7 ms·

It should be externalized to a degree. Facebook shouldn't be the ones verifying age, but there should be a trusted 3rd party service that does that, which just

by mgfist 7mo ago

It should be externalized to a degree. Facebook shouldn't be the ones verifying age, but there should be a trusted 3rd party service that does that, which just tells facebook "yes this user is old enough to use your service" or "no they're not old enough". It abso-fucking-lutely should not be at the OS level though, for so many reasons. Even the implementation alone would be a nightmare. Do I need to input my ID to use a fridge or toaster oven? Ridiculous.

pianoben 7mo ago
Or, and hear me out, _maybe our computers shouldn't spy on us in the first place_?
- jachee 7mo ago
  “Impossible to get a man to understand a thing, when his paycheck depends on his not understanding it.”
- ToucanLoucan 7mo ago
  I'm reminded of a video essay I watched about AI once, which took a side tangent into surveillance capitalism: "Google's data harvesting operation became a load bearing piece of the Internet before the public understood digital privacy. And now we can't get rid of it." The public has been conditioned to expect web services free at point of use. Legitimately it's hard to monetize things like YouTube without ads, and I get that. But turning our entire ecosystem of tech into a massive surveillance mini-state seems like an astonishingly shitty idea compared to just... finding a way to do advertising that DOESN'T involve 30 shadowy ad companies knowing your resting blood pressure. My otherwise creative and amazing industry seems utterly unwilling to confront this. Edit: Like, I don't know, am I crazy for thinking that simply because we can target ads this granularity, that it simply must be that? I get that the ad-tech companies do not want to go back to blind-firing ads into the digital ether on the hope that they'll be seen, but that's also plus or minus the entirety of the history of advertising as an industry, with the last 20 or so years being a weird blip where you could show your add to INCREDIBLY specific demographics. And I wouldn't give a shit except the tech permitting those functions seems to be socially corrosive and is requiring even further erosion of already pretty porous user privacy to keep being legally tenable.
  - adi_kurian 7mo ago
    You are not crazy for thinking that. However it appears that it takes pretty disasterous consequences for us to be able to walk anything back.
  - halfcat 7mo ago
    Society won’t delay reward now for future good on its own. Even if one person will, there’s a line of people who will step in to pollute the lake or kill the whales for a bag of money. It will just decay until it’s a short squeeze into oligarchy or worse (the corrupt will be forced into an arms race of accelerating corruption as opportunity becomes scarce). Then some other country who isn’t leaving it up to their society to do the right thing will be in charge. Until the same happens to them. This is the value of religion historically, one of the few ways of coercing a population into doing the right thing for their own good. But every group can be spoiled or hijacked by a small handful of bad actors who are willing to do what others are not.
- deleted 7mo ago
  [deleted]
- Dylan16807 7mo ago
  So which situation do you want instead of anonymous age verification: A) 18+ content is behind a pinky swear B) 18+ content is behind a parental control (what this bill would do) C) The internet can't have 18+ content anymore D) Some other system? Please describe it.
  - roenxi 7mo ago
    Does "the government doesn't get to decide what people can look at on the internet" count as C or D to you? It is the situation we've been in technically for 20 years now anyway; the world hasn't ended and it generally seems to be pretty workable. The status quo isn't an especially radical one.
    - fcarraldo 7mo ago
      20 years ago was only 2006. The internet has been around for much longer. The first consumer focused ISPs launched in the early 90’s, 35 years ago, but CompuServe and others were providing access to chat and BBS’s in the 80s. I’d say nearly 50 years is precedent enough that government intervention is unnecessary.
      - roenxi 7mo ago
        Yeah but most people weren't on the internet access in the early 90s. It is more a 2005+ phenomenon. https://en.wikipedia.org/wiki/Global_Internet_usage https://en.wikipedia.org/wiki/Global_Internet_usage
