Year of the Linux desktop inbound.

Sounds good. Might even encourage more people to move to a privacy respecting OSs.

Account is created? Who said were making accounts for our operating systems

Democrats had the best intentions when it came to the PATRIOT Act and the creation of the Department of Homeland Security as well,

How do you know what their intentions were?

Well, not all of them, obviously. Yet, for example, I tend to think Joe Biden actually did have good intentions considering the bulk of the PATRIOT Act was based on his prior legislation in the 90s, his Omnibus Counterterrorism Act. It's worth noting this was in response to a wave of US homegrown right-wing white nationalist radicalism and terrorism in the 1990's such as Waco and Ruby Ridge. The Oklahoma City Bombing would happen a month after this bill first appeared. Considering the shitstorm we're in regarding virulent white nationalist terrorism, I kind of think back when he first wrote it that it wasn't such a bad idea.

People who were more clearly war hawks like Hillary Clinton? Probably a lot less likely to have had great intentions.

Yet others, like Ron Wyden, who has been a consistent critic of the out of control national security state and voted against military intervention in Iraq in 2002 also voted for the PATRIOT Act. He also spent a great deal of time trying to amend the PATRIOT Act as well.

And as much as Democrats drink from the same well of corporate funding as Republicans, I wouldn't say the majority of the party is outright evil or don't care what happens to their constituents. Schumer obviously doesn't give a fuck, but I also don't think he's actually representative of the party as a whole as much as he just has power in a party that puts seniority over merit in intraparty politics.

It's easy to forget how much shock and terror 9/11 really did put into people which colored how quickly they foolishly signed off on the PATRIOT Act.

Why can’t we just have better parental controls? I’m a parent and I do want to protect my kids but I will not upload a photo or anything else.

I would argue that early and excessive exposure to very misogynistic porn can be damaging to a child in that it can reinforce that misogyny and bad sexual patterns/ideas.

I would also argue that it is the job of the parent or guardian of said child to make sure the information they get online (or anywhere for that matter) is age-appropriate, and not the job of the state.

These are clearly laws that are either not well thought through or (probably more likely) intentionally limiting of every citizen’s privacy. I don’t think that even if the porn or bullying or whatever problem was as bad as they say it is that this would even be justified.

Ok but isn’t that just this?

Declared Age Range / AgeRangeService - iOS

Use Play Age Signals API - Android

The left was saying that the PATRIOT Act was a bad idea from day one, just like we were with the Iraq War. People keep ignoring the left (or dismiss us as paranoid) and we keep getting proven right over and over and over again.

No shit, I was one of those people. I just don't ascribe to malice what can adequately be explained by stupidity, being out of touch, and not thinking through long-term political consequences. Once again, the Omnibus Counterterrorism Act was largely in response to white nationalist home-grown terrorism, which not having squashed that in the 90s is literally part of why we have the problems we have to day with a white nationalist government. Still didn't make it great, but I have a lot more sympathy for its origins in that era.

It wouldn't even work on paper. All it would take to twist this into something dystopian is requiring cryptogtaphic attestation for the age range, and knowing lawmakers, they would justify it as a countermeasure for kids lying about their age. Expand the feature as a web API so websites can use the "easier" and "more secure" system-level age verification process and—oh look, now we can't use important websites without a commercial operating system.

It would be like Secure Boot but worse. At least with that you can turn it off or enroll your own keys.

Holy fuck this is bad

I fully expect this to become a move to hamper linux, or any non-windows desktop usage, because "we can't trust a user who has full access to their OS" or some other bullshit.

Protecting parent's rights to abuse their kids is a common, if unstated, goal of laws like this.

When my kids were young, but old enough that they may inadvertently stumble upon porn, I told them the truth. The truth that so few explain to their children. The truth that many adults don't understand and many more completely forget.

Porn is fake.

It's not real. The sounds? Acting. The breasts? Those are fake too. The perfect skin? Makeup (or airbrush).

Even "amateur" porn is fake! As soon as someone agrees to be filmed having sex it ceases to be real.

Also, let me get this straight: Your greatest fear from children being exposed to porn is they might begin to accept mysogyny‽ As in, you think porn is the most likely place kids will be exposed to it and somehow just nod their heads‽ "Oh wow, that's totally sexist! But they're having sex so it must be OK. I'll try to be like that!" (Child nods head).

