers to users of a general purpose computing device.
This would probably cover something like a Linux based Steam box, where there are different organizations providing applications.
I assume the people behind this don’t know things like apt or dnf exist, so it likely wasn’t considered.
Vendors will need support stuff like "account holder is 12msec old, and can access adult content". They can even create a special certification for it.
>> useradd -G under13usergroup username
I think it's one peg below intel agencies. It's the local gov agencies that want that power. The 3 letter peeps can already tell who writes what, both at scale and targeted.
These companies have fewer ethics than a minimum-wage liquor store clerk when it comes to caring about the age of their users.
What percentage of those do you think are being "allowed" to do so by their parents?
What?
"The internet" is extremely widely available and full of hazards of all sorts, some intentional, some deliberate.
I'm pushing back on this idea that it's desirable or even possible for "the parent" to completely protect their children from these hazards. Most of them can't even protect themselves.
We can demand that services, especially child accessible ones, be safer, without also expecting parents to abandon all responsibility.
What parents should be doing is enabling age controls.
Which means those age control features need to exist.
So the state is making sure the features exist.
There's no verification. The headline is a lie. It's just an account setting that parents can use if they want to.
Parents want the equivalent of being able to let their kid go to the mall and trust that the movie theater will not let them in to an R-rated movie. They don't want to have to call the theater, identify the child, and say "don't let them in to this list of movies".
And a flag on the account would be like the highschooler, right? As opposed to having nothing in way too many situations.
> Age verification doesn’t even work in the meatspace.
It works a lot better than nothing, you won't have 10 years olds getting into all the R rated movies they want. It doesn't have to be perfect, and a bit of wiggle room can even be a good thing for learning how to navigate the world.
Yes, yes, free speech and everything, you just have to first give the OS your phone number, credit card number, drink a verification can and please also... you do want to still keep your job, right?
- AI causing RAM/disk price shocks and shortages
- Google attempting to lock down Android
- The EeYou codifying the Google-Apple duopoly into age-verification legislation
- Age verification requirements spreading rapidly
- AI scraping meaning many sites have WAF rules set to 'max'. It's getting extremely hard to browse the internet with a VPN + privacy features such as WebGL blocking etc. Geoblocking seems to be on the rise too (eg Trenitalia, Aegean Air).
- Governments wanting backdoors on devices
- Broadband price increases (10-25% rises are being baked into annual contracts here in the UK)
It seems in 2026 they've really gone full speed ahead.
What is the future going to look like? A Government-approved Apple OR Google spying device for the things you need to exist as a citizen... and a bunch of paper books/library cards/porn mags?
I guess let me show a slope I found over here, just past the boiling frogs, watch your footing though, it's recently been greased and is quite steep.
I think this is mostly for show to stay relevant wrt. What is happening in the courts. This is the Same play as it always been for registration “are you over the age of 13?”
So we're already pretty deep in the law deciding what shape of computing you're allowed to do. What makes you think it will stop here?
Wedge.
> when the application is downloaded and launched
So it looks like the law only requires it on first launch. Which makes sense if the application can only be run from that one account. Apps that can be launched from multiple accounts are not singled out in the law, but the spirt of the law would have you checking what account is launching the app and are they in the correct age range.
> (c) “Application” means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device that can access a covered application store or download an application.
If your device can connect to a covered application store, every application on your computer must follow this.
Now exchange "car" for "OS" and "alcohol" for "age-sensitive content"
To your point, a user shouldn’t be forced to put in age details just to use an OS. That said, if an OS can send a simple Boolean to an app/site if the user is over 18 or not, I’m guessing more people would rather opt into that system vs handing over extensive details to each and every vendor who asks.
As a person in my 40s, with no kids in my house, I find all of this absurd. Let parents install some nanny software if they want, don’t force it on everyone and use “protecting children” as the scapegoat.
It's a good reason not to put cloud dependencies into things.
no accounts to compromise. no passwords to remember. end point devices control their connectivity. no vpn needed to connect, no intermediary to see all traffic and peer traffic is specifically what is needed/allowed/requested, not a wide open network connection/accounts to be compromised
The saving grace is that obviously they have no idea what a Linux distribution is, and only the Attorney General can bring action, so there isn't much risk of the AG suing Debian.
