Age verification is stupid, parents the actual parents need to look after their kids and what they're doing on the computer. If I hadn't been able to sit down at my Atari 800 computer with 48 KB ram, as I pleased after school everyday since the second grade, I wouldn't be the person I am today I wouldn't know as much about computers and I would not be a tech savvy person at all. These age verification measures are strong handed nanny type rules and laws that have no place in the household, it is not the government's job to raise children it's the parent's job. You're going to raise a whole generation of dummies.
Age verification at the OS level makes no sense to me. Most households aren't going to have a separate device for every family member and so you will end up with a tablet or computer set up by one of the parents (and thus having their age stored) that will be used by both parents and children. Likewise, people generally won't create a separate account for every potential user.
> Age verification at the OS level makes no sense to me.
it's the only form of "age verification" which can be done in a somewhat privacy respecting way (as in at most leak the age)
the idea is to "bounce back" the "is old enough" decision to parent controls and let the parent choose (the Californian law doesn't quite do that perfectly, but goes into that direction)
and if you sell what is more or less a general purpose compute/internet access device with OS (which I do include phones into) I think it's very reasonable to either sell it to adults only (with a disclaimer it's "not for children") or include
proper parent controls
> Most households aren't going to have a separate device for every family member
in current times in the west it is very very common for many devices to be for one person only. Especially phones, or at least have different (OS) accounts.
but again this comes back to "parent controls", weather that is for a child (OS) account or a way to switch from a child profile to a adult profile doesn't matter
but in the end, the point of such laws should be to give parents tools to parent. As well as handling the case of parent acting in neglect by inaction. But if a parent intentional decides to give their children a device with their profile because they think it's fine than that should be their choice and responsibility.
> Likewise, people generally won't create a separate account for every potential user.
where it was possible I have not seen it not used, weather it's on a switch, gaming console or PC. It is the most convenient way of automatically separates logins, browsing history, game safes etc.
and the law als isn't made for that shared computer in the living room (through it will apply there). It's more about the devices children might use unsupervised, e.g. their phone.
That's why Meta paid for these os-based age identification laws[1], shifting the responsibility from itself onto the app stores. I agree it's probably preferable to do it on device instead of every website implementing an id check through shady as fuck[2] third parties like Persona. This whole thing is just such a mess though, people rightfully distrust everybody involved, all these bought and paid-for politicians. All of a sudden we have the same laws popping up all over the place, US, UK, Australia, Brazil, ... Nobody, not a single person involved gives a fuck about child safety. It's different billion dollar lobbies fighting amongst each other, each with different monetary incentives.
You know what they should do? They should scrap it all, no more "child safety" laws until we kicked money out of politics. Western liberal democracy is in a corruption and legitimacy crisis, this is just it's latest symptom.
> They should scrap it all, no more "child safety" laws until we kicked money out of politics.
the current state has been close to that, and is co-associated to be a related to many existing issues wrt. to children/mental health/child safety (I very intentionally use co-associated instead of correlated, and definitely not root cause)
you could say law makers of many countries have given the industry ~30 years time to self regulate and come up with something acceptable by themself
The industry didn't. Now they have to regulate, it's their job and responsibility to do so :(
(but it's also their responsibility to not listen to highly malicious/biased lobbyist trying to hijack it into surveillance laws!)
honestly to some degree the industry still has a short time frame to fix it themself, provide an acceptable solution which can mostly work internationally (by having localization in it) and pitch that to the EU and US states not having yet decided on age verification laws, so that the few which already have some bad laws are pressured to change course
Through the problem is many non-cooperate entities instead insist it's all nonsense and there is no problem and companies like G, MS, Meta etc. have little interest fixing the situation. A misguided, hard to implement age verification law creates a legal moat to hinder smaller competing companies...
we have seen the same with the EU AI act, it's general outline is very reasonable especially if base that assessment on the corner comments. But thanks to big tech lobbyist hijacking it it became a economical/regulatory moat catastrophe (in the details and the parts which have not yet taking effect, not in every aspect).
What is wrong with parental controls AND parenting?
Nothing. This has never been about protection of children. It is tracking real identity from every source to every destination otherwise known as user-tracking. If this was about protecting children they would require an RTA header on all adult and user-generated content sites and require the most common user agents to look for that header if parental controls are enabled. No tracking, no uploading anything. [1] Sufficient for small children which is more than we have now or will ever have thanks to corporate greed and lobbying.
> It is tracking real identity from every source to every destination otherwise known as user-tracking.
except this is not true at all
yes there are people which try to systematically hijack child protection laws all the time for stuff like that
but e.g. the californium law is very clearly intended to avoid exactly that (that= tracking real identity)
> they would require an RTA header
they are politicians focused on law making, they have no idea what an "header" even is!
A politicians job is to identify issues consult people with expertise, propose a solution based on this people feedback and then listen to feedback, including from other groups. If they need to know what an HTTP header is and how that works something went really wrong.
But this is also where things often do go wrong, by a) dishonest and outright malicious consulting telling politicians bullshit, b) politicians having a over the top simplified understanding of a topic and think that it's still suited for extrapolating things from it leading them to nonsensical outcomes.
And if then large part of the industry which do care about non abusive solutions loudly refuses to provide any solution and denounce anyone trying to do so you are basically opening even more doors for anyone with malicious intentions. Which is pretty much the situation we have now.
Even worse not only do many people in the tech/hacker community not only not try to help with finding an acceptable solution they often outright reject that there is even a problem.
But there is a problem, a huge one even.
As just one dump example of many: it's currently harder for a teenager to get access to some wholesome soft porn then it is to watch potentially traumatizing and definitely not healthy content (weather it's violence, or certain forms of hard core porn(1)), or access sites/apps with gambling, prying on children, hate mongering, glorification of mobbing etc. etc.
And lets not forget most parents are non technical people, which means most of the reasonable usable and privacy protecting existing tools are not actually usable by them (and not available by default, and they can't reasonable evaluate which ones are okay either).
Also please don't say I grew up with a uncontrolled internet (~25-35y) and I am fine. Putting aside that the internet was very different back then. But also hardly anyone in that age range is truly mentally fine (for a lot of reasons, but that anyway makes it a pretty bad argument).
> RTA header
is insufficient, age isn't just 18+ or 13+. Through many media sites love to pretend that is the case
Furthermore this doesn't work for "feed" content as the server needs to know what to filter one before returning content.
But this is also the direction I have proposed in previous comments and not that far away from the direction the Californian law went to (but very much different to the UK law):
- provide a min. age category indicator for all content (most times by app, sometimes per-content in that app, sometimes per-origin per-content in that app (e.g. YT accessed through the browser). But this needs to be more complicated then 13+,18+ as categories differ by country and you should include tags and some other stuff.
- A parent control API which has a simple/naive default impl. but can be replaced with whatever parent think is right.
- A API to get the users age category (incl. localization, e.g. `us:13`). It needs explicit permissions and providers are not allowed to force it, every contents min-age-constraints still have to go through the parent control app. It's only for selecting content feed/preview. The specific content served might still be rejected by the parent controls! Using it for anything else should be made criminal illegal with personal liabilities for executives. (e.g. using it to try to sniff the exact age date of a person). A implementation which just serves `us:18` but then refused anything >13+ or similar must be treated as a legit possibility, the app must still work in general, but it might not have any further previews. Etc. Etc.
- The trust of age hints/evaluation is anchored solely in the parent controls, the setup of the parent controls is the parents responsibility. Any form of identification(2), AI face scans or similar as a requirement for setting up parent controls/not having a permanent 13+ account or similar _is strictly outlawed_.
- All sold products with preinstalled OS must have a default parent control app which is trivially to setup up in it's default setup and the default setup must only reqiore 1. localization (preset to current country if known, changeable), 2. age to auto adapt the age group where alternative the parent can set the age group, even through that means they have to change it in the future manually (needed for special care children). It also in it's default setup must not track/spy on everything the child does.
- Adult accounts still need compatibility with the APIs but will always provide 18+/yes content allowed.
- Products and e.g. downloadable OSes can decide to be "adult only", in which case their access must be guarded like any other adult only content (e.g. when you buy it) but in which case they don't need to support child accounts and can instead return hard coded 18+/yes content allowed.
(This is already the short(er) version :/, e.g. most countries have a 18-21 category, for many countries that category is only irrelevant for things anyway involving a identification (e.g. signing certain contracts, doing certain jobs), but e.g. the US relation to alcohol is an exception).)
---------
(1): And I don't mean just a bit of soft bondage, but things which will lead to serious health issues long term and/or involve violence, glorification of violence, suppression, misogyn, implications of torture, rape, child abuse or in case of drawn/generated content non-implications and even snuff.
(2): There can be some acceptable ways, e.g. a clerk checking your ID IRL, without recording anything except yes/no. Digital ID setups which only communicate adult yes/no without identification etc. But given that all relevant devices tend to be too expensive for children to buy them themself and you also should trust your child if it approaches adulthood (and might have the money) I don't think anything like that is really needed. In general this should focus on efficient solutions for age group <16. IMHO if you still need parent controls for 16+ you messed up parenting.
A API to get the users age category (incl. localization, e.g. `us:13`). It needs explicit permissions and providers are not allowed to force it,
An API actually means that more and more details about the user will inevitably be added with time. This is a user-trackers dream come true. No thanks. One static header, done and dusted.
But this needs to be more complicated then 13+,18+
I will never agree with this nor will most people. Content is either adult or not adult. That is how existing parental laws are structured in most countries. The parent must decide if the child is ready to view content that is rated anything other than "G". The parent decides, not some app, not some API.
A child account on a tablet, phone, laptop need only prevent tampering with browser settings and by default enable parental controls which in turn simply look for an RTA header or any other indicators that the site or content is adult or user-generated in nature. Keep it simple. If people wont enable looking for a header then the only reason they would go far further and screw with an API would be if it were to the benefit of evil. (marketing, sales, manipulation of the child, manipulation of the parent).
> An API actually means that more and more details about the user will inevitably be added with time.
with that logic you could also argue a computer means more APIs will be added over time
especially if it's a law mandated API which doesn't allow any additional thing this really isn't a problem
> I will never agree with this nor will most people
except overall (at least outside no HN bubble) most people would disagree with you, actually the huge majority of parents and children affected by that would disagree
Treating a 16 year old like they are 13 is just completely absurd.
Expecting parent to make decisions about every single peace of content (website, YT, video) their child, even if older, watches without providing any guidance and defaults
is not practical at all and due to that is guaranteed to fail.
To be frank you comment is completely quixotic, lacking any relation to the reality most parents live in today.
