top | item 47270784

System76 on Age Verification Laws

850 points| LorenDB | 25 days ago |blog.system76.com | reply

602 comments

order
[+] Tyrubias|25 days ago|reply
I don’t like to shill for companies, but I’m glad System76 made a statement. The addendum does feel like their legal team made them add it though:

> Some of these laws impose requirements on System76 and Linux distributions in general. The California law, and Colorado law modeled after it, were agreed in concert with major operating system providers. Should this method of age attestation become the standard, apps and websites will not assume liability when a signal is not provided and assume the lowest age bracket. Any Linux distribution that does not provide an age bracket signal will result in a nerfed internet for their users.

> We are accustomed to adding operating system features to comply with laws. Accessibility features for ADA, and power efficiency settings for Energy Star regulations are two examples. We are a part of this world and we believe in the rule of law. We still hope these laws will be recognized for the folly they are and removed from the books or found unconstitutional.

Anyways, it feels like all sides of the political spectrum are trying to strip away any semblance of anonymity or privacy online both in the US and abroad. No one should have to provide any personal details to use any general computing device. Otherwise, given the pervasive tracking done by corporations and the rise of constant surveillance outdoors, there will be nowhere for people to safely gather and express themselves freely and privately.

[+] idle_zealot|25 days ago|reply
> No one should have to provide any personal details to use any general computing device

I agree. I also agree with S76 that some laws regarding how an operating system intended for wide use should function are acceptable. How would you react to this law if the requirement was only that the operating system had to ask the user what age bracket it should report to sites? You get to pick it, it isn't mandatory that it be checked, and it doesn't need to be a date, just the bucket. Is that still too onerous?

I ask because I feel like if we don't do something, the trajectory is that ~every website and app is going to either voluntarily or compulsorily do face scans, AI behavior analysis, and ID checks for their users, and I really don't want to live in that world.

[+] shevy-java|25 days ago|reply
> Accessibility features for ADA

The problem is that the comparison falls flat. ADA does not sniff for birth date and surrender that data to others. One has to look at things at a cohesive unit, e. g. insecure bootloaders by Microsoft surrendering data to others. It seems as if they try to make computers spy-devices. That in itself is suspicious. Why should we support any such move? Some laws are clearly written by lobbyists.

[+] hulitu|25 days ago|reply
> The California law, and Colorado law modeled after it, were agreed in concert with major operating system providers.

So it is Microsoft, Google and Apple pushing for this.

[+] strangattractor|24 days ago|reply
Cigarette vending machines had little stickers that said it was illegal for those under 18 to purchase cigarettes. Sure stopped all my friends from buying them.

Seems exactly like the useless process fixation that Abundance advocates abhor.

[+] curt15|25 days ago|reply
>Anyways, it feels like all sides of the political spectrum are trying to strip away any semblance of anonymity or privacy online both in the US and abroad. No one should have to provide any personal details to use any general computing device.

What was the legislative history for the California law? Who sponsored it, and who are their backers? Is there some coordinated effort by surveillance state proponents?

[+] threatofrain|25 days ago|reply
> Anyways, it feels like all sides of the political spectrum are trying to strip away any semblance of anonymity or privacy online both in the US and abroad.

It's not this or that political party, your neighbors simply don't share your values. Maybe you don't agree with their values either — like to what degree we should be ceding privacy in favor of fighting child exploitation on the internet. Child protection arguments work because it is a compass to the true feelings of your neighbors.

[+] FpUser|25 days ago|reply
I remember western public laughing about requirement of the former USSR to register a typewriters. So we have a case of he who slays the dragon becomes one
[+] sharperguy|25 days ago|reply
The same politicians who claim to support the free market will do deals like ttis with corporate oligopolies to cement their position into eternity.
[+] gzread|25 days ago|reply
The California law doesn't strip away any anonymity or privacy except for the additional fingerprint signal of you being a kid or not, which is no worse than Accept-Language
[+] jadbox|25 days ago|reply
Why can't it be the BROWSER that reports age instead of the OS?
[+] cmxch|24 days ago|reply
Still not good enough to comply in advance.
[+] panja|25 days ago|reply
Gotta find a way to profitability I suppose
[+] r2vcap|25 days ago|reply
Fxxk off, to all political actors pretending this is about child protection. Protecting children is not the job of the OS, the device manufacturer, or the internet service provider. It is the parent’s job. If you cannot supervise, monitor, and discipline your child’s internet use, that is your failure, not theirs.