What happens if I bring a laptop with an "illegal" OS without this unwanted "feature" into the state? Will I be denied access to public wifi in hotels and restaurants? Or will it grant me access, but snitch on me -- make a call to the state police to come deal with someone with an illegal laptop? Will I be forced to install a different OS while a police officer watches? Will my laptop be confiscated and destroyed as contraband? Will I be thrown in a California prison?
I don't want to take a risk and find out.
The only remedies listed are:
> 1798.503. (a) A person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) per affected child for each negligent violation or not more than seven thousand five hundred dollars ($7,500) per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought in the name of the people of the State of California by the Attorney General.
And there are several other provisions that further narrow the circumstances under which this law could be enforced.
If your personal computer is not being used by a child, and you're not distributing software to children or devices used by children, then there are no circumstances under which your actions could violate this law.
Microsoft has been pushing aggressively to deprecate the local and funnel everyone to Microsoft online accounts , while Android and macOS/iOS are already in such a state by default.
Coupled with the same accounts being used for online login, looks like a feature creep panopticon in the making. With Linux lucking out be default.
Isnt that literally one of the first rules of the DNM Bible?
It still parents that usually buy the computers and set up the différents user accounts. So the responsibilities would be put back in their hands as machine owners to correctly tag kid's accounts. OS vendors would then only be responsible to accurately transmit this declarative information to requesting App/services.
Of course some smart kids are gonna find a way to bypass that (as any other mesure you can imagine, because kids are smart). But nonetheless we could have a good enough OS level declarative age for 95% uses cases and send to the trashbin all the age verification creep that is the current trend.
That isn’t age verification at all
First, let's admit the push for age verification laws isn't a partisan or ideological thing. It's a global trend. This California law has bipartisan sponsorship and only major org opponent is the evil G [1]. While age verification is unpopular in tech community, I imagine a lot of average adult voters agree that limiting children's access to wilder parts of the Internet is a good thing.
On this premise, the discussion is then who should be responsible for age verification. The traditional model is to require app developers / website owners to gatekeep -- like the Texas and Ohio laws that require PornHub to verify users' IDs. But such model put too much burden on small developers, and it's a privacy nightmare to have to share your PII with random apps.
This is why we see this new model. States start to believe it seems more viable to dump the responsibility on big tech / platforms. A newer Texas law is adopt this model (on top the traditional model) to require app stores to verify user age (but was recently blocked by court) [2]. And this California law pretty much also takes this model -- the OS (thinking as iOS / Android / Windows with app store) shall obtain the user age and provide "a signal regarding the users age bracket to applications available in a covered application store".
While many people here are concerning open-source OSes, and the language do cover all OSes -- my intuition is no lawmaker had ever think about them and they were not the target.
[1] https://calmatters.digitaldemocracy.org/bills/ca_202520260ab... [2] https://www.politico.com/news/2026/01/05/big-tech-won-in-tex...
Curious.
The people who wrote this law work for Microsoft and think people have individual laptops and phones with a cellular plan. They care nothing for user privacy, in fact they want persistent digital identifies for advertising.
Why is this "news" today? Am I missing something?
My question, is if "the children" are worth protecting, why not adults? I would like to opt into not having to deal with dark patterns. Why not a age independent system, which a user can opt into and which "children" are automatically optd into.
It says users, on account creation, must indicate their age or birth year (or both) and that programs must have access to that info, but I don’t see any requirement about checking whether what the user enters is correct.
What does make it weird is that it requires account holders to enter that data at account creation, and it defines an account holder as ”an individual who is at least 18 years of age or a parent or legal guardian of a user who is under 18 years of age in the state”
So, kids are allowed to create an account, but then, an account holder has to enter their age or birth year.
To top it of “a parent or legal guardian who is not associated with a user’s device” is not an account holder, so let’s say a 15-year old buys a laptop or smartphone and wants to set it up. There’s nobody associated with the device, so there are no account holders. Who should enter that age info?
On many smartphones, having a grown-up create an account first won’t work, as there’s no way to set up a second account.
but users don't have a 1:1 mapping to the people that log into them. linux users that aren't used by any particular person, but by a particular _service_ are common. so are linux users that could be logged into by any number of people, and which have no specific single owner.