Random person jumping in to say, the original comment from 'Bender' is what is agreed with by almost every human I've spoken to. It is most definitely the take of every parent in my social circle, the vast majority of whom are outside of the tech space.
The issue you're describing is strictly one of parenting, and not one that can or should be handled via some government agency. Their (Bender's) suggestion is actually the best that I've seen for handling this issue, and the only one I believe those I know would all happily agree with.
On a side note, this entire comment of yours is very unhinged. I'd wager you're far far far from being aware of the 'reality most parents live in today', based off of what you've said here.
EDIT: Thinking about it more I _guess_ we are more misunderstanding each other then we are fundamentally disagreeing (through I guess we still are disagreeing :) )
---
> I'd wager you're far far far from being aware of the 'reality most parents live in today',
I'm not (EDIT: As in I have enough parents in my live, through there may be larger cultural differences.)
and it's beyond my understanding how anyone can think treating a 13 and a 16 year one alike is a reasonable solution
similar all the things I have proposed gives parents the tooling needed
you make it sound like having an app fully controlled and replaceable by the parents is somehow removing power/choice from them. But nothing in it excludes parents from allowing or disallowing children to watch content from other age categories, potentially on a peace by peace basis
what it does is take the IRL system which isn't perfect but works reasonable good from how we e.g. handle the sale of movies and applies it to the digital world
including the option to ignore it
but we also have to recognize the reality that not all parents bother to even try to properly parent, and others are stressed, overworked and struggle. So having a triviale setup once and get some somewhat reasonable baseline solution is important (and yes it shouldn't be important, but IRL it is anyway)
similar I think it's important to realize that not just 18+ content can be harmful a barely not 18+ horror movie can still be quite traumatizing for some 13 year old. At the same time when children become 16+ you should have build a relation of trust with them where they shouldn't need to tell you or ask you for permission for everything not appropriate for 13 year olds on the internet. But while trust is grate you still would want to do more than that to keep them away from e.g. online gambling and some other sides. Which brings us back to having a baseline which works without spying on your child but still blocks some things off. I don't see how this is supposed to work without a having a 16+ age category between 13/12+ and 18+.
I guess we can probably agree on the fact that most content should only need the content age rating -> you decide (through parent controls) app direction. The OS --api--> Site/App direction is only really needed to serve a feed of "next" content and some other edge cases you could argue aren't in the best interest of children. But also there are better ways to fix those issues (through other means) IMHO. So I personally still would include it. At least for the age range 16+.
When it comes to 16+ I am not concerned about them at all. Sounds cold, no? But in reality 16 year olds have a network of people in their friend circle that can bypass any restrictions anyone sets on them. In my experience the more money spent trying to isolate them from a perceived harm will just make it more likely their circle/bubble/network of friends have already long since bypassed it sometimes out of spite or just to prove they can.
Case in point, games rated G are what many of them use for watching porn, sharing warez and pirated movies and streaming movies/porn together. This is already a thing in many rated-G games especially but not limited to games that use VR headsets, social games and such. Some of the smaller indie games are how some bypass sanctions, embargoes and more. That is just one of many examples of how teen bypass all perceived restrictions. Some small children will see porn in these games but that is a different problem for a different day.
My focus is entirely on small children and their most common use cases. The 99% problem. Keeping the nastier parts of the internet partitioned from small children is mostly accepted by most parents, is the right time to do it before they such as teens know what they are being locked out of. As the child evolves and develops the parent can decide when it is time to lift parental controls and then sit with the child whilst they explore the nastiest of nastiness together. The parent can answer questions instead of waiting until they are young tweens for their tween friends to incorrectly answer questions and start spreading STD's and/or getting impregnated to learn the hard way. Before someone says it, yes tweens are getting pregnant more often because their bodies are developing earlier now due to chemicals they are being exposed to and they are hitting puberty much earlier, some as young as 8 or 9. Some are getting penetrated as young as 6 or 7 and younger. They need to learn from their parents, not random kids their age or random websites or some GPT.
One simple static RTA header set on a load balancer or accelerator or within server applications is done and dusted. It does not get any easier. A check for that header by the user agent or application on a locked down child account to trigger parental controls is also easy. This was a thing in the early 2000's on MSIE and a few other browsers based on MSIE I think SlimBrowser and a few others. An intern could likely add this check in an afternoon not counting Quality Assurance time. No leaking data via API's, no sharing age or any other identifying attributes. If someone is arguing to gather this data I can not take their ideas in good faith because I have worked along side all the nasty people that want this data and I know they have no ethics and will sell this data with all manor of evil people and evil organizations that would be good bed buddies with Epstein and friends. I am unwavering on this belief. I have whipped this dead horse into micronized dust and will continue long after that micronized dust is broken into Quarks and Leptons.
Does it though? Unless all countries unify their laws regarding this matter it will fail in the same way that blacklist filtering does.
Also I'm not convinced that borrowing a device presents a new or different failure mode. Children could always obtain physical contraband from their friends so nothing has changed here.
it solves the problem of it being too trivial for a 12 year old to access content which at best is quite problematic and at worst outright traumatizing
as in, the same reason we have laws that a clerk glances at the age on you id if you look young and buy alcohol but your parent are still allowed to let you drink with them if they think its right (or what a 16+ movie with them etc. etc.)
this is also why it really shouldn't be anything much more fancy then parent controls checking min age of content locally / indication of age for feed fetching. Everything else is disproportional (unrelated from all the other issue it might have).
Ideally, they'd require OS (desktop and mobile) to have an adult mode and a restricted mode (set up by the adults when they buy the device), and then let third-party apps confirm the status (e.g., age) in the latter case. Then you have minimal privacy issues and many parents actually want something like this.
> “Most households aren't going to have a separate device for every family member…”
They want us to all to have user accounts and login like well behaved workers. So cute. Little Donald can login for hisself, and doesn’t need mommy to do it for him.
Apparently there's been work to expose Meta pushing/funding this, to shift age responsibility from them and force for fine grained age data to be provided to apps.
the law is there because parents are fucking clueless unprincipled whining crybabies, who need a lot of support, and sometimes that includes a bit of pushing ...
or who knows what problem is this supposed to fix. orphans buying phones? kids buying secret phones behind their parents back?
I frequently see comments which would have made sense in the past (e.g. early 2000th) but kinda aren't fully reflecting reality anymore
it's as if humans have a tendency to make up their mind/world view in their younger years and then tend to kinda stick with it/only change it slowly as long as no big live changing events happen
Once you get outside the SV and NYC bubbles, the vast majority of kids do not have their own laptops in the US. Phones, obviously are somewhat more common, but as even you note that's mainly with regard to teenagers - the average 10 year old in middle America does not have their own phone.
Why? Why should Linux ever implement local laws like this as core functionality? Especially invasive/anti-privacy ones.
If someone wants to introduce an age-verification-ca-module, fine, but not make it core. Yes I understand systemd is not the kernel, but its ubiquitous enough.
That just says to every country around the world; Windows, Mac, and even Linux is on board too, let's make it law also!
I dunno, I always expected Linux to be the last bastion of freedom and not to capitulate so easily.
There are still distros without it, I may have to go to one, since I already jumped Win10 to Cachy for the BS MS is pulling. I was going to go systemd-free but Cachy "just worked" compared to the others in terms of setup. So I stuck with it.
Yeah it's one of the reasons I run BSD. I don't want stuff changing that works well. And I don't want big tech suits telling me what's good for me.
BSD is much less invested in chasing the next big thing, and also has much less contributions from big tech. Which for me are both pluses. Of course I respect those who differ but they have Linux.
And when I see what Poettering is working on now with ammutable I'm even more glad I'm not on that train.
Your link's not loading for me, but I can recommend Guix System to anyone looking for a systemd-free distro similar to NixOS. For something Arch-like, there's Void (but beware it is not actually based on Arch, so no AUR or pacman).
> Why? Why should Linux ever implement local laws like this as core functionality? Especially invasive/anti-privacy ones.
1) It's legally required to sell computers with that OS in certain jurisdictions
2) I presume there is at least one person actually selling said
3) The feature is so trivially easy to bypass that it presents no reasonable privacy threat at this time (IIRC, it's just a numeric field with no validation?)
After seeing how easily California bent OS developers (commerical and open source) to comply with their local laws, Canada decides they will go one further. They aren't happy with a simple date field that can be easily fudged. So they pass a law that requires all OS's to continually scan the biometrics of users using the OS. ie. Camera if it has one, fingerprint reader once an hour, voice analysis, etc.
They also refuse to allow computers to be sold in their country unless OS developers comply with their law.
Do you think you'll see such enthusiam to comply? Or will the line be drawn at some point?
That is ok. The writing was on the wall for a while. It is time to let it go. It served its purpose. We might as well start mapping out a way without it in a more serious way out of sheer necessity. I know I am.
Western surveillance tech is superior because it gives you the option to choose your gender on a fluid scale when they're vacuuming your private data, whereas backwards eastern tech limits you to only male or female.
Also most human communication isn't about formal logical reasoning. It's only a fallacy when applied in the form "A therefore B". We can make all sorts of useful and relevant observations about human and societal behavior that aren't logically rigorous.
Yes they can, but claiming a theoretical future event as fact (or inevitable) I would consider particularly fallacious as it's impossible to prove.
And I think history also shows these claims rarely end up happening the way these alarmists think it will.
Usually when a slope appears, regulation steps in, technology evolves, or the culture shifts, rather than society devolving into some inescapable dystopian hellscape.
I don't see what prevents anyone (e.g., a distro maintainer) from patching that anti-feature out of the source or disabling with with root access. As long as people can control the software running on their machines, which is the idea behind Linux, nothing that people don't actually want will stay in the system.
Systemd shouldn't be foisting this nonsense on Linux users however. I suppose the anti-systemd subset of the Linux community was proven right after all, this is the kind of issue that can end up facing when a huge piece of opinionated software like systemd more or less becomes an indispensable part of Linux.
Good on them. Devices shouldn't collect any extraneous data by default other than that needed to fulfill a feature a user consciously selects, and that includes this stupid age verification spyware regimes are pushing.
An adult had to pay for the ISP connection; that's the extent of age verification needed. We shouldn't be demanding adults expose their identities to for-profit entities and surveillance states, so much as mandating for-profit companies make parental controls easier to use, more effective, and stopping them from harvesting data on kids in the first place.
Not every corner of the universe needs to be baby-proofed; we just need to build a society where parents are enabled and supported to be parents, rather than outsourcing such a critical role to strangers and/or devices so they can get back to work.
Fewer and fewer countries. I think none of the countries I've been too where I've purchased a SIM without ID allow that anymore. It is required to try to limit purchase by scam call centers and to enable phone number portability.