  - ekidd 7mo ago
    (A), honestly. You might think you can keep 16 year olds from looking at porn, if they want to. You can't. You have never been able to. All you can do is teach them that the law is stupid and pointless, and they should treat rules with contempt. But they'll still be able to look at porn. What you can do is allow the government and private companies to track everyone, everywhere, all the time. And you can create more gatekeepers that hold personal identity data, misuse it, and leak it.
- gloosx 7mo ago
  It's not the gun that kills. It's not the computer that spies.
- xtiansimon 7mo ago
  Once you force OS to communicate data about the user, here we’re talking age, is it a slippery slope? Once the architecture is created, why not put other things about you in there?
- dadysgirl1 7mo ago
  Agreed! We shouldn't be because wouldn't we go to jail for shit like that if it were you or I?
inkysigma 7mo ago
Except none of these bills (California or the one in question) as currently written require an ID to actually be verified, merely that the user provide an age. This seems intentional as it's seems to solve the user journey where a parent is able to set a reasonable default by simply setting up an associated account age at account creation. It's effectively just standardizing parental controls. I think this is a reasonable balance without being invasive as there's now a defined path to do reasonable parenting without being a sysadmin and operators cannot claim ignorance because the user input a random birthday. The information leaked is also fairly minimal so even assuming ads are using that as signal, it doesn't add too many bits to tracking compared to everything else. I think the California bill needs a bit of work to clarify what exactly this applies to (e.g. exclude servers) but I also think this is a reasonable framework to satisfy this debate. I've seen the argument that this could lead to actual age verification but I think that's a line that's clearly definable and could be fought separately.
- bink 7mo ago
  Kids aren't stupid. They'll just create another account when they're old enough to figure it out. They'll tell their friends how to do it and the rest of us will be stuck with these stupid prompts forever like it's a cookie banner.
  - inkysigma 7mo ago
    Actually given boot chain protection, this will probably get harder as time goes on but even assuming some kids are able to, this is clearly definable as a user error: the fault lies with the kid and as a parent you need to think about your threat model. Right now, it's not even clear how to create parental controls at a reasonable level so there's no clear path for what to do or how to respond.
  - lich_king 7mo ago
    So you're advocating for stronger and more invasive controls?... I think this is a sensible compromise. It gives parents more control than before without relying on shady third-party software or without turning every platform into a cop. Yeah, it also aligns with Meta's interests, but so what? The age attestation solutions pursued by the EU are far more invasive in this respect, even though they notionally protect identity. They mean that the "default" internet experience is going to be nerfed until you can present a cryptographic proof that you're worthy.
FuckButtons 7mo ago
And just which third party do you trust with your identity?
eecc 7mo ago
I guess the point is: delegate to kernel, then “oh, people with root can bypass with modules? Secure Boot!”
- newdee 7mo ago
  And then only trusted devices with an “acceptable” posture and valid manufacturer attestation can participate! Hellscape.
- bergfest 7mo ago
  This is exactly what will happen.
inetknght 7mo ago
> It should be externalized to a degree. Why? We don't externalize age verification when buying alcohol or visiting the strip club. It's on the responsibility of those establishments to verify age.
- pstuart 7mo ago
  Do we make contractors do age verification on their supplies when building a liquor store or strip club? The OS is a tool used by Meta, just like the utilities and the compute itself. Meta Apps can have age verification but it should be at the point of service, not the supply chain. And even if we were to agree to this, uploading your IDs to an untrusted third party is asking too much.