Practically, I think this is tough. How does a business verify their 20k Linux servers in AWS? What prevents Linux users from simply modifying their code such that they no longer do age verification? I think it's easy to imagine circumventing this one law, but this is another brick in the wall. Maybe your bank stops working on Linux. Maybe major websites stop working unless they get your citizen ID and age verification data from your OS. Maybe no one makes a browser that doesn't try to grab that information.
Not joking; stock up on books and keep a collection of media that you own personally. Perhaps your linux computer will start looking a lot like your PC from the early 90s: not connected to the internet, just used for word processing, some installed games, and media.
For example, I've got a map application on my phone that lets me download maps, widgets, POI lists, etc. from their app store. It seems like enabling that age signal through this exchange is exactly what the politicians are looking for.
I can imagine Samsung asking for the user's age every time you want to grab a snack and refusing to unlock the door otherwise.
Or perhaps... they could add a camera to the fridge and send a stream 24/7 to their servers so they can identify the age of whoever opens the door. For complying with the laws of California, honestly!
The way I read that, you just have to ask for an indication of age. Like when I'm not logged in to Steam and I want to look at a game with blood, it asks for a birth year and I pretend to be 109. That's not exactly "age verification." Am I missing something?
Bill text (it’s longer, but the rest is mostly definitions of the terms used here):
1798.501. (a) An operating system provider shall do all of the following:
(1) Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
(2) Provide a developer who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface that identifies, at a minimum, which of the following categories pertains to the user:
(A) Under 13 years of age.
(B) At least 13 years of age and under 16 years of age.
(C) At least 16 years of age and under 18 years of age.
(D) At least 18 years of age.
(3) Send only the minimum amount of information necessary to comply with this title and shall not share the digital signal information with a third party for a purpose not required by this title.
(b) (1) A developer shall request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.
(2) (A) A developer that receives a signal pursuant to this title shall be deemed to have actual knowledge of the age range of the user to whom that signal pertains across all platforms of the application and points of access of the application even if the developer willfully disregards the signal.
(B) A developer shall not willfully disregard internal clear and convincing information otherwise available to the developer that indicates that a user’s age is different than the age bracket data indicated by a signal provided by an operating system provider or a covered application store.
(3) (A) Except as provided in subparagraph (B), a developer shall treat a signal received pursuant to this title as the primary indicator of a user’s age range for purposes of determining the user’s age.
(B) If a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant to this title, the developer shall use that information as the primary indicator of the user’s age.
(4) A developer that receives a signal pursuant to this title shall use that signal to comply with applicable law but shall not do either of the following:
(A) Request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply with this title.
(B) Share the signal with a third party for a purpose not required by this title.
The language is so broad it seems to cover all software that exists and is accessible via the internet, and every install of an operating system on any kind of machine
> (c) “Application” means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device that can access a covered application store or download an application.
> “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing that can access a covered application store or can download an application.
> “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.
So any piece of software you can download from the internet will be required to check this "signal" made available by the os?
The literal reading of the law says this only required when a child is the primary user of the device.
> (b) (1) A developer shall request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.
but 'user' here is:
> (i) “User” means a child that is the primary user of the device.
So these rules should only apply to accounts/devices where a child is the primary user.
Grep on an adult's machine would not need to check how old you are, at least with a literal reading of the law.
So grep/ls/etc are all installed as part of that 'account holder' and do not need to do any age verification.
The signal only needs to be checked when the device/account user is a child and when downloading apps. I think an unfortunate consequence here is that the literal definition of the law says package managers probably can not run on children accounts without jumping through a bunch of hoops. Which is bad for children learning code/computers/etc.
The first thing I would change about this law would be:
> (b) (1) A developer shall request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.
Any application that does not need to know a users age should not be required request the 'signal'
I once used curl to download a shell script from GitHub and it caused a defcon 1 event where security reached out to me asking why I downloaded it.
I want to know who is behind these laws like this one and the 3D printer gun verification, that seem to pop up across state legislatures all at the same time.
Client side JavaScript can be considered an application, and then ad business would need to first verify that I am over 18 in order to allow me to see their ads.
Ultimate ad blocker.
(a) (1) “Account holder” means an individual who is at least 18 years of age or a parent or legal guardian of a user who is under 18 years of age in the state.
(a) (2) “Account holder” does not include a parent of an emancipated minor or a parent or legal guardian who is not associated with a user’s device.