Apps requesting an age is not extraneous and there are many legal and safety reasons why an app may collect this information. If the operating system doesn't do it you run into the cookie banner situation where every individual site has to implement a dialog box asking the user instead of there being a standardized way to do it.
Except the cookie banners are also optional, unless you're using third-party services to collect that data. Don't blame the cookie banner, blame the dozens or hundreds of "partners" that site is using to "process" your data, blame the site owner for building such a travesty of a page that they have so many "partners" in the mix harvesting extraneous info unnecessary for basic functionality instead of building a better, cleaner, leaner, targeted service.
So is an app needing the age of the user. That doesn't mean there are not a bunch of people who will collect the information. It's like saying washing your hands before cooking food is optional and that people should blame restaurants for serving food. It's not a serious suggestion. Restaurants will continue with the business model of exchanging food for money and websites will continue with the business model of showing ads. These kinds of businesses will exist forever.
I have! And an adult still has to pay the connection charges to offer that free wi-fi. Or provide the funds for a kid to buy a device to connect to said free wi-fi.
You can go down the rabbit hole as far as you like, but it's to no avail. At some point, an adult has to consciously enable the child to connect to the internet. Full stop.
I agree with the sentiment you're expressing however I think "consciously enable" might be taking it a step too far. Modern devices off no end of unexpected was to gain internet access.
I wonder how things like computers at the library will work. This whole thing is just so stupid and intrusive. I can't imagine anyone will benefit from this except advertisers, doxxers and Big Brother.
Age checks certainly won't be restricted only to porn sites. Tons of sites have 13+ ToS like Facebook & the various other social sites, Discord too iirc. The reason people are so adamantly against this proposal is that it ties the machine to a particular identity. So how does a public computer work? If age verification is implemented at the OS level, can we even have public terminals? All those interfaces in stores that are just a website in kiosk mode? Would they be illegally representing end users if it's set as an adult on a master account/login? This proposal is so stupid and poorly thought out it's alarming.
systemd which was already in hot water over because the problems it creates over service, this was the last drop to get folks dropping systemct altogether.
i wish, but its not easy. So much of the application ecosystem has now been adapted or built around systemd and its other services. While some tools might still work with dbus alternatives, its quite clear that its harder and harder to use linux without it. Gnome is one example where even the dbus replacements wont work anymore. Others will follow; ironically Ubuntu is doing its own thing like usual, using systemd and resolved but not some other parts. However, im not really holding my breath there, as they usually end up adopting the "standard" way; now in the hands of companies like IBM....
I think the only option really at this point is to move over to BSD, but we face other issues like GPU drivers etc. The same people that worry about systemd probably also worry about AI, so if they want to be able to use it, it needs to run locally.
The 3rd option is to move away from general computing, and start building esp32 powered tools, where we can own the fulls stack. Dedicated digital tools for specific purposes. Personally, this sound like the best option, taking into account that we have almost lost the battle for open OS on mobile devices. We need to get away from the giant US corporations for the majority of our computing, and only interact with them when absolutely necessary. A grass roots computing moment basically.
Wasn't most of the hype surrounding the Motorola partnership based on the idea that you'd be able to get a device with GrapheneOS pre-installed, boosting the legitimacy of GrapheneOS as a competitor to Google Android? Sure, "GrapheneOS adds several more supported devices" is cool and all, but it's not nearly as exciting...
No. The bare minimum is that Motorola provides the needed baseline hardware security requirements to their future devices. Everything else is just a bonus. There could be green-boot support and/or preinstalled devices, but thats not a necessity. GOS benefits with an official hardware platform, potentially early partner access to AOSP source code, input on hardware and firmware decisions, and Motorola benefits by potentially having GOS features, better hardware security, and making tons of money from alternate OS users, GOS or otherwise.
If shipping a specific device configuration to the US is illegal, Motorola should not ship this specific device configuration to the US.
I do not think our parent is suggesting otherwise.
AFAIK Motorola and GrapheneOS are not merging, they are getting into a partnership. They do not have to think or do exactly the same.
Apple can comply with both CCP and US demands at the same time without a problem. I am sure Motorola can adjust their services to the markets they are working in, as well.
They are not building a product that cannot be sold in their primary market. They are not designing GrapheneOS devices, they are improving existing devices to meet GOS requirements. There will still be an OEM OS for those devices. Preinstalled GOS devices can simply not be sold there.
Your arguments show a lack of the least imagination, let alone simple reasoning.
There are countless ways to satisfy any regulation while still doing whatever you actually want to do.
The very most obvious is simply sell the device, in the affected areas, with any sort of os that meets the letter of the law in that area.
If it's also easy for the user to install something else once it becomes their property, well that's the new owner's business atthat point, Motorola did their part and complied with everything required.
No one needs to demand a company violate anything. That is just a silly argument to even try to make. Calling people insane for things they never said nor even implied is what's insane.
The typical GOS user generally doesnt want to do that. Flashing is a hurdle that increases barrier for entry. Reducing or eliminating that burden is ideal. Greenboot support would make flashing a little easier.
> typical GOS user generally doesnt want to do that
How do you know this? Is there an official (or even unofficial) source of GOS preinstalled devices that a substantial amount of "typical GOS user" has acquired?
Or maybe you are talking about "potential user of GOS"?
In any case: if you installed it yourself you mostly have to trust the source of the installer. If you purchase a pre-installed device you're basically back to the android/ios model: you have to trust the manufacturer AND the maker of the OS
I have helped a significant number of GOS users install GOS to their device. If you perform post install steps correctly then you do not need to trust where you got it from, as the post install steps are there to verify your install is genuine. If GOS gets greenboot support for motorola devices, then not getting a yellowboot screen will show it is genuine and you wont need to trust anything.
This is emblematic of a misunderstanding technologists often have about the law. We try to treat it like code we can exploit and hack around. But there is no compiler deterministically producing outcomes. Of course, this misunderstanding is often bolstered by the accurate observation that lawyers and businesses find loopholes and favorable interpretations that to us appear much like the exploits we propose. The critical element that's often missed, though, is the human one. To get away with an exploit, to have the case law updated to reflect your favorable interpretation, you need power, influence, and alignment on your interests. There are tax "loopholes" now that are commonly used but in a prior era, under the same laws, would have seen you dragged into court and eviscerated. If you tried your cute SD card trick a judge would tear you a new one. If Microsoft tried it, they could maybe talk to the right people before the case and come to an understanding that this little loophole was convenient for dev devices or something, and convince a judge to rule that they could do it, but only if accompanied by some external age confirmation they could self-attest to, with some wording that makes it clear that the trick is only usable by large and well-respected institutions. The law is not an impartial arbiter that you can outsmart. It's the enforcement mechanism for multiple tiers or rules that bind different classes. This age gathering law is a classic moat law. It exists to prevent outgroups from shipping software that's incompatible with this age communication system, and in a business-to-business context serves to establish obligations between ingroup members. Any other clever interpretation of the law will be discarded regardless of specific wording.
You sound like a teenager fighting his parents. "Technically you didn't say WHICH bed I had to be in by midnight!!!!! I was in A bed, I followed the rules!!!!"
Society (mostly) works because we all agree that laws have intents. The wording is crafted as best as possible, and for the rest we have judges to shutdown lawyers trying to be a moffkalast smart asses.
Call it what you want, I still think that if the, ahem, intent, of a law is to reduce personal freedoms then it should be protested in as many annoying ways as possible. Should at least get some publicity even if it gets struck down.
Virtue signal away. I’m with whatever device and OS purveyors are willing to tell these tyrants to get stuffed.
I haven’t cut over to it completely yet but I think this’ll be the last nail in the coffin for my time as an Apple user. It’s already a loveless marriage , it’s already over, I’m already sleeping with GrapheneOS on the side. it’s asking when I’m going to leave her and it’s always “soon, baby. soon.”
As they should, I was personally surprised so many people were surprised come ICE raids that government can buy and track location via apps, advertising and your phone in general. Regular people need an idea, who is.. uhh.. less likely to sell them down the river.
If we go back a few years and analyze the porn magazines that are sold in a gas station, it's not up to the magazine to ensure that the "reader" has the legal age.
So we delegated the responsibility twice, first the gas station attendant must check the age of the buyer and then, the buyer should check the age of any reader.
So now, who's the "gas station attendant" in our situation?
Why would you want every site on the internet to traffic in government IDs? This is by far the least bad out of all possible ways to implement age checking. The benefit of this is that it can short-circuit support for more onerous age verification. The writing has been on the wall for some time now: the era of completely unrestricted internet is coming to an end. The question is how awful will the new normal be? This implementation is a win all around, a complete nothingburger. We should be celebrating it, not fighting it tooth and nail.
The tech crowds utter derangement over this minor mandate is truly a sight to behold.
> This is by far the least bad out of all possible ways to implement age checking.
Not quite. The least bad (that I'm aware of) is to mandate RTA headers (or an equivalent more comprehensive self categorization system) and to also mandate that major platforms (presumably OS and browsers, based on MAU or some such) implement support for filtering on those headers.
But sending a binned age as per the California law is the next best thing to that.
I think that malicious compliance all the way might have been the better option here. If a birth date is all that is needed, let the user enter a random one. If actual biometric verification is needed alongside, let the user also paste the code to a fake biometric validator that always returns valid.
It is the same philosophy as with an app that forcibly wants an invasive permission to the detriment of the user. Let the app have the permission while in a sandbox so it sees nothing.
Giving in in any capacity is unacceptable. The GrapheneOS foundation is based in Canada and is not obligated to record this information, so they wont. They have no reason to comply, be it malicious or otherwise.
Agreed. This is one of those moments you might as well simply say no. For practical reasons too, your users do have options and tend to be the kind that will drop a distribution if it goes rogue.
People who live in authoritarian states like North Korea or California can (and arguably should) ignore the fact that GrapheneOS is illegal where they live and use it anyway.
If you want a privacy-violating OS, there are already two big options on the market. A secure OS for people who do not live in authoritarian surveillance states offers a benefit to some people, even if not all people. A third privacy-violating OS offers no value to anyone anywhere in the world.
You'd need to closely read the law and have a lawyer advise you, but a neat attempt might be to just ask for the date of birth, send that "in real time" to the App Store program, and then have that program simply discard it?
I don't think current iterations of the law require that this be sent off-device in any way.
The second requirement of the California law is that there be an API available to all apps that returns the age band a user is in -- one of:
age < 13
age >= 13 && age < 16
age >= 16 && age < 18
age >= 18
A non-maliciously compliant implementation would need to retain a date of birth or equivalent until the user was over 18.