Or perhaps you think kids will be viewing so much porn—specifically, the mysogynistic kind—that it will somehow carve mysogyny into their minds?

This is so much like the beliefs of conservatives that try to ban books that mention LGBTQ people. Stop and think for a moment: How much porn did you view as a kid? How did that impact your life?

I seriously doubt it changed much. Unless, of course, you were reading Playboy for the articles.

Yes! Because cyber bullying can only happen on platforms that are designed specifically for adults. By banning children from social networks, we will have completely eliminated the problem and totally not at all created much worse problems like potentially leaking the identities of millions of people and destroying the entire concept of privacy.

(Nods head vigorously)

https://theforestscout.com/40129/in-our-opinion/how-a-childrens-game-turned-into-an-outlet-for-bullying/

What is in the actual bill?
I haven't read any of this but if it was just a year of birth box at local signup then this could actually be pretty good. A sort of halfway between local only parental controls & age-policing, ID-reporting corporations.

https://leg.colorado.gov/bills/SB26-051

Here's a summary, but the text of the actual bill can be gotten by clicking on "Recent Bill (PDF)"

Only for privacy and anonymity, companies like Google and Microsoft will do fabulously however. Who donates to him I wonder.

Apple already has iCloud age settings

DON'T give them ideas!

I've been a longtime mobile and web developer, have a teenage kid with a phone, and am a big privacy advocate (card-carrying member of ACLU and EFF). As a parent, I don't want my kid exposed to cyber-bullying, toxic social media, or algorithmic bullshit.

And I will tell you this: the operating system is 100% where you want to do age verification.

I don't want individual social media sites, dodgy third-party orgs, or government agencies scanning our faces or IDs. Under a family sharing plan, the OS already knows how old the kid is. Any site wanting to gate access can privately ask the OS if age > X without spilling their PII. Same concept as OAuth. An opaque, encrypted token indicating GO or NO-GO.

Raging that they shouldn't do any of this is just idiotic. Unfettered access got us CSAM, kids getting radicalized, or bullied to the point of self-harm. Fuck that.

From a technical point of view, having OS-level verification is the least worst, and in my technical opinion, the best option.

Hey Colorado. GFY and get your damn politicians under control.

First I've heard of it, dude. Don't get your knickers in a twist.

And I will tell you this: the operating system is 100% where you want to do age verification.

Oh, what's that you're using? It's Linux? Sure that's fine, just make sure the age verification check works on it.

Wait, what do you mean you have "root access"? Why do you keep repeating "it's my hardware and I own it"? You removed the age check system? You can do that! Hey, he's not supposed to be able to do that!

Colorado proposes bill to ban open source operating systems

Crap.... I was right </Edit

As a parent, systems and web developer of both open source and proprietary software. This would single-handedly be one of the most damaging things to ever happen to the world of personal computing.

From a technical point of view, having OS-level verification is the least worst, and in my technical opinion, the best option.

It's a horribly bad opinion. It's the same old problem with client-side anti-chest. You can't trust the hardware. If the user has full access to the computer, then they can do whatever they want with it. This is a core issue in security modelling. So what's the answer? Try to lock down the system. This is why anti-cheat software, to play a video game, has more access to your computer's hardware than you do as a user. Full access to every single file, data in memory, webcams, things on screen, etc.

What's going to happen if it becomes mandated that age checks must happen in the OS? We're going to get computers so locked down that you won't be able to open a .txt file without some kind of authentication check.

No thanks. I'm happy to avoid every single age-check required service.

As a software engineer that works on virtualization and is interested in software freedom, this law terrifies me because it's a trojan horse for something much much worse than the already shitty status quo: remote attestation.

And I will tell you this: the operating system is 100% where you want to do age verification

No, it's the last place you want to do this check. Let me explain: because users control the PCs they buy right now, meaning they can install any OS and programa the so wish to install; governments at some point will decide that they cannot trust the results given by any OS.

The only way for governments will be to actually trust third parties (again) that will check properties in your computer through a module that controls the whole computer and users don't have access to.

