11 ms·

The one and only method I will participate in is server operators setting a RTA header [1] for URL's that may contain adult or user-generated or user-contribute

by Bender 6mo ago

The one and only method I will participate in is server operators setting a RTA header [1] for URL's that may contain adult or user-generated or user-contributed content and the clients having the option to detect that header and trigger parental controls if they are enabled by the device owner. That should suffice to protect most small children. Teens will always get around anything anyone implements as they are already doing. RTA headers are not perfect, nothing is nor ever will be but there is absolutely no tracking or leaking data involved. Governments could easily hire contractors to scan sites for the lack of that header and fine sites not participating into oblivion. I a small server operator and a client of the internet will not participate in any other methods period, full-stop. Make simple logical and rational laws around RTA headers and I will participate. Many sites already voluntarily add this header. It is trivial to implement. Many questions and a lengthy discussion occurred here [1]. I doubt my little private and semi-private sites would be noticed but one day it may come to that at which point it's back into semi-private Tinc open source VPN meshes for my friends and I. [1] - https://news.ycombinator.com/item?id=46152074 https://news.ycombinator.com/item?id=46152074

big85 6mo ago
Back in the late 90s or so, there was a proposal to have sites voluntarily set an age header, so parents/employers/etc could use to block the site if they wish. People said it would never work, because adult sites had a financial incentive not to opt in to reduce their own traffic.
- Bender 6mo ago
  What I am suggesting could address most of that. If they do not participate they get fined. The government loves to fine companies. This assumes they put enough "teeth" into a law that prevents companies from accepting fines as the cost of doing business. This would also require legislation that could block sites that operate from countries that do not cooperate with US laws. Mandatory subscriptions to BGP AS path filters, CDN block-lists which already exist, etc... People could still bypass such restrictions with a VPN but that would not apply to most small children. Sanctions and embargoes are always an option.
  - Barbing 6mo ago
    >fined Exactly. If you’re hurting kids to make more money selling porn videos, straight to jail. I’m glad there are solutions that won’t ruin the Internet. Now the uphill battle to convince our legislators (see: encryption & fundamentally technically ignorant calls for backdoors). I’m here to die on this hill!
- iamnothere 6mo ago
  You’d think that one could simply block sites that don’t have the age header set on child computers. This may block kids from hobbyist sites that don’t bother to set their headers as kid-friendly, but commercial sites would surely set their headers properly. Over time sending proper rating headers would become more normalized if they were in common use. This still isn’t perfect, as it creates an incentive for legislators to criminalize improper age header settings and legislate what is considered kid-appropriate. But it’s still better than this age verification crap.
  - Scaled 6mo ago
    Yes, that's how parental filters already work. They use a combination of rta tags and external data to block pages. Even works with Google safe search, firewall devices, etc. The rta ecosystem is already built out and viable.
    - nativeit 6mo ago
      I think the better tack is to stop acting like these laws are being pushed by honest actors with good faith intentions of protecting children.
  - ryandrake 6mo ago
    An age header is not the answer. Why should a site have to decide what content is appropriate for a 18 year old and what content is not? Who is qualified to make that decision for every 17 year old in the world? Do they know my 17 year old? Do they know the rules in our home? What if I'm OK with my kid seeing sex-education stuff, but some lawyer at Wikipedia just decides to tag sex ed articles as 18+? Now I have a shitty choice: Open up the floodgates of "18+" to my kid, do it temporarily while the kid browses the sex ed sites, or not let the kid browse them. Letting a company or government decide what's appropriate for what exact specific age is fraught with problems.
    - chlorodose 6mo ago
      Then this leads to a very unwelcome view that most of the problems we face are actually rooted in parents' unwillingness to invest too much time in education :)
- Lammy 6mo ago
  > Back in the late 90s or so, there was a proposal This one: https://www.w3.org/PICS/ https://www.w3.org/PICS/
  - Bender 6mo ago
    PICS was very complicated and attenpted to cover all possible "categories" of adult content. It was confusing, incomplete and only a handful of sites voluntarily labelled their sites with it. RTA is one simple static header that any site operator could add in seconds unless they get more complicated with it by dynamically adding it to individual videos say, on Youtube which means in that case the server application would need to send that header for any video tagged as adult. I added PICS to my forums but it was missing many categories of adult content. I ended up just selecting everything as I could not predict what people may upload which made for a very long header.
    - dylan604 6mo ago
      > unless they get more complicated with it by dynamically adding it to individual videos say, on Youtube YT already does this. I never watch YT signed in, and I often see videos that require you to be logged in as the video is age restricted.
      - Bender 6mo ago
        Agreed though in my example the point would be to set the header in the case the child is logged in but for whatever reason the site does not know their age. Instead of a third party site, a header is sent with the video tagged as adult that triggers parental controls if they are enabled by the device owner.
- masfuerte 6mo ago
  The porn companies already set the RTA header. It was designed by an organisation funded by the porn companies. https://en.wikipedia.org/wiki/Association_of_Sites_Advocating_Child_Protection https://en.wikipedia.org/wiki/Association_of_Sites_Advocatin...
  - motbus3 6mo ago
    It seems there is a GitHub repo somewhere mapping Meta money to lobbyists inside other companies Which is at least interesting
    - bryan_w 6mo ago
      That was created by AI. Ai is great at playing six degrees of Kevin Bacon
- thesuitonym 6mo ago
  What, in the same way movie studios wouldn't comply with the Hayes Code, or comic book publishers wouldn't comply with the CCA, or games publishers wouldn't comply with the ESRB? The financial incentive is to police yourself, because government policing is much, much worse.
  - nine_k 6mo ago
    There's a great relevant quip: "If you think that the cost of compliance is high, try noncompliance".