They can provide tools, sure. But restricting adults because some parents fail at parenting is insane. That is how a totalitarian state grows: by demanding the power to monitor and control every individual.

If you cannot control your children, that is your fault. And if that is the case, you should think twice before having kids.

[+] newsclues|25 days ago|reply
What if we had ISP police?

Cops to track what people did on the internet, checking every image to ensure it's not pornographic, or every transaction online, to ensure it's not criminal!

Sounds great! Let's just start by rolling out the program to target elected officials and their families as a trial. If every congressional or senate representative wants to undergo a few years of scrutiny to make sure the system works well, maybe the people will follow gladly.

[+] tyler33|25 days ago|reply
of course it is an excuse for controlling/spy on us, every children use and will keep using their parent computer/phone
[+] mxfh|25 days ago|reply
sure, let all retailers sell alcohol to children to test your theory.
[+] cultofmetatron|25 days ago|reply
this whole thing is part of building a mechanism to restrict free speech down the line to cover for a certain "greatest ally" of the united states. make no mistake, the "not a genocide" over the last two years and the recent "not a war" is very much related to this.
[+] mihaic|25 days ago|reply
In general, I argue for less state control on anything. But your argument seems flawed from its core. If someone is a bad parent, should we simply ignore it and let the children turn out idiots as well? And the line is often blurry, so that's why we designed schools that should compensate even for dumb parents.

And, just to be clear on this topic, I think these age restriction laws are mostly bullshit, but I'm deeply against the concept of putting all the responsabiliy of raising children onto the parents.

[+] al_borland|25 days ago|reply
> Throwing them into the deep end when they’re 16 or 18 is too late.

I saw this a lot in college. Kids that didn’t have any freedom or autonomy while living at home went wild in college. They had no idea how to self-regulate. A lot of them failed out. Those who didn’t had some rough years. Sheltering kids for too long seems to do more harm than good. At least if they run into issues while still children, their parents can be there to help them through it so they can better navigate on their own once they move out.

[+] dbdr|25 days ago|reply
This law feels like a battle in The Coming War on General Computation, as Cory Doctorow put it:

> I can see that there will be programs that run on general purpose computers and peripherals that will even freak me out. So I can believe that people who advocate for limiting general purpose computers will find receptive audience for their positions. But just as we saw with the copyright wars, banning certain instructions, or protocols, or messages, will be wholly ineffective as a means of prevention and remedy; and as we saw in the copyright wars, all attempts at controlling PCs will converge on rootkits; all attempts at controlling the Internet will converge on surveillance and censorship, which is why all this stuff matters.

Full talk: https://www.youtube.com/watch?v=HUEvRyemKSg

[+] muyuu|25 days ago|reply
> all attempts at controlling the Internet will converge on surveillance and censorship, which is why all this stuff matters

it really boils down to this sadly, and it should be pretty obvious shouldn't it?

i'm finding it befuddling that even technical audiences seem to resist connecting those dots, but strong motivated reasoning is at play: these are audiences that will often feel it will be them who will be in control, and they're also emotionally nudged by the idea of child safety

[+] 0xbadcafebee|25 days ago|reply
"Age verification" is such a politician's way to label this. It doesn't actually verify your age. What it does do is set the groundwork to argue that none of us should use any software on any computer that an App Store with Age Verification doesn't allow us to.

But there's a bigger issue than just what software you're allowed to run on your own computer. What's really insidious is the combination of the corporate and government interest. If every server tracks how old you are, it's a short step to tracking more information. Eventually it's a mandatory collection of metadata on everyone that uses a computer (which is every human). Something both corporations and governments would love.