This is called remote attestation: https://www.eff.org/deeplinks/2023/08/your-computer-should-say-what-you-tell-it-say-1

With this technology, users don't decide what programa they can install and run, they can't even decide what websites can they visit.

It's a brutal encroachment on the computer freedom you have enjoyed up to now, and the perfect tool for an authoritarian government to enforce what can you watch and in general, can do with your computer.

If this law is approved, I guarantee you it will spread and will have expanded versions requiring remote attestation. (Don't worry, lobbyists will find a way to sell remote attestation preserves privacy to make it go down easier)

The end result is a nightmare-fueling scenario where someone like Peter Thiel through Persona not only has your information because it needed to verify to create the account in your computer, but Microsoft also has it, and governments through Microsoft may decide to limit which platforms you can access (X or something worse), if also if you've been a bad citizen, if you can run programs in any computer that can be legally sold.

All in all, this law is incredibly dangerous in the current political climate where even supposedly democratic governments are pushing for more authoritarian controls to digital life. And I'm surprised organisations like EFF haven't seen this yet

If I could trust that the people in government know how computers work I'd be down but well I can't

This looks like self-reporting. ie: no third party ID snooping badness. Am I missing something?

What are you on about? If they get 95% of the population with this it's still a huge win for them.

its not about limiting children's access to porn and other stuff, it never was.

Fucking idiots don't know how operating systems work or what they're for.

At this point, it's probably cheaper and more effective to have proper sex education in schools...

At which age? And how?

What would be the point of that? If the check was done locally it would be trivial to spoof.

Technically, this can't work. It's a bad idea.

These people are idiots

Colorodo democrats have always been lousy. Here they are following texas and montana and tennessee, locking down the internet with dishonest arguments. No one in reality thinks this is about protecting kids, and it's not the state's place to do so, it's the parents, it's a violation of the 1st amendment to make adults expose their identities to people recording everything they do online and using it against them, and selling it to the government.

We need to repeal these bills, and we need a popular open source of model legislation to counter-act ALEC, that writes these bills and state lawmakers just fill in the blanks, after the united corporations give them a plausible excuse to and pay them off

The courts should strike it down, I don't have faith they will side with the constitution, but it's clearly unconstititional and beyond the authority of the state as well, in the realm of interstate commerce which is explicitly given to the feds, whom can't be trusted either obviously.

But the 1st amendment is clearly invalidating this, forcing people to identify themselves to groups that will record everything they say or do and sell it to everyone, including the government, that will chill speech, and groups will punish people for their speech.

Too bad scotus is all in on punishing people for speech though.

You lost all credibility early on in your first statement, to anyone living in reality paying attention, your analysis is worth nothing.

In that case reducing the amount of freedom the kid has is.. counter-productive

It will just give more control to their parents

Systemd is so much easier to use, absolutely was not a mistake.

Google already allows you to save your ID in Google Wallet and share specific details via NFC. Why can't I just use it to provide my year of birth?

Seriously. There are better ways to ensure privacy with identity verification.

I'll caveat this by saying IANAL. But the way I read Bill 26-051 is that it's looking to implement "user age attestation" not "device or application" (WEI). Two separate things.

Age Attestation requires the OS (or really, the cloud service that implements account-level authorization) and come up with an "age signal." It prohibits using third-party non-public data, and puts the burden on the OS for managing the Go/No Go process. No PII leaves the device.

The alternative is dystopian, poorly managed KYC/AML over-reaches. Under the guise of anti-fraud/anti-gambling, these will reach deep into our communal shorts. They could well soon require individual biometric verification (iris scans, face contour maps, fingerprints, etc). No, thanks.

WEI is a separate story. It's trying to cut down on malicious apps and maybe stop individual sites doing browser fingerprinting. It can only work on systems with single-points of app installation (without side-loading) and devices already locked down with hardware TPMs. So far, that only covers iOS. All the other systems (Linux, Mac, Windows, and Android) let you install your own system-level code without having to go through the One Official appstore. And with WASM, the browser makes it all moot.

Personally, I think WEI is a total waste of time. Trying to squeeze the toothpaste back into the tube. But it's solving a different problem than age verification.