A maliciously compliant API could just wait 18 years after account creation before yielding an answer. (remember folks: "real time" does not mean "fast").
One of the oddities about the way the law is phrased is that it requires the age band information about the user be provided to "the developer" rather than to the application.
> One of the oddities about the way the law is phrased is that it requires the age band information about the user be provided to "the developer" rather than to the application.
So, expose it via a Unix socket only accessible to the account named "developer"?
so... just sell a phone with a script prompts the user to install the OS, and it auto-verifies hashes, can't be bypassed, etc. Is that too simplistic a solution?
I highly doubt that would work but there could be, say, a card in the box with the link to the webinstaller and the webinstaller can be made even easier.
That depends on what kind of law you view this as. As a parental control like the V-chip (but hopefully with a higher percent of parents using it) it's nothing new.
It's not new but that was a dumb and irrelevant technology too. And didn't last for that reason (easily bypassed, not working with modern tech). Just like the clipper chip that was supposed to spy on us.
Not just "could be used in one", but age verification is the raison d'être for the introduction and existence of these fields. Not sure why some people pretend otherwise when it is obvious.
Do you think parental controls requirements are generally a fraud, or if it's just this law what makes it special?
I don't think the California law makes it easier in any meaningful way to pass age verification laws, considering how many age verification laws have already passed. I see it as something that has real uses by itself and also can get many apps/sites that would have done US-wide age verification to trust the setting instead.
I know it's gonna be a very unpopular opinion. I do like, appreciate, respect & admire that they are ready to die on a hill. I just don't think it's the right hill. I do not have an issue with the legality of it. Rather I think age verification is actually not bad. Sure i see the potential danger. But there is potential benefits, that'd counter the danger, by a lot.
In different times, i might have argued differently. I'm not saying it's not worth protecting the world you deem worthy of protection. But no matter what that world is to any of you. The one we all share is changing for sure. Uncontrollably fast. And many things are gonna change. And many things won't matter that much anymore, if we actually end up going where we're headed.
I mean a this is just a super small part of it all, but i assume in this specific case, for graphene, it's a battle for privacy... and they're right. But we're still going into a future where we got 5,10,20,30 more years of "AI", even just keeping the same level of overall sophistication for most, but costs decreasing immensely... I don't know about you, but I don't think the ways we protect our privacy can be unaffected, already because we're going to learn all new aspects about which data is private. Just out of practicality. Extreme example: but if generating hundreds of obscene deepfakes of any person as easily as taking a photo with your iPhone... ah, i can't keep having this discussion, i hope i am just an insane moron who is wrong. But, just to be sure: instead of arguing if we should close the windows on the train that's burning, or leave them open, as some are smart and others need help, let's just get off the fucking train.
And yes of course. One might argue (I actually would), we should not start implementing laws like that or start making personal information a requirement to digital access.
But this might be the first step to a different future, or not. As i said, who cares where the train is headed. It's burning and nobody even really wants to be on it. Let's please get off the train.
Not saying the battle is lost. I have tried working on something because I still have great hope. But someone seriously must act. I tried, getting off the train. Or at least start standing up from my seat. Realizing it's not that easy to get off. It's embarrassing, but i can't even get off the train by myself... i tried anyway... but here i am, sitting again (currently on the floor, lost my seat, damn...)... i have been building something for the past 2 years. Well, trying to build something, an attempt to change course... ruining my life over it. And currently i failed, before i even got to a point where my prototype or any of the theoretical work even remotely represents the vision. But maybe i just learned, i was wrong about all of it. I hope i'll make it back being able to afford working on it and someday a way to make enough money to pay smarter people than me to join. But currently, it's insane for me for me to even dare dreaming about that. I have really dug myself a hole. Next time, it should at least be a hill...
So in the meantime: can people like the dudes & dudiñas from graphene please chose a wiser battle. If just some of all these people got together & worked on getting off the train, instead of working on things that seem meaningful now, but wouldn't even be considered worthy of being mentioned in the future... we'd have a shot.
Damn. I still just can't accept it, even though i've literally lost everything believing that. And i am ashamed so deeply believing in what i saw, and in friendly moments still see, as a future... thinking i could change it, without changing myself... but please god, in the end, let me not have been just bonkers, but convicted.
I appreciate the thought, but I personally disagree having seen the patterns of the past 2-3 decades. There is zero real benefit to it save powers that be. Honestly, the only reasonable move forward is non-compliance. Everything else results in steady inching towards full blown panopticon ( and some would argue that we are already there ).
GOS is not going to compromise on user privacy and security. This is not a technical problem, it is a social one where parents refuse to do what they should have done from the start. The internet is not for kids. Presuming users to be guilty until proven innocent is unacceptable. Making mechanisms to obtain user data, even if it is completely and perfectly functional and achieves what it sets out to do, risks malicious parties obtaining that information. The only way to win the game is not to play, to not ever provide that data, and children shouldnt be playing the gane in the first place.
That raises the issues that GrapheneOS needs to solve, which may require more creativity than bold, somtimes combative statements.
If GrapheneOS doesn't comply with laws and regulations then they will sometimes be banned or restricted. If that happens, they may not be "usable by anyone around the world" for long.
That doesn't mean they have to capitulate or sacrifice security. They can find creative solutions, some of which are suggested here. The first step is to carefully read the spec to determine what is necessary, then talk to someone like the EFF, and find a way forward.
Better would have been a statement "If GrapheneOS devices can't be LEGALLY sold in a region due to their regulations, so be it." . I hope that is what they meant, leaving open the possibility they'll have a secret drone delivery squadron bringing GrapheneOS phones in to Brazil and other equivalent places.
Also it would be nice if, where Graphene has partnered with hardware manufacturers, then said hardware sellers could issue a statement like "$Manufacturer promises that in regions where GrapheneOS is illegal we'll leave the bootloader unlocked, if users choose to break local legislation then that is on them" and furthermore a statement like "$Manufacturer fully swears on all honour possible that in any regions which ban unlocked bootloader devices then, oops, we found that if you short pins 3 and 8 of the third chip on the left together at any time during booting you'll permanently unlock the bootloader and absolutely nobody is allowed to know that. Which is why we've posted this on every social media channel. Afterall, all our users need to know that they're not allowed to know that the bootloader can be unlocked by shorting pins 3 and 8 (third chip on the left) with anything less than 20 ohms (nobody must know that a paperclip would do for this)".
Age verification is stupid, parents the actual parents need to look after their kids and what they're doing on the computer. If I hadn't been able to sit down at my Atari 800 computer with 48 KB ram, as I pleased after school everyday since the second grade, I wouldn't be the person I am today I wouldn't know as much about computers and I would not be a tech savvy person at all. These age verification measures are strong handed nanny type rules and laws that have no place in the household, it is not the government's job to raise children it's the parent's job. You're going to raise a whole generation of dummies.
Age verification at the OS level makes no sense to me. Most households aren't going to have a separate device for every family member and so you will end up with a tablet or computer set up by one of the parents (and thus having their age stored) that will be used by both parents and children. Likewise, people generally won't create a separate account for every potential user.
> Age verification at the OS level makes no sense to me.
it's the only form of "age verification" which can be done in a somewhat privacy respecting way (as in at most leak the age)
the idea is to "bounce back" the "is old enough" decision to parent controls and let the parent choose (the Californian law doesn't quite do that perfectly, but goes into that direction)
and if you sell what is more or less a general purpose compute/internet access device with OS (which I do include phones into) I think it's very reasonable to either sell it to adults only (with a disclaimer it's "not for children") or include proper parent controls
> Most households aren't going to have a separate device for every family member
in current times in the west it is very very common for many devices to be for one person only. Especially phones, or at least have different (OS) accounts.
but again this comes back to "parent controls", weather that is for a child (OS) account or a way to switch from a child profile to a adult profile doesn't matter
but in the end, the point of such laws should be to give parents tools to parent. As well as handling the case of parent acting in neglect by inaction. But if a parent intentional decides to give their children a device with their profile because they think it's fine than that should be their choice and responsibility.
> Likewise, people generally won't create a separate account for every potential user.
where it was possible I have not seen it not used, weather it's on a switch, gaming console or PC. It is the most convenient way of automatically separates logins, browsing history, game safes etc.
and the law als isn't made for that shared computer in the living room (through it will apply there). It's more about the devices children might use unsupervised, e.g. their phone.
That's why Meta paid for these os-based age identification laws[1], shifting the responsibility from itself onto the app stores. I agree it's probably preferable to do it on device instead of every website implementing an id check through shady as fuck[2] third parties like Persona. This whole thing is just such a mess though, people rightfully distrust everybody involved, all these bought and paid-for politicians. All of a sudden we have the same laws popping up all over the place, US, UK, Australia, Brazil, ... Nobody, not a single person involved gives a fuck about child safety. It's different billion dollar lobbies fighting amongst each other, each with different monetary incentives.
You know what they should do? They should scrap it all, no more "child safety" laws until we kicked money out of politics. Western liberal democracy is in a corruption and legitimacy crisis, this is just it's latest symptom.
[1] https://www.yahoo.com/news/articles/reddit-user-uncovers-beh...
[2] https://cybernews.com/privacy/persona-leak-exposes-global-su...
> They should scrap it all, no more "child safety" laws until we kicked money out of politics.
the current state has been close to that, and is co-associated to be a related to many existing issues wrt. to children/mental health/child safety (I very intentionally use co-associated instead of correlated, and definitely not root cause)
you could say law makers of many countries have given the industry ~30 years time to self regulate and come up with something acceptable by themself
The industry didn't. Now they have to regulate, it's their job and responsibility to do so :(
(but it's also their responsibility to not listen to highly malicious/biased lobbyist trying to hijack it into surveillance laws!)
honestly to some degree the industry still has a short time frame to fix it themself, provide an acceptable solution which can mostly work internationally (by having localization in it) and pitch that to the EU and US states not having yet decided on age verification laws, so that the few which already have some bad laws are pressured to change course
Through the problem is many non-cooperate entities instead insist it's all nonsense and there is no problem and companies like G, MS, Meta etc. have little interest fixing the situation. A misguided, hard to implement age verification law creates a legal moat to hinder smaller competing companies...
we have seen the same with the EU AI act, it's general outline is very reasonable especially if base that assessment on the corner comments. But thanks to big tech lobbyist hijacking it it became a economical/regulatory moat catastrophe (in the details and the parts which have not yet taking effect, not in every aspect).
Or just not have it at all? What is wrong with parental controls AND parenting? What real issue does this solve?
What is wrong with parental controls AND parenting?