You were worried about a national ID? No need. We'll have national metadata. Just sign in with your Apple Store/Google Store credentials. Don't worry about not having it, you can't use a computer without it. Now that we have your national login, the government can track everything you do on a computer (as all that friendly "telemetry" will be sent to the corporate servers). Hope you didn't visit an anti-Republican forum, or you might get an unfortunate audit.

[+] convivialdingo|25 days ago|reply
Or anti-Democrat forum? Let's not pretend this isn't a California law, or a bipartisan political power grab.
[+] dagss|25 days ago|reply
Not commenting on this specific law, but I do believe the premise that children should be exposed to everything is wrong, and that the overall view on humans in this post is naive.

These days, exposing an immature brain to the raw internet is basically just handing the brain and personality over to be molded by large corporations and algorithms.

And humans have never been rational, self-contained actors that self-educate perfectly when exposed to information, converging on an objectively good and constructive worldview. Quite the opposite.

Humans develop in relation to one another, increasingly in relation to algorithms, and sometimes become messed up, and sometimes those mess-ups would have been avoidable had relations or exposure been different.

In fact I would say you as a parent is not doing your job if you are not trying to make sure a 12 year old isn't pulled into, say, an anorexia rabbit hole.

Whether that is best done through making sure exposure doesn't happen, or through exposure and education, will depend on the child and parent (and society) in question. What worked best for a highly rational self-reliant geek teen may simply be a disaster for another human. And what worked for an upper class highly educated family may not work for a poor family with alcoholized parents or working 18 hours a day to make ends meet.

And parents are not perfect -- if all parents were perfect, there also would be no alcoholics and drug addicts or poverty or war. But people are imperfect, and it's natural to make laws to mitigate at least the worst effects of that. (Again, haven't read this specific law proposal, but found the worldview of OP a bit naive.)

[+] junto|25 days ago|reply
I’m tired of the U.S. nanny state with its pilgrim-religious historical backdrop of prudishness, infecting everyone outside its own borders.

Their ideas are deeply unhealthy for children and worst of all, lazily shift the responsibility of parenting from the parents to the state.

Many European countries have long had a culture of slowly increasingly responsibilities and freedoms to their children gradually, letting them slowly and safely test their boundaries. At least the proposed EU solution (for identity) tries to prevent overreach. The wholesale EU spying to “save the children”, which seems to be funded by the U.S. is a different topic and we need to continue to fight it tooth and nail.

The insidiousness lies with major tech companies and their pursuit of eyeballs on screens. The Internet was supposed to be something we used to learn, gain knowledge and connect. They took the internet over, bastardized it and made deeply addictive apps and games to keep you watching ads regardless of age.

These age checks are just for data collection and spying to sell the data to the highest bidder, which is likely governments in order to control and herd their populations.

The reason for this is easy to understand in the context of AI. In the future the only valuable asset will be a data and the access to that data.

In the future, any app will be built, replicated, deployed and maintained by AI. Apps, websites, especially B2B apps - their days are numbered.

If my business needs a billing system tailored to my business in the future, I’ll describe it and have an AI built and maintain it. That is not that far away in relative terms.

Our goal collectively (as technology advocates) is to make sure that this consolidation of personal data doesn’t happen. If personal AI is to be built, then the user should have full ownership and away from the spying eyes of groups like Palantir and the NSA. They cannot be trusted. The Jews learnt that catastrophically in Germany in the 1940’s putting their trust in a government that became authoritarian and evil.

What is digital will never die and what is digitally given cannot be taken back.

[+] globemaster99|25 days ago|reply
So much for freedom and democracy lectured by Americans and westerners to the rest of the world. This is just censorship of every form of freedom of speech. This got nothing to do with children or youth. They will eventually censor and track everyone.
[+] kraf|25 days ago|reply
Comparing today's internet to the 90s is hardly fair. It has become extremely predatory, and most places youth gravitate towards are controlled by algorithms with the goal of getting them hooked on the platforms to make them available for manipulation by the platform's customers.

Of course, there will be stories of smart kids doing amazing things with access to vast troves of information, but the average story is much sadder.