  - alistairSH 7mo ago
    uploading your IDs to an untrusted third party is asking too much. So have the government do it? They already know who we are and when we were born.
    - kevin_thibedeau 7mo ago
      That requires trusting a government with a power that is likely to be abused.
      - ToucanLoucan 7mo ago
        The power to tell people how old someone is?
        mgulick 7mo ago
        The power of correlating your real ID with your browsing activity on the internet.
        ToucanLoucan 7mo ago
deleted 7mo ago
[deleted]
mindslight 7mo ago
A different approach that would keep incentives properly aligned is for Facebook (et al) to publish labels in website headers asserting the age (and other) suitability of content on various sections of the site. It would then be up to client software (eg a browser) to refuse to display sites that are unsuitable for kids on devices that have been configured for kid use. As there has been a market failure for decades at this point, it would be reasonable to give this a legislative nudge - spelling out the specific labels, requiring large websites to publish the appropriate labels, and requiring large device manufacturers to include parental controls functionality. The labels would be defined such that a website not declaring labels (small, foreign, configuration mistake, etc) would simply not be shown by software configured with parental controls, preserving the basic permissionless nature of the Internet we take for granted. But as it stands, this mandate being pushed is horribly broken - both for subjecting all users to the age verification regime, and also for being highly inflexible for parents who have opinions about what their kids should be seeing that differ from corporate attorneys!
themafia 7mo ago
> Facebook shouldn't be the ones verifying age So, they want to profit off children, but do nothing to protect them? > but there should be a trusted 3rd party service that does that Gee, if only Facebook would use their incredible might to create this, rather than trying to rob our representative government from underneath us. > It abso-fucking-lutely should not be at the OS level though It's not my problem. It shouldn't involve me at all. I don't use social media and I think if you let your kids on there unsupervised you have a screw loose.
midnitewarrior 7mo ago
I want to be able to hire a licensed Identity Service Provider that gets all of my verified identity data in an encrypted token and let me register it with the OS, and control what amount of the data I expose to apps, with age verification being one of the lower levels of access. I pay the company to verify me, I am their customer. They take on the liability of the OS makers and app makers of age verification. If you have a valid token signed by a licensed IDS that verified your age in your OS, that's all anyone needs to know.
mech422 7mo ago
I'm surprised that people think this is some new 'save-the-children' thing ? Didn't Zuck say like 10 years ago, you should not be allowed to be anonymous on the internet ? This just seems on-brand at this point.
kazinator 7mo ago
> but there should be a trusted 3rd party service that does that No, there shouldn't be any such thing; everyone pushing for any shape of this should just bugger off.
davorak 7mo ago
> trusted 3rd party service So we have to pay some 3rd party service to hoard information about Children? Why we want to set that up? Why would we want to take that power from the parents and give it to some company?
DANmode 7mo ago
The trusted third-party is, in part, meant to be a society of responsible parents.
dangus 7mo ago
The porn industry already figured this out and it’s super simple. Requires zero personal information. https://www.rtalabel.org/index.html https://www.rtalabel.org/index.html
9991 7mo ago
Yea, it's called Mom & Dad.
kajaktum 7mo ago
If social media, alcohol, drugs, gambling, phones are so, so, so bad for children. Just ban them from children. We were completely fine 30 years ago without any phone. They will survive. They will probably thrive because now they have to learn how to hack the system. Instead, we just give them everything they need and all the thinking they do is scrolling.
- pjmlp 7mo ago
  On the 50's, it is incredible the proctective bubble that gets pushed around in some countries nowadays, externalizing all responsabilities.