Nothing. This has never been about protection of children. It is tracking real identity from every source to every destination otherwise known as user-tracking. If this was about protecting children they would require an RTA header on all adult and user-generated content sites and require the most common user agents to look for that header if parental controls are enabled. No tracking, no uploading anything. [1] Sufficient for small children which is more than we have now or will ever have thanks to corporate greed and lobbying.
[1] - https://news.ycombinator.com/item?id=46152074
> It is tracking real identity from every source to every destination otherwise known as user-tracking.
except this is not true at all
yes there are people which try to systematically hijack child protection laws all the time for stuff like that
but e.g. the californium law is very clearly intended to avoid exactly that (that= tracking real identity)
> they would require an RTA header
they are politicians focused on law making, they have no idea what an "header" even is!
A politicians job is to identify issues consult people with expertise, propose a solution based on this people feedback and then listen to feedback, including from other groups. If they need to know what an HTTP header is and how that works something went really wrong.
But this is also where things often do go wrong, by a) dishonest and outright malicious consulting telling politicians bullshit, b) politicians having a over the top simplified understanding of a topic and think that it's still suited for extrapolating things from it leading them to nonsensical outcomes.
And if then large part of the industry which do care about non abusive solutions loudly refuses to provide any solution and denounce anyone trying to do so you are basically opening even more doors for anyone with malicious intentions. Which is pretty much the situation we have now.
Even worse not only do many people in the tech/hacker community not only not try to help with finding an acceptable solution they often outright reject that there is even a problem.
But there is a problem, a huge one even.
As just one dump example of many: it's currently harder for a teenager to get access to some wholesome soft porn then it is to watch potentially traumatizing and definitely not healthy content (weather it's violence, or certain forms of hard core porn(1)), or access sites/apps with gambling, prying on children, hate mongering, glorification of mobbing etc. etc.
And lets not forget most parents are non technical people, which means most of the reasonable usable and privacy protecting existing tools are not actually usable by them (and not available by default, and they can't reasonable evaluate which ones are okay either).
Also please don't say I grew up with a uncontrolled internet (~25-35y) and I am fine. Putting aside that the internet was very different back then. But also hardly anyone in that age range is truly mentally fine (for a lot of reasons, but that anyway makes it a pretty bad argument).
> RTA header
is insufficient, age isn't just 18+ or 13+. Through many media sites love to pretend that is the case
Furthermore this doesn't work for "feed" content as the server needs to know what to filter one before returning content.
But this is also the direction I have proposed in previous comments and not that far away from the direction the Californian law went to (but very much different to the UK law):
- provide a min. age category indicator for all content (most times by app, sometimes per-content in that app, sometimes per-origin per-content in that app (e.g. YT accessed through the browser). But this needs to be more complicated then 13+,18+ as categories differ by country and you should include tags and some other stuff.
- A parent control API which has a simple/naive default impl. but can be replaced with whatever parent think is right.
- A API to get the users age category (incl. localization, e.g. `us:13`). It needs explicit permissions and providers are not allowed to force it, every contents min-age-constraints still have to go through the parent control app. It's only for selecting content feed/preview. The specific content served might still be rejected by the parent controls! Using it for anything else should be made criminal illegal with personal liabilities for executives. (e.g. using it to try to sniff the exact age date of a person). A implementation which just serves `us:18` but then refused anything >13+ or similar must be treated as a legit possibility, the app must still work in general, but it might not have any further previews. Etc. Etc.
- The trust of age hints/evaluation is anchored solely in the parent controls, the setup of the parent controls is the parents responsibility. Any form of identification(2), AI face scans or similar as a requirement for setting up parent controls/not having a permanent 13+ account or similar _is strictly outlawed_.
- All sold products with preinstalled OS must have a default parent control app which is trivially to setup up in it's default setup and the default setup must only reqiore 1. localization (preset to current country if known, changeable), 2. age to auto adapt the age group where alternative the parent can set the age group, even through that means they have to change it in the future manually (needed for special care children). It also in it's default setup must not track/spy on everything the child does.
- Adult accounts still need compatibility with the APIs but will always provide 18+/yes content allowed.
- Products and e.g. downloadable OSes can decide to be "adult only", in which case their access must be guarded like any other adult only content (e.g. when you buy it) but in which case they don't need to support child accounts and can instead return hard coded 18+/yes content allowed.
(This is already the short(er) version :/, e.g. most countries have a 18-21 category, for many countries that category is only irrelevant for things anyway involving a identification (e.g. signing certain contracts, doing certain jobs), but e.g. the US relation to alcohol is an exception).)
---------
(1): And I don't mean just a bit of soft bondage, but things which will lead to serious health issues long term and/or involve violence, glorification of violence, suppression, misogyn, implications of torture, rape, child abuse or in case of drawn/generated content non-implications and even snuff.
(2): There can be some acceptable ways, e.g. a clerk checking your ID IRL, without recording anything except yes/no. Digital ID setups which only communicate adult yes/no without identification etc. But given that all relevant devices tend to be too expensive for children to buy them themself and you also should trust your child if it approaches adulthood (and might have the money) I don't think anything like that is really needed. In general this should focus on efficient solutions for age group <16. IMHO if you still need parent controls for 16+ you messed up parenting.
A API to get the users age category (incl. localization, e.g. `us:13`). It needs explicit permissions and providers are not allowed to force it,
An API actually means that more and more details about the user will inevitably be added with time. This is a user-trackers dream come true. No thanks. One static header, done and dusted.
But this needs to be more complicated then 13+,18+
I will never agree with this nor will most people. Content is either adult or not adult. That is how existing parental laws are structured in most countries. The parent must decide if the child is ready to view content that is rated anything other than "G". The parent decides, not some app, not some API.
A child account on a tablet, phone, laptop need only prevent tampering with browser settings and by default enable parental controls which in turn simply look for an RTA header or any other indicators that the site or content is adult or user-generated in nature. Keep it simple. If people wont enable looking for a header then the only reason they would go far further and screw with an API would be if it were to the benefit of evil. (marketing, sales, manipulation of the child, manipulation of the parent).
> An API actually means that more and more details about the user will inevitably be added with time.
with that logic you could also argue a computer means more APIs will be added over time
especially if it's a law mandated API which doesn't allow any additional thing this really isn't a problem
> I will never agree with this nor will most people
except overall (at least outside no HN bubble) most people would disagree with you, actually the huge majority of parents and children affected by that would disagree
Treating a 16 year old like they are 13 is just completely absurd.
Expecting parent to make decisions about every single peace of content (website, YT, video) their child, even if older, watches without providing any guidance and defaults is not practical at all and due to that is guaranteed to fail.
To be frank you comment is completely quixotic, lacking any relation to the reality most parents live in today.
Random person jumping in to say, the original comment from 'Bender' is what is agreed with by almost every human I've spoken to. It is most definitely the take of every parent in my social circle, the vast majority of whom are outside of the tech space.
The issue you're describing is strictly one of parenting, and not one that can or should be handled via some government agency. Their (Bender's) suggestion is actually the best that I've seen for handling this issue, and the only one I believe those I know would all happily agree with.
On a side note, this entire comment of yours is very unhinged. I'd wager you're far far far from being aware of the 'reality most parents live in today', based off of what you've said here.
EDIT: Thinking about it more I _guess_ we are more misunderstanding each other then we are fundamentally disagreeing (through I guess we still are disagreeing :) )
---
> I'd wager you're far far far from being aware of the 'reality most parents live in today',
I'm not (EDIT: As in I have enough parents in my live, through there may be larger cultural differences.)
and it's beyond my understanding how anyone can think treating a 13 and a 16 year one alike is a reasonable solution
similar all the things I have proposed gives parents the tooling needed
you make it sound like having an app fully controlled and replaceable by the parents is somehow removing power/choice from them. But nothing in it excludes parents from allowing or disallowing children to watch content from other age categories, potentially on a peace by peace basis
what it does is take the IRL system which isn't perfect but works reasonable good from how we e.g. handle the sale of movies and applies it to the digital world
including the option to ignore it
but we also have to recognize the reality that not all parents bother to even try to properly parent, and others are stressed, overworked and struggle. So having a triviale setup once and get some somewhat reasonable baseline solution is important (and yes it shouldn't be important, but IRL it is anyway)
similar I think it's important to realize that not just 18+ content can be harmful a barely not 18+ horror movie can still be quite traumatizing for some 13 year old. At the same time when children become 16+ you should have build a relation of trust with them where they shouldn't need to tell you or ask you for permission for everything not appropriate for 13 year olds on the internet. But while trust is grate you still would want to do more than that to keep them away from e.g. online gambling and some other sides. Which brings us back to having a baseline which works without spying on your child but still blocks some things off. I don't see how this is supposed to work without a having a 16+ age category between 13/12+ and 18+.
I guess we can probably agree on the fact that most content should only need the content age rating -> you decide (through parent controls) app direction. The OS --api--> Site/App direction is only really needed to serve a feed of "next" content and some other edge cases you could argue aren't in the best interest of children. But also there are better ways to fix those issues (through other means) IMHO. So I personally still would include it. At least for the age range 16+.
When it comes to 16+ I am not concerned about them at all. Sounds cold, no? But in reality 16 year olds have a network of people in their friend circle that can bypass any restrictions anyone sets on them. In my experience the more money spent trying to isolate them from a perceived harm will just make it more likely their circle/bubble/network of friends have already long since bypassed it sometimes out of spite or just to prove they can.
Case in point, games rated G are what many of them use for watching porn, sharing warez and pirated movies and streaming movies/porn together. This is already a thing in many rated-G games especially but not limited to games that use VR headsets, social games and such. Some of the smaller indie games are how some bypass sanctions, embargoes and more. That is just one of many examples of how teen bypass all perceived restrictions. Some small children will see porn in these games but that is a different problem for a different day.
My focus is entirely on small children and their most common use cases. The 99% problem. Keeping the nastier parts of the internet partitioned from small children is mostly accepted by most parents, is the right time to do it before they such as teens know what they are being locked out of. As the child evolves and develops the parent can decide when it is time to lift parental controls and then sit with the child whilst they explore the nastiest of nastiness together. The parent can answer questions instead of waiting until they are young tweens for their tween friends to incorrectly answer questions and start spreading STD's and/or getting impregnated to learn the hard way. Before someone says it, yes tweens are getting pregnant more often because their bodies are developing earlier now due to chemicals they are being exposed to and they are hitting puberty much earlier, some as young as 8 or 9. Some are getting penetrated as young as 6 or 7 and younger. They need to learn from their parents, not random kids their age or random websites or some GPT.