The EU is working on a type of digital ID that an age-restricted platform would ask for, which only gives the platform the age information and no further PII.

Companies (not talking about system76) amazingly always find the shittyest interpretations of their obligations to make sure to destroy the regulations intention as much as they can. The cookie popups should have been an option in the browser asking the user whether they want to be tracked and platforms were meant to respect this flag. Not every site asking individually, not all this dark pattern annoyance. It's mind-blowing that that was tanked so hard.

[+] whywhywhywhy|25 days ago|reply
None of this is for what you're describing though, there is no reality where such wildly different countries and states in different corners of the world all decided coincidentally to all do this within 6 months of each other. We know it's not "well maybe they saw X country and thought it was a good idea" because even percolating the policy would have taken over a year.

Protecting kids is just the PR reason, the real goal is requiring ID auth for every action taken on a computer. If we normalize it for downloading apps or using websites the next step is to authorize it for connecting to HTTPS at all and then the next step is requiring it to unlock your CPU cores.

If people don't push back on this now there is no world where we get out of 2030 without requiring government ID auth to install linux on your own computer not connected to the internet.

End to end silicon to server auth is absolutely possible and someone is working really hard to make it a reality.

[+] deno|25 days ago|reply
> The EU is working on a type of digital ID that an age-restricted platform would ask for, which only gives the platform the age information and no further PII.

Sure, it might start out that way, but once adoption reaches anything critical the PII will be required to squash free speech as soon as possible. But by then the interaction flow will be familiar, hardly anyone will even notice, never mind care.

The EU has the best frog boiling experts in the world.

[+] mendyberger|25 days ago|reply
> Comparing today's internet to the 90s is hardly fair. It has become extremely predatory...

I think you're missing the point they're trying to make. It's not that the problem isn't real, it's that the solution won't work. Kids will find a way around. They have a lot more free time than us.

[+] colinmarc|25 days ago|reply
I'm surprised by the complete lack of dissent or even nuance in the discussion here. I'm much more ambivalent on this: the historical record for prohibition is not good, but instagram and the like are uniquely and disastrously harmful and the companies pushing them on children are powerful in a way that has no real historical precedent. In the balance, anything the reduces the power those companies have over our lives (and our politics) has to be at least considered. In other words, I don't think this is necessarily the right measure - but I'm desperate.

Didn't regulating cigarettes kind of work?

[+] hananova|25 days ago|reply
I can't fathom all the rage and confusion here about these laws. It's been a well-known effect since forever that when a government deems that something needs to be done, they'll go for the first "something-shaped" solution.

This all could've been avoided. Governments all over the world have been ringing the alarm bells about lack of self-regulation in tech and social media. And instead of doing even a minimum of regulation, anything to calm or assuage the governments, the entire industry went balls-to-the-wall "line go up" mode. We, collectively, only have ourselves to blame, and now it's too late.

If you look back, it didn't have to be this way: - Governments told game publishers to find a system to handle age rating or else. The industry developed the ESRB (and other local systems), and no "or else" happened. - Governments told phone and smart device manufacturers to collectively standardize on a charging standard, almost everyone agreed on USB-C and only many years later did the government step in and force the lone outlier to play ball. If that one hadn't been stubborn, there wouldn't have been a law.

The industry had a chance to do something practical, the industry chose not to, and now something impractical (but you better find a way anyway, or else) will be forced upon them. And I won't shed a tear for the poor companies finally having to do something.

[+] shevy-java|25 days ago|reply
> We, collectively, only have ourselves to blame, and now it's too late.

Why would we have to be blamed for a law written by some lobbyists? That makes no sense at all. There are of course some folks that are in favour of this because "of the children" but their rationale does not apply to me nor to many other people. Why should they be able to force people to surrender their data, with the operating system becoming a sniffer giving out private data to everyone else? That makes no sense.

[+] Jean-Papoulos|25 days ago|reply
> We, collectively, only have ourselves to blame, and now it's too late.

Can't believe I'm reading this. I don't want age verification at all, whether it's self-imposed or not. I should be free to use whatever tools I want however I want.