(i) “User” means a child that is the primary user of the device.
User is the most surprising here. It really should just be minors, or non-emancipated minors. Further, I think there are interesting ways the definition of account holder and user combined play out in interpreting the rest of the law.
Does that mean that the admin will have to manage dob of every student when creating accounts ?
> A developer shall not willfully disregard internal clear and convincing information otherwise available to the developer that indicates that a user’s age is different than the age bracket data indicated by a signal provided by an operating system provider or a covered application store.
>If a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant to this title, the developer shall use that information as the primary indicator of the user’s age.
So, I have a button "I'm older than 18" on my app but the signal is "under 13", I can decide that the user is older than 18 ?
That already happens to some extent although the mechanism by which this happens might depend on the school district, etc. The `dateOfBirth` LDAP attribute is probably the most obvious method (which admittedly should probably not be used due to the ease in accessing this info in the default configuration) but there are others.
In secondary school when my account was set up we were told that our initial password (that we had to change on first logon) was our DOB
I wonder: since that operating system needs to attest and (vaguely) eventually report an age and other identifiers to a government API and app developers, will that report violate HIPAA?
If not, why not? You need age verification before you even create an account.
This thing is so broadly-written, the only thing saving you from needing to give you age to your toaster is that it's not a "general-purpose" computing device. Never mind that it can run DOOM...
also: what's download? in embedded sphere, flashing a firmware is often reffered to as download. That's an industry standard term.
History teaches us governments are the best at protecting children.
(Local variations can exist)
California Assembly Bill 1043 requires OS providers (including Linux) to add age verification at account setup, prompting users for birth date/age to signal age brackets to apps in covered stores. It may violate privacy by enabling data collection/misuse beyond age checks, similar to UK/Discord issues; no explicit civil rights violations noted, but could restrict access for adults/minors if misapplied. Benefits: Enables age-appropriate app content, protecting minors. Drawbacks: Privacy risks, enforcement hurdles (e.g., Linux disclaimers like "not for California use"), aligns with global trends amplifying concerns.
An updated deep dive by Mr. AI returned the following analysis:
Official link: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm... Revised pros: Enhances child safety via non-PII age brackets for app compliance; data minimization limits info shared; anticompetitive prohibitions prevent misuse; good faith shields from liability. Revised cons: Setup requires age input, risking misuse despite safeguards; enforcement challenges for open-source OS like Linux; increased developer liability for signals; potential access restrictions from errors or misreports. No clear privacy/civil rights violations for adults/minors, but implementation costs and global trend concerns persist.
My thoughts: California lawmakers keep turning the screw more and more to the left with AB 1043 being introduced by Democrat Buffy Wicks. Though it has bipartisan co-authors (8 Democrats, 3 Republicans) and passed the Assembly unanimously (58-0), it still feels a bit authoritarian to me. The California Assembly political divide is very left leaning with Democrats controlling 60 seats and Republicans 20 for a total of 80 with Democrats controlling a supermajority.
What's to stop someone from building their own Distro using LinuxFromScratch to bypass this new restriction? Nothing, in my view!
Which I had money cause, Florida looking good about now.
What's next? Chinese style social credit? You’ll need 800 points to run a sudo command?
Free society? Mass surveillance. The West is becoming more of a nanny state like China every year.
In all seriousness, though, this is the only way where politicians get to pretend they did something and the rest of us get to avoid getting royally screwed. If parents were given dumbed-down versions of the tools that already exist to manage corporate-owned cell phones and laptops then there'd be a lot less for people to complain about (not that it would stop perpetually incompetent parents from pointing the finger at everyone but themselves for their own failings, of course, but at least the vast majority who AREN'T those people would be satisfied).
BUT this is obviously not the right way to implement this.
Right now I'm on an ESP32 with free RTOS, will I need to add a keyboard and display just for age verification?
I'd like to see that definition. My OS doesn't have an "application store", so I doubt it's impacted by this law.
> “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing that can access a covered application store or can download an application.
To whittle down the the important part:
> “Covered application store” means > any [...] general purpose computing that can access a covered application store or can download an application
If you have a network stack, you can 100% connect to a "covered application store" and thus the OS falls under the scope of the law.
All this does is require the user to select a non-verified age bracket on first boot. You can lie, just like porn sites today. I thought HNers wanted parents to govern their children's use of technology with these kinds of mechanisms.