One simple static RTA header set on a load balancer or accelerator or within server applications is done and dusted. It does not get any easier. A check for that header by the user agent or application on a locked down child account to trigger parental controls is also easy. This was a thing in the early 2000's on MSIE and a few other browsers based on MSIE I think SlimBrowser and a few others. An intern could likely add this check in an afternoon not counting Quality Assurance time. No leaking data via API's, no sharing age or any other identifying attributes. If someone is arguing to gather this data I can not take their ideas in good faith because I have worked along side all the nasty people that want this data and I know they have no ethics and will sell this data with all manor of evil people and evil organizations that would be good bed buddies with Epstein and friends. I am unwavering on this belief. I have whipped this dead horse into micronized dust and will continue long after that micronized dust is broken into Quarks and Leptons.
> Or just not have it at all? What is wrong with parental controls AND parenting?
It doesn't hand over control of computing to governments
It solves the problem of your kid borrowing a phone from another kid at school.
Does it though? Unless all countries unify their laws regarding this matter it will fail in the same way that blacklist filtering does.
Also I'm not convinced that borrowing a device presents a new or different failure mode. Children could always obtain physical contraband from their friends so nothing has changed here.
no it doesn't
also doesn't need to IMHO
it solves the problem of it being too trivial for a 12 year old to access content which at best is quite problematic and at worst outright traumatizing
as in, the same reason we have laws that a clerk glances at the age on you id if you look young and buy alcohol but your parent are still allowed to let you drink with them if they think its right (or what a 16+ movie with them etc. etc.)
this is also why it really shouldn't be anything much more fancy then parent controls checking min age of content locally / indication of age for feed fetching. Everything else is disproportional (unrelated from all the other issue it might have).
Ideally, they'd require OS (desktop and mobile) to have an adult mode and a restricted mode (set up by the adults when they buy the device), and then let third-party apps confirm the status (e.g., age) in the latter case. Then you have minimal privacy issues and many parents actually want something like this.
yes pretty much
> it's the only form of "age verification" which can be done in a somewhat privacy respecting way (as in at most leak the age)
could. But Google, Microsoft and Meta do not want to do it this way. They want to sell your personal data, the more, the better.
> “Most households aren't going to have a separate device for every family member…”
They want us to all to have user accounts and login like well behaved workers. So cute. Little Donald can login for hisself, and doesn’t need mommy to do it for him.
Apparently there's been work to expose Meta pushing/funding this, to shift age responsibility from them and force for fine grained age data to be provided to apps.
> Age verification at the OS level makes no sense to me
If taken at face value, sure.
The goal of those age verification laws are not age verification.
Every semi competent os has suppoert for multiple users
What are you talking about, most households give personal phones to their children, especially teenagers.
Laptops aren't rare either.
Give the kid a device that is age-controlled. No need for all devices to support it.
the law is there because parents are fucking clueless unprincipled whining crybabies, who need a lot of support, and sometimes that includes a bit of pushing ...
or who knows what problem is this supposed to fix. orphans buying phones? kids buying secret phones behind their parents back?
I suspect there’s quite a difference between what most people do and what most HN commenters do.
I frequently see comments which would have made sense in the past (e.g. early 2000th) but kinda aren't fully reflecting reality anymore
it's as if humans have a tendency to make up their mind/world view in their younger years and then tend to kinda stick with it/only change it slowly as long as no big live changing events happen
Most CA households may be, but obviously not everywhere
Once you get outside the SV and NYC bubbles, the vast majority of kids do not have their own laptops in the US. Phones, obviously are somewhat more common, but as even you note that's mainly with regard to teenagers - the average 10 year old in middle America does not have their own phone.
Most of these kids have their own tablets though:
> By 2 years old, 4 in 10 children have their own tablet (40%), and by 4 years old, more than half of children (58%) do.
Tablet ownership rises to 68% at age 8.
https://www.commonsensemedia.org/sites/default/files/researc...
In the meantime systemd already added handling for Age to the system bus. Next step is to add your race, then income, then who you voted for...
Why? Why should Linux ever implement local laws like this as core functionality? Especially invasive/anti-privacy ones.
If someone wants to introduce an age-verification-ca-module, fine, but not make it core. Yes I understand systemd is not the kernel, but its ubiquitous enough.
That just says to every country around the world; Windows, Mac, and even Linux is on board too, let's make it law also!
I dunno, I always expected Linux to be the last bastion of freedom and not to capitulate so easily.
Systemd has always rubbed me the wrong way, and its uptake across all the base distros turns me off, but at least...
https://nosystemd.org/
There are still distros without it, I may have to go to one, since I already jumped Win10 to Cachy for the BS MS is pulling. I was going to go systemd-free but Cachy "just worked" compared to the others in terms of setup. So I stuck with it.
I wish Lennart would just stop already.
Yeah it's one of the reasons I run BSD. I don't want stuff changing that works well. And I don't want big tech suits telling me what's good for me.
BSD is much less invested in chasing the next big thing, and also has much less contributions from big tech. Which for me are both pluses. Of course I respect those who differ but they have Linux.
And when I see what Poettering is working on now with ammutable I'm even more glad I'm not on that train.
Your link's not loading for me, but I can recommend Guix System to anyone looking for a systemd-free distro similar to NixOS. For something Arch-like, there's Void (but beware it is not actually based on Arch, so no AUR or pacman).
> Why? Why should Linux ever implement local laws like this as core functionality? Especially invasive/anti-privacy ones.
1) It's legally required to sell computers with that OS in certain jurisdictions
2) I presume there is at least one person actually selling said
3) The feature is so trivially easy to bypass that it presents no reasonable privacy threat at this time (IIRC, it's just a numeric field with no validation?)
Lets up the ante.
After seeing how easily California bent OS developers (commerical and open source) to comply with their local laws, Canada decides they will go one further. They aren't happy with a simple date field that can be easily fudged. So they pass a law that requires all OS's to continually scan the biometrics of users using the OS. ie. Camera if it has one, fingerprint reader once an hour, voice analysis, etc.
They also refuse to allow computers to be sold in their country unless OS developers comply with their law.
Do you think you'll see such enthusiam to comply? Or will the line be drawn at some point?
> Why? Why should Linux ever implement local laws like this as core functionality?
I have no idea.
But they did actually bend over.
> Why?
it's maintained by companies
they have to comply with law
that they are mostly US companies doesn't exactly help either
Finally we can set the evil bit correctly on a kernel level.
That is ok. The writing was on the wall for a while. It is time to let it go. It served its purpose. We might as well start mapping out a way without it in a more serious way out of sheer necessity. I know I am.
[dead]
Western tech direction in the last 5 years:
https://www.youtube.com/watch?v=nXL-r8deB5o
If you think that's bad, just wait till you see eastern tech.
That's an interesting topic. Please, elaborate.
Western surveillance tech is superior because it gives you the option to choose your gender on a fluid scale when they're vacuuming your private data, whereas backwards eastern tech limits you to only male or female.
What about not asking for gender when gender is completely irrelevant to the thing that the user is trying to do?
But how would the government know who's writing mean comments against them online without detailed surveillance?
Nit: introducing a user account field is not the same as the system bus. It’s in ~/.identity and might be absent altogether.
to clear up a misconception for everyone, systemd doesn't do age verification. it just lets you set age restrictions on accounts. It's very sensible.
And for some distros, it’s a CoC violation to question it.
> Next step is to add your race, then income, then who you voted for
https://en.wikipedia.org/wiki/Slippery_slope
A guess for what's next is not a slippery slope argument, let alone a fallacy.
It was not phrased as a guess though, but as a "fact" that cannot be proven
From your link:
> non-fallacious forms of the argument can also exist.[7]: 273–311
Also most human communication isn't about formal logical reasoning. It's only a fallacy when applied in the form "A therefore B". We can make all sorts of useful and relevant observations about human and societal behavior that aren't logically rigorous.
Yes they can, but claiming a theoretical future event as fact (or inevitable) I would consider particularly fallacious as it's impossible to prove.
And I think history also shows these claims rarely end up happening the way these alarmists think it will.
Usually when a slope appears, regulation steps in, technology evolves, or the culture shifts, rather than society devolving into some inescapable dystopian hellscape.
Google has been following the trend of locking down Android for a decade. The slippery slope is a fact here.
I don't see what prevents anyone (e.g., a distro maintainer) from patching that anti-feature out of the source or disabling with with root access. As long as people can control the software running on their machines, which is the idea behind Linux, nothing that people don't actually want will stay in the system.
Systemd shouldn't be foisting this nonsense on Linux users however. I suppose the anti-systemd subset of the Linux community was proven right after all, this is the kind of issue that can end up facing when a huge piece of opinionated software like systemd more or less becomes an indispensable part of Linux.
it was reverted ?
Someone tried to gaslight the maintainers into reverting it and was rejected.
Good on them. Devices shouldn't collect any extraneous data by default other than that needed to fulfill a feature a user consciously selects, and that includes this stupid age verification spyware regimes are pushing.
An adult had to pay for the ISP connection; that's the extent of age verification needed. We shouldn't be demanding adults expose their identities to for-profit entities and surveillance states, so much as mandating for-profit companies make parental controls easier to use, more effective, and stopping them from harvesting data on kids in the first place.
Not every corner of the universe needs to be baby-proofed; we just need to build a society where parents are enabled and supported to be parents, rather than outsourcing such a critical role to strangers and/or devices so they can get back to work.
> An adult had to pay for the ISP connection
In many countries, it is still possible to buy a prepaid SIM without any ID.
Fewer and fewer countries. I think none of the countries I've been too where I've purchased a SIM without ID allow that anymore. It is required to try to limit purchase by scam call centers and to enable phone number portability.
And if such a country wants to keep kids off of the unrestricted internet they should just ban that practice.
And HN would complain even more about the loss of privacy.
So, they can change that if they want.
Apps requesting an age is not extraneous and there are many legal and safety reasons why an app may collect this information. If the operating system doesn't do it you run into the cookie banner situation where every individual site has to implement a dialog box asking the user instead of there being a standardized way to do it.
I'll bite: what's the safety reason for an app to ask for age verification?
What kind of apps do you people use that are so dangerous? Does the computer zap you if you misuse the app or what?
For example an app may want to disable chat or private messages with other people if the user is a kid.
Except the cookie banners are also optional, unless you're using third-party services to collect that data. Don't blame the cookie banner, blame the dozens or hundreds of "partners" that site is using to "process" your data, blame the site owner for building such a travesty of a page that they have so many "partners" in the mix harvesting extraneous info unnecessary for basic functionality instead of building a better, cleaner, leaner, targeted service.