by mgfist 7mo ago

pianoben 7mo ago

Or, and hear me out, _maybe our computers shouldn't spy on us in the first place_?

jachee 7mo ago
“Impossible to get a man to understand a thing, when his paycheck depends on his not understanding it.”
ToucanLoucan 7mo ago
I'm reminded of a video essay I watched about AI once, which took a side tangent into surveillance capitalism: "Google's data harvesting operation became a load bearing piece of the Internet before the public understood digital privacy. And now we can't get rid of it." The public has been conditioned to expect web services free at point of use. Legitimately it's hard to monetize things like YouTube without ads, and I get that. But turning our entire ecosystem of tech into a massive surveillance mini-state seems like an astonishingly shitty idea compared to just... finding a way to do advertising that DOESN'T involve 30 shadowy ad companies knowing your resting blood pressure. My otherwise creative and amazing industry seems utterly unwilling to confront this. Edit: Like, I don't know, am I crazy for thinking that simply because we can target ads this granularity, that it simply must be that? I get that the ad-tech companies do not want to go back to blind-firing ads into the digital ether on the hope that they'll be seen, but that's also plus or minus the entirety of the history of advertising as an industry, with the last 20 or so years being a weird blip where you could show your add to INCREDIBLY specific demographics. And I wouldn't give a shit except the tech permitting those functions seems to be socially corrosive and is requiring even further erosion of already pretty porous user privacy to keep being legally tenable.
- adi_kurian 7mo ago
  You are not crazy for thinking that. However it appears that it takes pretty disasterous consequences for us to be able to walk anything back.
- halfcat 7mo ago
  Society won’t delay reward now for future good on its own. Even if one person will, there’s a line of people who will step in to pollute the lake or kill the whales for a bag of money. It will just decay until it’s a short squeeze into oligarchy or worse (the corrupt will be forced into an arms race of accelerating corruption as opportunity becomes scarce). Then some other country who isn’t leaving it up to their society to do the right thing will be in charge. Until the same happens to them. This is the value of religion historically, one of the few ways of coercing a population into doing the right thing for their own good. But every group can be spoiled or hijacked by a small handful of bad actors who are willing to do what others are not.
deleted 7mo ago
[deleted]
Dylan16807 7mo ago
So which situation do you want instead of anonymous age verification: A) 18+ content is behind a pinky swear B) 18+ content is behind a parental control (what this bill would do) C) The internet can't have 18+ content anymore D) Some other system? Please describe it.
- roenxi 7mo ago
  Does "the government doesn't get to decide what people can look at on the internet" count as C or D to you? It is the situation we've been in technically for 20 years now anyway; the world hasn't ended and it generally seems to be pretty workable. The status quo isn't an especially radical one.
  - fcarraldo 7mo ago
    20 years ago was only 2006. The internet has been around for much longer. The first consumer focused ISPs launched in the early 90’s, 35 years ago, but CompuServe and others were providing access to chat and BBS’s in the 80s. I’d say nearly 50 years is precedent enough that government intervention is unnecessary.
    - roenxi 7mo ago
      Yeah but most people weren't on the internet access in the early 90s. It is more a 2005+ phenomenon. https://en.wikipedia.org/wiki/Global_Internet_usage https://en.wikipedia.org/wiki/Global_Internet_usage
- ekidd 7mo ago
  (A), honestly. You might think you can keep 16 year olds from looking at porn, if they want to. You can't. You have never been able to. All you can do is teach them that the law is stupid and pointless, and they should treat rules with contempt. But they'll still be able to look at porn. What you can do is allow the government and private companies to track everyone, everywhere, all the time. And you can create more gatekeepers that hold personal identity data, misuse it, and leak it.
gloosx 7mo ago
It's not the gun that kills. It's not the computer that spies.
xtiansimon 7mo ago
Once you force OS to communicate data about the user, here we’re talking age, is it a slippery slope? Once the architecture is created, why not put other things about you in there?
dadysgirl1 7mo ago
Agreed! We shouldn't be because wouldn't we go to jail for shit like that if it were you or I?

inkysigma 7mo ago

Except none of these bills (California or the one in question) as currently written require an ID to actually be verified, merely that the user provide an age. This seems intentional as it's seems to solve the user journey where a parent is able to set a reasonable default by simply setting up an associated account age at account creation. It's effectively just standardizing parental controls. I think this is a reasonable balance without being invasive as there's now a defined path to do reasonable parenting without being a sysadmin and operators cannot claim ignorance because the user input a random birthday. The information leaked is also fairly minimal so even assuming ads are using that as signal, it doesn't add too many bits to tracking compared to everything else. I think the California bill needs a bit of work to clarify what exactly this applies to (e.g. exclude servers) but I also think this is a reasonable framework to satisfy this debate. I've seen the argument that this could lead to actual age verification but I think that's a line that's clearly definable and could be fought separately.

bink 7mo ago
Kids aren't stupid. They'll just create another account when they're old enough to figure it out. They'll tell their friends how to do it and the rest of us will be stuck with these stupid prompts forever like it's a cookie banner.
- inkysigma 7mo ago
  Actually given boot chain protection, this will probably get harder as time goes on but even assuming some kids are able to, this is clearly definable as a user error: the fault lies with the kid and as a parent you need to think about your threat model. Right now, it's not even clear how to create parental controls at a reasonable level so there's no clear path for what to do or how to respond.
- lich_king 7mo ago
  So you're advocating for stronger and more invasive controls?... I think this is a sensible compromise. It gives parents more control than before without relying on shady third-party software or without turning every platform into a cop. Yeah, it also aligns with Meta's interests, but so what? The age attestation solutions pursued by the EU are far more invasive in this respect, even though they notionally protect identity. They mean that the "default" internet experience is going to be nerfed until you can present a cryptographic proof that you're worthy.