In the US maybe, but where I am you can't fap in peace without using a VPN or have some kind of age verification. Some of them being baroque. Example:
"We analyze your email’s digital footprint (history and reputation) against trusted databases. This is often enough to confirm that you're of legal age."
Really? Can you expand on the version of Australian legislation that requires an OS to have age verification?
The AU legislation I'm aware of requires various social media sites to verify that users of those sites are not under some age, 16 or so.
That is not a constraint on the OS or on potential users, that's a legal requirement for Social Service providers.
https://www.abc.net.au/news/2025-07-11/age-verification-sear...
It appears that the Australian and UK versions don't go as far as what seems to have been proposed in the US.
It's useful to get a feel on the policies and differences being rolled out before going over the skies and extrapolating from misconceptions.
"This title does not impose liability on an operating system provider, a covered application store, or a developer that arises from the use of a device or application by a person who is not the user to whom a signal pertains."
This is obviously a law so poorly written that it'll never pass a court challenge. Assuming anyone brings one.
Accomplishes three things: Demonizes age verification, big tech gets to dodge it, cedes more control of your PC.
"useradd bob" is an "account setup". does that need age verification too? haha
I've been working around the Microsoft user-creation requirement for years. Looks like they were ahead of the game. CA is marching towards private-business surveillance. What could go wrong?
And since it doesn't make sense to have dozens of different versions of their apps, they write to the strictest jurisdiction's laws.
If everyone has the power to make laws that apply to everyone...it's chaos.
> The "beige box" era was largely the result of strict German workplace ergonomics standards (specifically the TUV and DIN standards) that became the de facto rules for the entire global industry. The law didn't explicitly say "thou shalt use beige," but the regulations were so specific about light reflectivity and eye strain that beige (or "computer gray") was essentially the only compliant option.
It was already approved? This seems wildly invasive, and CA can't even pretend they're doing it to stop porn. CA is just monitoring citizens for the love of the game
More significantly, it does require all applications (from "covered application stores", but which has a definition for that which seems to include not only what you would normally call an app store, but any website or other source from which an app can be downloaded) to check the age signal provided by the OS when the application is "downloaded and launched".
While it is poorly drafted, circular, and self-contradictory on some definitions and other points, it arguably seems to prohibit age verification within the scope of apps it covers, in that:
(1) It requires all OS's to have an age attestation feature, (2) It requires all applications to use the age attestation feature, (3) It requires developers of applications to rely on the info from the age attestation feature as the "primary indicator of a users age range for determining the user's age", with the only exception being if the developer has internal (not external) information which is "clear and convincing information" that the user's age is different from what is signalled by the OS.
Not exactly true as you can do local account installs.
I wonder if you can get around the law by just having people build their own image from the source.
"Self, are you 18 years old?" "Why, yes I am." "OK, self, please fill out a 27B stroke 6 form in your head." "I've completed it." "OK, self, I've validated it."
useradd...
But what about your outrage you all at the moral and ethical implications of this?
Won't kids just lie about their age, like they do to sign up with social media?
What if more than one person uses the pc?
What if it is sold?
If the OS is open source, then the user could remove the software code to collect the data.
This is protect-young-people theater.
If
In all honesty the V-Chip was meant to protect children.
Age verification and identity assurance[1] is meant to reduce online banking fraud and combat terrorism/espionage.
Whats next outlawing encryption with Clipper Chip[2] 2.0 and saying its to save the whales? I guess we have QUIC and other DRM tech to ruin our day so it doesn't even matter.
I would prefer we drop the think of the children[3] charade and act like adults and get serious about online crime/fraud/terrorism and maximizing online banking.
The biggest problem with this thought domain is that the internet is global and we are thinking at regional, national, and state levels. For so many years everyone has heard complaints about the great firewall of China only to build our own? I guess we have no other choice since bad apples spoil the bunch[4].
[0]https://en.wikipedia.org/wiki/V-chip [1]https://pages.nist.gov/800-63-3/sp800-63-3.html [2]https://en.wikipedia.org/wiki/Clipper_chip [3]https://en.wikipedia.org/wiki/Think_of_the_children [4]https://en.wikipedia.org/wiki/Bad_apples
They should also require background checks for gun safes.