So is an app needing the age of the user. That doesn't mean there are not a bunch of people who will collect the information. It's like saying washing your hands before cooking food is optional and that people should blame restaurants for serving food. It's not a serious suggestion. Restaurants will continue with the business model of exchanging food for money and websites will continue with the business model of showing ads. These kinds of businesses will exist forever.
> An adult had to pay for the ISP connection
Ever heard of free wifi?
I have! And an adult still has to pay the connection charges to offer that free wi-fi. Or provide the funds for a kid to buy a device to connect to said free wi-fi.
You can go down the rabbit hole as far as you like, but it's to no avail. At some point, an adult has to consciously enable the child to connect to the internet. Full stop.
I agree with the sentiment you're expressing however I think "consciously enable" might be taking it a step too far. Modern devices off no end of unexpected was to gain internet access.
GrapheneOS also posted about it on their Mastodon / Fediverse account: https://grapheneos.social/@GrapheneOS/116261301913660830
I wonder how things like computers at the library will work. This whole thing is just so stupid and intrusive. I can't imagine anyone will benefit from this except advertisers, doxxers and Big Brother.
You're not really going to be watching porn at the library though, just saying
Age checks certainly won't be restricted only to porn sites. Tons of sites have 13+ ToS like Facebook & the various other social sites, Discord too iirc. The reason people are so adamantly against this proposal is that it ties the machine to a particular identity. So how does a public computer work? If age verification is implemented at the OS level, can we even have public terminals? All those interfaces in stores that are just a website in kiosk mode? Would they be illegally representing end users if it's set as an adult on a master account/login? This proposal is so stupid and poorly thought out it's alarming.
In fact, many libraries have computers sectioned off in semi-private areas exactly for this reason...
Are you sure that's a library?
I mean we have places here like that where you can insert some coins for a private viewing cabin but we don't call them libraries :)
We expected no less from GOS project.
systemd which was already in hot water over because the problems it creates over service, this was the last drop to get folks dropping systemct altogether.
i wish, but its not easy. So much of the application ecosystem has now been adapted or built around systemd and its other services. While some tools might still work with dbus alternatives, its quite clear that its harder and harder to use linux without it. Gnome is one example where even the dbus replacements wont work anymore. Others will follow; ironically Ubuntu is doing its own thing like usual, using systemd and resolved but not some other parts. However, im not really holding my breath there, as they usually end up adopting the "standard" way; now in the hands of companies like IBM....
I think the only option really at this point is to move over to BSD, but we face other issues like GPU drivers etc. The same people that worry about systemd probably also worry about AI, so if they want to be able to use it, it needs to run locally.
The 3rd option is to move away from general computing, and start building esp32 powered tools, where we can own the fulls stack. Dedicated digital tools for specific purposes. Personally, this sound like the best option, taking into account that we have almost lost the battle for open OS on mobile devices. We need to get away from the giant US corporations for the majority of our computing, and only interact with them when absolutely necessary. A grass roots computing moment basically.
This is absolutely the right stance to take against such stupid mandates.
How's that gonna pan out with Motorola?
Motorola likely wont sell devices with GOS preinstalled in those regions.
Wasn't most of the hype surrounding the Motorola partnership based on the idea that you'd be able to get a device with GrapheneOS pre-installed, boosting the legitimacy of GrapheneOS as a competitor to Google Android? Sure, "GrapheneOS adds several more supported devices" is cool and all, but it's not nearly as exciting...
No. The bare minimum is that Motorola provides the needed baseline hardware security requirements to their future devices. Everything else is just a bonus. There could be green-boot support and/or preinstalled devices, but thats not a necessity. GOS benefits with an official hardware platform, potentially early partner access to AOSP source code, input on hardware and firmware decisions, and Motorola benefits by potentially having GOS features, better hardware security, and making tons of money from alternate OS users, GOS or otherwise.
[dead]
If Motorola have a problem with it, they obviously aren't the right partner for Graphene.
Graphene obviously won't want to partner with a company that immediately bends over backwards for this kind of puritanical nonsense.
Motorola wont break the law. They just wont sell preinstalled devices, if preinstalled devices was even on the table for 2027.
Motorola will obviously have a problem with violating the law in several US states.
Like, what's unclear here? Do you seriously say that corporations should just ignore laws which they don't like?
If shipping a specific device configuration to the US is illegal, Motorola should not ship this specific device configuration to the US.
I do not think our parent is suggesting otherwise.
AFAIK Motorola and GrapheneOS are not merging, they are getting into a partnership. They do not have to think or do exactly the same.
Apple can comply with both CCP and US demands at the same time without a problem. I am sure Motorola can adjust their services to the markets they are working in, as well.
Motorola is pretty much only present in US these days, why would they build a product that can't be sold in their primary market?
Demanding that OSes outright violate the law because you disagree with your own elected government is pretty insane.
They are not building a product that cannot be sold in their primary market. They are not designing GrapheneOS devices, they are improving existing devices to meet GOS requirements. There will still be an OEM OS for those devices. Preinstalled GOS devices can simply not be sold there.
Can't speak about other continents but Motorola smartphones are at least available all over Europe so your initial statement is incorrect.
Your arguments show a lack of the least imagination, let alone simple reasoning.
There are countless ways to satisfy any regulation while still doing whatever you actually want to do.
The very most obvious is simply sell the device, in the affected areas, with any sort of os that meets the letter of the law in that area.
If it's also easy for the user to install something else once it becomes their property, well that's the new owner's business atthat point, Motorola did their part and complied with everything required.
No one needs to demand a company violate anything. That is just a silly argument to even try to make. Calling people insane for things they never said nor even implied is what's insane.
Quick google shows that in 2024 half of the Motorola phone sales were in LATAM, especially Brazil. What makes you say that the key market is the US?
[dead]
More likely they will just add their own age widget themselves
This is excellent; silly laws on the books should exclude countries from access to things.
Unfortunately it’s not enough because there’s also a need to work to get the laws repealed AND stop the endless attempts to bring them back.
Will a record be kept associating a device to a person through the verification system?
What's next, browsers sending this to $website every time you need to post a comment on the web.
Seems like a pure virtue signaling: they don't sell or make hardware. It is mandated only for pre-installed operating systems, from what I understand.
They've partnered with Motorola to have it preinstalled on phones, this is in TFA.
Preinstalled devices is not the main goal of the partnership. GOS is ok without having that to start. Motorolas stock OS will still be available.
Let me add that the typical GrapheneOS user will probably prefer to install the OS themselves rather than trust what comes preinstalled.
The typical GOS user generally doesnt want to do that. Flashing is a hurdle that increases barrier for entry. Reducing or eliminating that burden is ideal. Greenboot support would make flashing a little easier.
> typical GOS user generally doesnt want to do that
How do you know this? Is there an official (or even unofficial) source of GOS preinstalled devices that a substantial amount of "typical GOS user" has acquired?
Or maybe you are talking about "potential user of GOS"?
In any case: if you installed it yourself you mostly have to trust the source of the installer. If you purchase a pre-installed device you're basically back to the android/ios model: you have to trust the manufacturer AND the maker of the OS
I have helped a significant number of GOS users install GOS to their device. If you perform post install steps correctly then you do not need to trust where you got it from, as the post install steps are there to verify your install is genuine. If GOS gets greenboot support for motorola devices, then not getting a yellowboot screen will show it is genuine and you wont need to trust anything.
Could just ship it along on an SD card with a single button install you do yourself. Technically not preinstalled.
This is emblematic of a misunderstanding technologists often have about the law. We try to treat it like code we can exploit and hack around. But there is no compiler deterministically producing outcomes. Of course, this misunderstanding is often bolstered by the accurate observation that lawyers and businesses find loopholes and favorable interpretations that to us appear much like the exploits we propose. The critical element that's often missed, though, is the human one. To get away with an exploit, to have the case law updated to reflect your favorable interpretation, you need power, influence, and alignment on your interests. There are tax "loopholes" now that are commonly used but in a prior era, under the same laws, would have seen you dragged into court and eviscerated. If you tried your cute SD card trick a judge would tear you a new one. If Microsoft tried it, they could maybe talk to the right people before the case and come to an understanding that this little loophole was convenient for dev devices or something, and convince a judge to rule that they could do it, but only if accompanied by some external age confirmation they could self-attest to, with some wording that makes it clear that the trick is only usable by large and well-respected institutions. The law is not an impartial arbiter that you can outsmart. It's the enforcement mechanism for multiple tiers or rules that bind different classes. This age gathering law is a classic moat law. It exists to prevent outgroups from shipping software that's incompatible with this age communication system, and in a business-to-business context serves to establish obligations between ingroup members. Any other clever interpretation of the law will be discarded regardless of specific wording.
Right, my bad. It's easy to forget our society is a convoluted backroom quid pro quo even if we pretend otherwise on paper.
Sounds like it exposes a ton of attack surface. Better to just have a card with a link to the webinstaller, probably.
I'm sure noone in the legal system of California would notice that trick!
Well correct me if I'm wrong but dumb laws are usually not written by people who know much shit about fuck. So it's entirely possible they wouldn't.
You sound like a teenager fighting his parents. "Technically you didn't say WHICH bed I had to be in by midnight!!!!! I was in A bed, I followed the rules!!!!"
Society (mostly) works because we all agree that laws have intents. The wording is crafted as best as possible, and for the rest we have judges to shutdown lawyers trying to be a moffkalast smart asses.
Call it what you want, I still think that if the, ahem, intent, of a law is to reduce personal freedoms then it should be protested in as many annoying ways as possible. Should at least get some publicity even if it gets struck down.
Virtue signal away. I’m with whatever device and OS purveyors are willing to tell these tyrants to get stuffed.
I haven’t cut over to it completely yet but I think this’ll be the last nail in the coffin for my time as an Apple user. It’s already a loveless marriage , it’s already over, I’m already sleeping with GrapheneOS on the side. it’s asking when I’m going to leave her and it’s always “soon, baby. soon.”
As they should, I was personally surprised so many people were surprised come ICE raids that government can buy and track location via apps, advertising and your phone in general. Regular people need an idea, who is.. uhh.. less likely to sell them down the river.
Its a statement for the future. They arent bound to add this now but they could be in the future. They will adapt accordingly to avoid it.
The California law does apply to existing OS, right?
Can someone catch me up how FB et al are not the ones responsible for age verification?
Is it lack of something similar to PKI for identify verification?
If we go back a few years and analyze the porn magazines that are sold in a gas station, it's not up to the magazine to ensure that the "reader" has the legal age.
So we delegated the responsibility twice, first the gas station attendant must check the age of the buyer and then, the buyer should check the age of any reader.