Not to say the Colorado bill is perfect. There is a truck-sized app vs. website loophole in it, so kids can still access social media sites from the browser vs their phones. But the OS can offer an API that browsers can vend to websites without every site rolling their own crappy system. It also doesn't account for a clever kid figuring out how to create a separate adult-appearing user account. Because of course, they will.

Saying it's parental responsibility is unrealistic. I've helped folks set up Screentime, router-level filters, and even Circle (in-home ARP spoofing box, and mobile VPN + fine-grain URL filtering). There are ways around all of it. Besides, the kids can still get exposed to utter bilge via school-approved sites like Zoom, YouTube, or Google Drive. Let's not even bother with messaging apps or in-game chat. This is all assuming parents have the time or knowledge to set things up and manage the filters.

We're not trying to be over-controlling, stop the kids from dancing too close at the prom, or yuck their yum. But as parents, we do want to have some sort of say in what they're exposed to online before their brains have the capacity to process them. The risk to their mental health is real, and just YOLOing it hasn't worked out too well.

I'm sure there's a lot of subtle behind-the-scenes stuff in the Colorado bill. I'll wait to hear what EFF or Mike Masnick have to say about it. But as a techie, app developer, and parent, it reads like the least-worst way to keep a minor away from nasty crap without requiring every one of us to scan our faces and provide IDs to every rando website.

I won't repeat what I said in the sibling thread.

But I don't see anywhere in this specific Colorado bill trying to restrict OS level features or go anywhere near open-source. As a parent, if I put little Timmy on Arch and give him root access, I don't get to bitch about what they do online.

This is about a single signal (kid/no kid) at the user-auth level, without slurping up PII and shipping it off into the ether.

But I don't see anywhere in this specific Colorado bill trying to restrict OS level features or go anywhere near open-source

Because the people proposing the bill don't understand or know what open source is.

I guess my example "realization of open source" dialogue wasn't in your face enough, eh?

This is about a single signal (kid/no kid) at the user-auth level, without slurping up PII and shipping it off into the ether.

You claim to be a developer, but seem to not understand the fundamental truth of "you can't trust the user's computer". The proposed law, would make it law that operating systems have some mechanism to verify age. Now if it's a law to guarantee the verification flag is available, then that would also mandate the mechanism be free from tampering, otherwise the law means literally nothing and is unenforceable.

So once they learn about open source, root access, jailbreaking, etc, those things will very quickly become illegal.

As I said in my other comment, this problem has been attempted with gaming client-side anti-cheat for decades now. There's a reason most online games still are riddled with cheaters, despite anti-cheat software being near Orwellian in what they can do.

Age verification is nothing more than the new guise of forced online tracking.

Unfortunately, if left unchecked, an incompetent ally is just as destructive as a malicious adversary. If you are from Colorado and take issue with this legislation you should contact your representatives and let them know that they are being idiotic since that is the only meaningful difference between the two. Overall, we can continue giving the dems a pass because they are the lesser of the evils, or we can attempt to use what little political capital we have to make them realise their errors.

and it’s not the state’s place to do so, it’s the parents

Not every parent is a good steward or guardian of their children, like those who have been caught cyberbullying their own children or those who send their gay/trans children to conversion camps to "pray the gay away" or even parents who deny their children life-saving vaccination and medical procedures because it conflicts with parental beliefs. A technically proficient parent who is "protecting their kids" could easily be blocking their children from access to information that is important to the child's development just as much as the government could be.

The argument that it's always fully the parents right and no one else's is an unintentional argument in favor of parents treating children like property and normalizing the ability for parents to abuse and control their children under the guise of the false idea that a parent always knows what is best for their child. Plenty of parents shat out kids while knowing fuck-all about how the world works and definitely don't know what is best for their child.

Government is imperfect, but so are parents.

or we can attempt to use what little political capital we have to make them realise their errors.

Exactly. That was essentially my point regarding those who supported the PATRIOT Act and the creation of the DHS which both have been widely abused since their inception (although thankfully the PATRIOT Act was finally sunseted). That it's important to help the politicians who think they're helping but are actually creating a more dangerous environment understand why what they're proposing is dangerous rather than to cynically reject all government as bad and to give up entirely. Thank you for stating it more clearly than I did.