Putting "Live Free or Die" on your license plates doesn't make it true.
They’re trying to destroy all the best nerdy hobbies. First drones, then 3D printing, now even my precious Amiga!
(I’m being sarcastic of course)
And I'll have to give a fake ID to our automated CI pipelines, I guess.
Overall, I think don't think it's a bad idea for devices to be able to host an age verification system that offers requestable boolean proof of age, like if porn site demands over 18 to view, the user, regardless of age, is prompted and if they accept, it returns either a positive cryptographic claim or a cancel signal if not of age. If they don't accept the prompt, the same cancel signal goes back. The idea that this feature would need a mandate of law is dumb.
This is truly stupid.
By next January there will be 30 different methods of age input signalling between OS and application. And then by 2030 we might have the top 3 adopted as established defacto standards.
somewhat related-ish https://xkcd.com/927/ :)
This is just not going to be a thing on Linux.
Are there app stores on Linux? Yes, that's what FlatHub and Snap supposed to be.
So what, should Canonical just block Ubuntu downloads to anyone in the state of California? No security researcher is going to download an operating system that asks them their age for example. I feel like it draws a red line for me also.
This law is so completely insane. It sounds like it was written by some Apple fanboy to whom there is no other operating system other than Apple. The very state that spawned GNU and BSD is the same state that is not only demanding your data but enshrining its use in spyware in law.
Server operators could add this header to anything adult or that may contain user-contibuted content in their sleep. App developers could add a snippet of code to look for the header in their sleep. Then have a law that requires parents with small children under 10 must enable parental controls on devices used by their children. Why under 10? No confrontation with teens. The small children will grow into the process. No PII shared. No asking for ID. No sharing ID. Not on the OS, not on a third party website. I don't like green eggs and ham, I don't like them Sam I am.
We all know that once this law has been complied to they will extend it to require ID be uploaded to whatever company gives the most kick-backs to Gavin and an API key will have to be saved on the OS per account. This data will be leaked in 3 ... 2 ...
To be wrong, one must understand what one is talking about.
Sigh.
But anyway I'm not in California nor the US so this doesn't apply to me in any way.
we're not far behind.
step1: "lets see if we can get away with imposing a small easy requirement, you know 'think of the children'"
step2: "now that we have a foot in the door, lets see if we can get some real tracking in place, for the children of course"
Anyhow: as far as I can tell compliance on linux would be as simple as
echo $YEAR_BORN > ~/.config/ca_ab_1043
In all seriousness, rather than comply, linux distros should enforce this law. Any linux install that detects itself being in california should automatically shutdown with a loud error message. I give it a week before a madmax situation develops.
My TV, my fridge, my 30 year-old TI-82, my sprinkler system… my mom’s pacemaker.
And will I have to verify again when I switch to command line? =P
What a joke.
We already have Secure Boot, the infrastructure is in place. It is currently optional, but a law like this can change that.
> (c) “Application” means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device that can access a covered application store or download an application.
This is basically any program.
> (e) (1) “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing that can access a covered application store or can download an application.
This would include any package manager like dnf/apt/pacman/etc. They facilitate download of applications from third parties.
> (g) “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.
This sounds to me like it would include distro maintainers. They develop and/or control the OS. Also, would this include the kernel devs? How would they be responsible for the myriad of package managers.
The overall law reeks of politicians not knowing what they're legislating.
when you force someone to signal status as a minor, you are forcing them to wear a target, hostiles will not have so much work to find minors, now they only have to contact, groom, and offend.
this proposed law actually endangers minors.
I would not know why the operating system I use would need to sniff on me - or yield that information to anyone else.
This is clearly fascism.
Not enjoying this verification can future
Colorado Senate Bill "26-051"
The actual bill and links to its two sponsors Matt Ball and Amy Paschal.
https://leg.colorado.gov/bills/SB26-051
https://leg.colorado.gov/legislators/matt-ball
https://leg.colorado.gov/legislators/amy-paschal
* It also reveals that visitors to any site are children, compromising their privacy and opening them up to targeted advertising
* The data will undoubtedly be added to the accumulated, traded databases so many services use
* The bill makes onerous demands of developers to consider other items that may suggest the user is actually in a different age bracket, like doing websearches for "toys" (child) or "toys" (adult) - which works what percentage of the time, exactly?