So now, who's the "gas station attendant" in our situation?
because there are other sites/apps online too, and it's better to decouple the "obtaining the verification" and the "presenting the verification"
and if sites and apps don't need to be in the loop for this they can't end up leaking all over the 'net
Why would you want every site on the internet to traffic in government IDs? This is by far the least bad out of all possible ways to implement age checking. The benefit of this is that it can short-circuit support for more onerous age verification. The writing has been on the wall for some time now: the era of completely unrestricted internet is coming to an end. The question is how awful will the new normal be? This implementation is a win all around, a complete nothingburger. We should be celebrating it, not fighting it tooth and nail.
The tech crowds utter derangement over this minor mandate is truly a sight to behold.
> This is by far the least bad out of all possible ways to implement age checking.
Not quite. The least bad (that I'm aware of) is to mandate RTA headers (or an equivalent more comprehensive self categorization system) and to also mandate that major platforms (presumably OS and browsers, based on MAU or some such) implement support for filtering on those headers.
But sending a binned age as per the California law is the next best thing to that.
I think that malicious compliance all the way might have been the better option here. If a birth date is all that is needed, let the user enter a random one. If actual biometric verification is needed alongside, let the user also paste the code to a fake biometric validator that always returns valid.
It is the same philosophy as with an app that forcibly wants an invasive permission to the detriment of the user. Let the app have the permission while in a sandbox so it sees nothing.
Giving in in any capacity is unacceptable. The GrapheneOS foundation is based in Canada and is not obligated to record this information, so they wont. They have no reason to comply, be it malicious or otherwise.
Agreed. This is one of those moments you might as well simply say no. For practical reasons too, your users do have options and tend to be the kind that will drop a distribution if it goes rogue.
[flagged]
People who live in authoritarian states like North Korea or California can (and arguably should) ignore the fact that GrapheneOS is illegal where they live and use it anyway.
If you want a privacy-violating OS, there are already two big options on the market. A secure OS for people who do not live in authoritarian surveillance states offers a benefit to some people, even if not all people. A third privacy-violating OS offers no value to anyone anywhere in the world.
As they stated "If GrapheneOS devices can't be sold in a region due to their regulations, so be it."
Asking the device owner for the user's birth date is precisely what the (California) law requires.
Biometrics are not required.
The concept appears to be that a parent or guardian could enter the birth date before turning the device over to a child.
Malicious compliance would be providing this age bracket API:
boolean is_user_over_18() { sleep (18 * 365.25 * 86400); return true; }
This is a real-time interface (as required by the law) that takes 18 years to complete. (Remember: "Real-time" does not mean "fast").
> Asking the device owner for the user's birth date is precisely what the (California) law requires.
Why would anybody bother to implement that?
The New York bill specifies a biometric requirement.
You'd need to closely read the law and have a lawyer advise you, but a neat attempt might be to just ask for the date of birth, send that "in real time" to the App Store program, and then have that program simply discard it?
I don't think current iterations of the law require that this be sent off-device in any way.
The second requirement of the California law is that there be an API available to all apps that returns the age band a user is in -- one of:
age < 13
age >= 13 && age < 16
age >= 16 && age < 18
age >= 18
A non-maliciously compliant implementation would need to retain a date of birth or equivalent until the user was over 18.
A maliciously compliant API could just wait 18 years after account creation before yielding an answer. (remember folks: "real time" does not mean "fast").
One of the oddities about the way the law is phrased is that it requires the age band information about the user be provided to "the developer" rather than to the application.
> One of the oddities about the way the law is phrased is that it requires the age band information about the user be provided to "the developer" rather than to the application.
So, expose it via a Unix socket only accessible to the account named "developer"?
Only half joking.
> The second requirement of the California law is that there be an API available to all apps that returns the age band a user is in -- one of:
Is anyone actually going to bother to do this though? Why would they?
Agree. I didn't even think of that. Embarrassing. Your approach might have been the best option.
We are back to printing books, boys
Apple should be championing this.
They should be proactively marketing the best parental controls on the market.
so... just sell a phone with a script prompts the user to install the OS, and it auto-verifies hashes, can't be bypassed, etc. Is that too simplistic a solution?
I highly doubt that would work but there could be, say, a card in the box with the link to the webinstaller and the webinstaller can be made even easier.
Having an age setting is not verification.
Having an age setting is not verification.
I hate the articles that lump everything together.
No but it is one of the building blocks for a verification system.
It could be used in one. But it would need so many changes that it doesn't advance that kind of thing by much.
It also gets sites to stop doing their own invasive verification systems.
I still view it as a step in the wrong direction. And it sends a message that this kind of law is ok.
That depends on what kind of law you view this as. As a parental control like the V-chip (but hopefully with a higher percent of parents using it) it's nothing new.
It's not new but that was a dumb and irrelevant technology too. And didn't last for that reason (easily bypassed, not working with modern tech). Just like the clipper chip that was supposed to spy on us.
Not just "could be used in one", but age verification is the raison d'être for the introduction and existence of these fields. Not sure why some people pretend otherwise when it is obvious.
Do you think parental controls requirements are generally a fraud, or if it's just this law what makes it special?
I don't think the California law makes it easier in any meaningful way to pass age verification laws, considering how many age verification laws have already passed. I see it as something that has real uses by itself and also can get many apps/sites that would have done US-wide age verification to trust the setting instead.
[flagged]
GrapheneOS protects everyone. Many normal and average users use GOS, and if minors seek to use it to protect themselves, thats great.
[dead]
I know it's gonna be a very unpopular opinion. I do like, appreciate, respect & admire that they are ready to die on a hill. I just don't think it's the right hill. I do not have an issue with the legality of it. Rather I think age verification is actually not bad. Sure i see the potential danger. But there is potential benefits, that'd counter the danger, by a lot.
In different times, i might have argued differently. I'm not saying it's not worth protecting the world you deem worthy of protection. But no matter what that world is to any of you. The one we all share is changing for sure. Uncontrollably fast. And many things are gonna change. And many things won't matter that much anymore, if we actually end up going where we're headed.
I mean a this is just a super small part of it all, but i assume in this specific case, for graphene, it's a battle for privacy... and they're right. But we're still going into a future where we got 5,10,20,30 more years of "AI", even just keeping the same level of overall sophistication for most, but costs decreasing immensely... I don't know about you, but I don't think the ways we protect our privacy can be unaffected, already because we're going to learn all new aspects about which data is private. Just out of practicality. Extreme example: but if generating hundreds of obscene deepfakes of any person as easily as taking a photo with your iPhone... ah, i can't keep having this discussion, i hope i am just an insane moron who is wrong. But, just to be sure: instead of arguing if we should close the windows on the train that's burning, or leave them open, as some are smart and others need help, let's just get off the fucking train.
And yes of course. One might argue (I actually would), we should not start implementing laws like that or start making personal information a requirement to digital access.
But this might be the first step to a different future, or not. As i said, who cares where the train is headed. It's burning and nobody even really wants to be on it. Let's please get off the train.
Not saying the battle is lost. I have tried working on something because I still have great hope. But someone seriously must act. I tried, getting off the train. Or at least start standing up from my seat. Realizing it's not that easy to get off. It's embarrassing, but i can't even get off the train by myself... i tried anyway... but here i am, sitting again (currently on the floor, lost my seat, damn...)... i have been building something for the past 2 years. Well, trying to build something, an attempt to change course... ruining my life over it. And currently i failed, before i even got to a point where my prototype or any of the theoretical work even remotely represents the vision. But maybe i just learned, i was wrong about all of it. I hope i'll make it back being able to afford working on it and someday a way to make enough money to pay smarter people than me to join. But currently, it's insane for me for me to even dare dreaming about that. I have really dug myself a hole. Next time, it should at least be a hill...
So in the meantime: can people like the dudes & dudiñas from graphene please chose a wiser battle. If just some of all these people got together & worked on getting off the train, instead of working on things that seem meaningful now, but wouldn't even be considered worthy of being mentioned in the future... we'd have a shot.
Damn. I still just can't accept it, even though i've literally lost everything believing that. And i am ashamed so deeply believing in what i saw, and in friendly moments still see, as a future... thinking i could change it, without changing myself... but please god, in the end, let me not have been just bonkers, but convicted.
(As if that, would be, any different).
I appreciate the thought, but I personally disagree having seen the patterns of the past 2-3 decades. There is zero real benefit to it save powers that be. Honestly, the only reasonable move forward is non-compliance. Everything else results in steady inching towards full blown panopticon ( and some would argue that we are already there ).
GOS is not going to compromise on user privacy and security. This is not a technical problem, it is a social one where parents refuse to do what they should have done from the start. The internet is not for kids. Presuming users to be guilty until proven innocent is unacceptable. Making mechanisms to obtain user data, even if it is completely and perfectly functional and achieves what it sets out to do, risks malicious parties obtaining that information. The only way to win the game is not to play, to not ever provide that data, and children shouldnt be playing the gane in the first place.
The GrapheneOS Mastodon post says,
"GrapheneOS will remain usable by anyone around the world without requiring personal information, identification or an account."
https://grapheneos.social/@GrapheneOS/116261301913660830
That raises the issues that GrapheneOS needs to solve, which may require more creativity than bold, somtimes combative statements.
If GrapheneOS doesn't comply with laws and regulations then they will sometimes be banned or restricted. If that happens, they may not be "usable by anyone around the world" for long.
That doesn't mean they have to capitulate or sacrifice security. They can find creative solutions, some of which are suggested here. The first step is to carefully read the spec to determine what is necessary, then talk to someone like the EFF, and find a way forward.
Better would have been a statement "If GrapheneOS devices can't be LEGALLY sold in a region due to their regulations, so be it." . I hope that is what they meant, leaving open the possibility they'll have a secret drone delivery squadron bringing GrapheneOS phones in to Brazil and other equivalent places.
Also it would be nice if, where Graphene has partnered with hardware manufacturers, then said hardware sellers could issue a statement like "$Manufacturer promises that in regions where GrapheneOS is illegal we'll leave the bootloader unlocked, if users choose to break local legislation then that is on them" and furthermore a statement like "$Manufacturer fully swears on all honour possible that in any regions which ban unlocked bootloader devices then, oops, we found that if you short pins 3 and 8 of the third chip on the left together at any time during booting you'll permanently unlock the bootloader and absolutely nobody is allowed to know that. Which is why we've posted this on every social media channel. Afterall, all our users need to know that they're not allowed to know that the bootloader can be unlocked by shorting pins 3 and 8 (third chip on the left) with anything less than 20 ohms (nobody must know that a paperclip would do for this)".
Nonetheless: Well done GrapheneOS!!!!!!!
The problem is the spirit of the law, not the word.
They wont break the law, they will just move to where there are no such regulations. This isnt a promise to violate laws.