[+] txrx0000|25 days ago|reply
Rather than age verification, this is what we should be doing instead:

Don't let phone manufacturers lock the bootloader on phones. Let the device owner lock it with a password if they decide to. Someone will make a child-friendly OS if there is demand. Tech-savvy parents should be able to install that on their kid's phone and then lock the bootloader.

What about non-tech-savvy parents?

There should be a toggle in the phone's settings to enable/disable app installation with a password, like sudo. This will let parents control what apps get installed/uninstalled on their kid's device.

But what about apps or online services that adults also use?

Apps and online services can add a password-protected toggle in their user account settings that enables child mode. Parents can take their child's phone, enable it, and set the password.

----

All it takes is some password-protected toggles. They will work better than every remote verification scheme.

The only problem with this solution is that it does not help certain governments build their global mass surveillence and propaganda apparatus, and tech companies can't collect more of your personal info to sell, and they can't make your devices obsolete whenever they want.

[+] jdashg|23 days ago|reply
We all demand Windows but without ads, but that doesn't cause the market to spit one out. The OS market isn't a healthy market, and government is stepping in here in part because of that market failure to provide a satisfactory solution here.
[+] Aachen|24 days ago|reply
This approach makes sense to me, though I'd expand password to be a broader term because people might prefer different authentication methods or approving a request to install software from their own device or so
[+] gzread|25 days ago|reply
Why necessarily with a password - what's wrong with the option to say "only allow installation of apps suitable for under 13s"?
[+] heavyset_go|25 days ago|reply
Just a reminder of what liability the CA age verification law imposes upon developers and providers.

It's not enough to adhere to the OS age signal:

> (3) (A) Except as provided in subparagraph (B), a developer shall treat a signal received pursuant to this title as the primary indicator of a user’s age range for purposes of determining the user’s age.

> (B) If a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant to this title, the developer shall use that information as the primary indicator of the user’s age.

Developers are still burdened with additional liability if they have reason to believe users are underage, even if their age flag says otherwise.

The only way to mitigate this liability is to confirm your users are of age with facial and ID scans, as it is implemented across platforms already. Not doing so opens you up to liability if someone ever writes "im 12 lol" on your app/platform.

[+] ibizaman|25 days ago|reply
> The challenges we face are neither technical nor legal. The only solution is to educate our children about life with digital abundance. Throwing them into the deep end when they’re 16 or 18 is too late. It’s a wonderful and weird world. Yes, there are dark corners. There always will be. We have to teach our children what to do when they encounter them and we have to trust them.

This resonates so much with me. I don’t want to control my kids. I will never be able to protect them from everything. I hope I won’t be able because I want to die before them. I want them to be able to navigate in the world and have all the cognitive tools necessary to avoid being fooled. I want to rest in peace knowing they can in turn educate their own children. I want to trust them and be relieved that I can focus on some tasks of my own without needing to constantly worry about them.

[+] hellojesus|25 days ago|reply
Are these laws not 1A violations due to code being speech and the gov not being allowed to compel speech?
[+] sp1rit|25 days ago|reply
I wonder who is behind this sudden push for these age verification laws. This wasn't an issue until recently and suddenly there are not just laws in California and Colorado, but also New York and Brazil.
[+] kevincloudsec|25 days ago|reply
requiring the OS to broadcast an age bracket to every app and website is building a new tracking vector and calling it child safety lol
[+] drnick1|25 days ago|reply
California may be able to target companies like System76, but it will be completely powerless against modular and decentralized distros like Debian and Arch.
[+] Aldipower|25 days ago|reply
Yeah, living in Europe it simply makes me scratching my head how this law could affect me. It won't. No Californian law will tell me what I should do.
[+] saltysalt|25 days ago|reply
It's sad to see such big brother crap in Linux, which sees like the exact opposite of the hacker ethos it was originally built upon.
[+] IndySun|25 days ago|reply
"Liberty has costs, but it’s worth it"

The whole point. Very well worded post. I weep for the all digital future.