FuckButtons 7mo ago

And just which third party do you trust with your identity?

eecc 7mo ago

I guess the point is: delegate to kernel, then “oh, people with root can bypass with modules? Secure Boot!”

newdee 7mo ago
And then only trusted devices with an “acceptable” posture and valid manufacturer attestation can participate! Hellscape.
bergfest 7mo ago
This is exactly what will happen.

inetknght 7mo ago

> It should be externalized to a degree. Why? We don't externalize age verification when buying alcohol or visiting the strip club. It's on the responsibility of those establishments to verify age.

pstuart 7mo ago
Do we make contractors do age verification on their supplies when building a liquor store or strip club? The OS is a tool used by Meta, just like the utilities and the compute itself. Meta Apps can have age verification but it should be at the point of service, not the supply chain. And even if we were to agree to this, uploading your IDs to an untrusted third party is asking too much.
- alistairSH 7mo ago
  uploading your IDs to an untrusted third party is asking too much. So have the government do it? They already know who we are and when we were born.
  - kevin_thibedeau 7mo ago
    That requires trusting a government with a power that is likely to be abused.
    - ToucanLoucan 7mo ago
      The power to tell people how old someone is?
      - mgulick 7mo ago
        The power of correlating your real ID with your browsing activity on the internet.
        ToucanLoucan 7mo ago

deleted 7mo ago

[deleted]

mindslight 7mo ago

A different approach that would keep incentives properly aligned is for Facebook (et al) to publish labels in website headers asserting the age (and other) suitability of content on various sections of the site. It would then be up to client software (eg a browser) to refuse to display sites that are unsuitable for kids on devices that have been configured for kid use. As there has been a market failure for decades at this point, it would be reasonable to give this a legislative nudge - spelling out the specific labels, requiring large websites to publish the appropriate labels, and requiring large device manufacturers to include parental controls functionality. The labels would be defined such that a website not declaring labels (small, foreign, configuration mistake, etc) would simply not be shown by software configured with parental controls, preserving the basic permissionless nature of the Internet we take for granted. But as it stands, this mandate being pushed is horribly broken - both for subjecting all users to the age verification regime, and also for being highly inflexible for parents who have opinions about what their kids should be seeing that differ from corporate attorneys!

themafia 7mo ago

> Facebook shouldn't be the ones verifying age So, they want to profit off children, but do nothing to protect them? > but there should be a trusted 3rd party service that does that Gee, if only Facebook would use their incredible might to create this, rather than trying to rob our representative government from underneath us. > It abso-fucking-lutely should not be at the OS level though It's not my problem. It shouldn't involve me at all. I don't use social media and I think if you let your kids on there unsupervised you have a screw loose.

midnitewarrior 7mo ago

I want to be able to hire a licensed Identity Service Provider that gets all of my verified identity data in an encrypted token and let me register it with the OS, and control what amount of the data I expose to apps, with age verification being one of the lower levels of access. I pay the company to verify me, I am their customer. They take on the liability of the OS makers and app makers of age verification. If you have a valid token signed by a licensed IDS that verified your age in your OS, that's all anyone needs to know.

mech422 7mo ago

I'm surprised that people think this is some new 'save-the-children' thing ? Didn't Zuck say like 10 years ago, you should not be allowed to be anonymous on the internet ? This just seems on-brand at this point.

kazinator 7mo ago

> but there should be a trusted 3rd party service that does that No, there shouldn't be any such thing; everyone pushing for any shape of this should just bugger off.

davorak 7mo ago

> trusted 3rd party service So we have to pay some 3rd party service to hoard information about Children? Why we want to set that up? Why would we want to take that power from the parents and give it to some company?

DANmode 7mo ago

The trusted third-party is, in part, meant to be a society of responsible parents.

dangus 7mo ago

The porn industry already figured this out and it’s super simple. Requires zero personal information. https://www.rtalabel.org/index.html https://www.rtalabel.org/index.html

9991 7mo ago

Yea, it's called Mom & Dad.

kajaktum 7mo ago

If social media, alcohol, drugs, gambling, phones are so, so, so bad for children. Just ban them from children. We were completely fine 30 years ago without any phone. They will survive. They will probably thrive because now they have to learn how to hack the system. Instead, we just give them everything they need and all the thinking they do is scrolling.

pjmlp 7mo ago
On the 50's, it is incredible the proctective bubble that gets pushed around in some countries nowadays, externalizing all responsabilities.