* And it's totally ineffective, since kids can look at porn anywhere they want, or internationally, regards of useless bill like this
The most egregious part of this bill is that:
* It legislates that if kids connect to a website, that website can query their age brackets (an "age signal"). This means their approximate age is revealed for kids-specific advertising, manipulation, or even sold to a pedophile group.
A DEVELOPER SHALL REQUEST AN AGE SIGNAL WITH RESPECT TO A PARTICULAR USER FROM AN OPERATING SYSTEM PROVIDER OR A COVERED APPLICATION STORE WHEN THE DEVELOPER'S APPLICATION IS DOWNLOADED AND LAUNCHED.
Basically SB 26-051 creates a mechanism that can be used to harvest the data that certain users are kids and then sell that data to anyone who will pay for it.
Data like this is traded internationally, which makes it tragic that elected lawmakers would waste time pushing a bill whose only mid-term effect would be making Colorado less attractive to developers and software companies.
The irony is that normally your kids would have been protected, by standard practices, from having their age exposed. This bill reverses that, putting your children at more risk.
The bill also would force many devices to provide age bracket data that are surprising to most people, because this part:
"DEVICE" MEANS ANY GENERAL-PURPOSE COMPUTING DEVICE THAT CAN ACCESS A COVERED APPLICATION STORE OR DOWNLOAD AN APPLICATION.
... means anything with Internet access and storage. This includes smart televisions, thermostats, tablets, smartphones, smart watches, some fitness tracking devices, some smart toilets, and so on, all potentially reporting your activity on demand, even if that back-end service has nothing to do with porn.
The bill is also poorly structured. Clearly it's intended to focus on services like app stores (Android, Apple), but by attempting to integrate support for this into operating systems, makes it available to hostile actors for any purpose worldwide. Further, it requires developers to guess whether other available information on a user might mean they're really in a different age bracket, exposing them to fines of $2500 to $7500 per minor "affected" (note: "affected" is not defined in the bill). The exemptions give blanket protection to developers working on for-internal-use software, but give no exemptions to recreational programmers. non-profit personal software, university projects, and so on, casting a chilling effect across software engineering generally.
Lastly, the bill is ineffective. Most of the web runs on Linux, a coöperative international effort, nominally controlled by one man in Finland. There is no chance of this bill's mechanism being implemented in this context. Nor will other developers be especially interested in rewriting software for this Colorado-specific bill. Further, the kids supposedly being protected from all the Colorado native porn sites would just web-browse to nearly any porn site and be outside of Colorado anyway, if not outside the US entirely.
These sponsors aren't alone. Most elected lawmakers are equally bad at technology and protecting democracy from the threats that come from chipping away at privacy protection. Bills like this appear in other states all the time, despite being toothless, easily circumvented by kids (who trivially circumvent even face photo hurdles), or radically compromising the privacy of adults (like this one).
There's also the long game, where these sometimes Democrat-led bills in various states could eventually see a much deeper-reaching federal one, where, instead of a "age signal", the user's computer must send an "ID signal", allowing all personal interactions with the Internet to be tracked, analyzed for political and other biases, and used by backbone firewalls to control exactly what people are allowed to read. Very handy for a dictator who might want to block off "fake news".
This is only a hypothesis, but one has to wonder whether sponsors to such bills even care if the bills work or pass, since either way they still get to claim they Protected the Children! even though the bills themselves violate privacy for everyone, often cause websites about breast cancer to be censored, or pave the way for authoritarian control - something this one stands out for. The only thing really surprising is that this bill wasn't sponsored by MAGA Republicans deliberately to add another paving stone to the road to national censorship.
I urge everyone to get in touch with other Colorado representatives to call for a fight against this travesty of a bill. Further, I would excoriate the two sponsors by email and phone, and tell them now that you will not reward this sort of juvenile lawmaking with your vote. Lastly, tell other people about how Matt and Amy plan to strip away their privacy in a way that puts children more at risk than doing nothing.
Recently after we spent hours getting a Chromebook set up after a "Power Wash" due to remote auth failure, it wanted the old password and there was no option but to wipe the device.
They held our homedir hostage with required remote auth.
We were not able to log into our computer and lost all of our data because of remote auth.
Secure critical systems must not have a centralized remote auth dependency that can be denied.