    - californical 6mo ago
      If only it were true today :|
  - breezybottom 6mo ago
    Sure but the government doesn't police corporations in the US anymore. The Hayes code was before neoliberalism.
    - shevy-java 6mo ago
      Quite true. The US corporations act like a giant global rabid dog. Fake legislation appears in the USA - lo and behold, it is copy/pasted into the EU. At the least lobbyists are getting rich right now.
      - htek 6mo ago
        At least the EU has GDPR. In the US, our personal data is collected by every app and website and company and packaged, sold and sifted through by a vast collection of private data brokers which the government already ingests.
    - flumes_whims_ 6mo ago
      The Hayes code wasn't policed by the government.
- btilly 6mo ago
  People were wrong. We pay money online mostly through credit cards. Credit card transactions can be reversed. If children spend money on porn, those payments are likely to be reversed. This is really bad for the ability of the porn sites to continue receiving credit card payments, and continue making money. An age header is a trivial step that can reduce the odds of the adult site receiving payments that later get reversed. Win, win. But if someone is willing and able to pay, then the adult industry wants the choice of whether to access content to be up to them. If government tries to regulate them, they'll engage in malicious compliance - do the minimum to not be sued, in a way that they can still reach customers. For example Utah tried to institute age verification. The porn industry blocked all IP addresses from Utah. Business boomed for VPN companies in Utah. Everyone, including porn companies, knows that a lot of that is for porn. But if you show up with a Nevada IP address, the porn's position is, "You're in Nevada. Utah law doesn't apply." Even if the credit card has a Utah zip code. If you live in Utah, and you're able to purchase a VPN, the porn companies want your money.
  - scythe 6mo ago
    >But if someone is willing and able to pay If someone is willing and able to pay, they have a source of money. If they aren't allowed to buy something, that control should be applied at the level where they get the money. If the child is using an adult's credit card, responsibility lies with the adult. If children need to have their own credit cards, the obvious point of control is the credit card itself. But also, most porn is ad-supported, pirated or free. Directly paid content is a small fraction. So all of this is moot for porn.
  - numpad0 6mo ago
    There was a random comment here on HN few days back that adult contents have lower chargeback rates than everything else. So ig stop spreading hallucinatory misinformations?
    - fragmede 6mo ago
      link?
    - 6mo ago
_ink_ 6mo ago
How are they supposed to fine sites out of their jurisdiction?
- Bender 6mo ago
  One possible method [1] though I am sure the network and security engineers here on HN could come up with simpler methods. Just blocking domains on the popular CDN's would kill access for most people as by default most browsers are using them for DoH DNS. [1] - https://news.ycombinator.com/item?id=47950843 https://news.ycombinator.com/item?id=47950843
  - filoleg 6mo ago
    The question was about fining entities outside of the original jurisdiction, so I am not sure what you have in mind that could be done by network/security engineers here.
    - Bender 6mo ago
      In terms of fines if they do not pay the fine their country is at risk of sanctions or embargoes which is probably a bit heavy handed but may incentivize their government to also enforce the rules, collect fines keeping some for themselves and passing the original fine back to the countries implementing child safety controls.
      - filoleg 6mo ago
        This is extremely naive and short-sighted. There is a literal example of this happening rn, and hopefully you will see why your approach isn't that good. UK's OFCOM is currenly issuing legal threats to 4chan, for allegedly serving adult content and not willing to implement age verification. 4chan's lawyer tells them to pound sand[0], on the basis that 4chan is hosted in the US and has zero business presence in the UK, and UK is more than welcome to ban the website on their end through UK ISPs. The saga has been ongoing for a while, and the lawyer has been pretty prolific online talking about the case. Anyway, following your approach, UK should embargo US over 4chan not willing to implement age verification as required by UK law? I plainly don't see this happening, or even being considered, ever. 0. https://www.bbc.com/news/articles/c624330lg1ko https://www.bbc.com/news/articles/c624330lg1ko
duped 6mo ago
This doesn't address the wider array of age-verification related problems that people want to solve, like social media where age verification is needed to police interactions between users.
- svachalek 6mo ago
  This is assuming children should be on social media at all, which I for one would debate.
- Bender 6mo ago
  I could be misunderstanding the context but to me that sounds like a moderation issue assuming we even want small children on social media in the first place. There should probably be a dedicated child-safe social media site that limits what communication can take place for small children and has severe punishments for adults pretending to be children for the purposes of grooming.
  - duped 6mo ago
    Moderation is like law enforcement, it doesn't prevent crimes from happening it just punishes the people they can catch. There exist severe punishments for the kinds of behavior I'm talking about, but unsurprisingly, this does not stop kids from being harmed and it doesn't undo it. This isn't hypothetical, by the way. There are adults catfishing kids into producing CSAM [0], kidnapping and assaulting minors [1], [2], and in the most extreme case, there's a borderline cult of crazy young adults who do terrorize people for fun [3]. It is a constant game of whackamole by moderators/admins to keep this behavior out of online spaces where kids hang out. I recognize that this is a "think of the children" argument, but indeed that's the point. The anonymous web was created without thinking about the children, just like how all social media was created without thinking about how it could be used to harm people. Age verification is the smallest step towards mitigating that harm. Now I disagree very strongly with the laws proposed (and indeed, I've been writing/calling/talking with state reps about this locally, because I don't want my state's bill passed). But the technical challenge needs to address the real problems that legislators are trying to go after. [0] https://www.justice.gov/usao-wdnc/pr/discord-user-who-catfished-young-victims-sentenced-21-years-prison-production-child https://www.justice.gov/usao-wdnc/pr/discord-user-who-catfis... [1] https://www.nbcnews.com/news/us-news/kidnapping-roblox-rcna201795 https://www.nbcnews.com/news/us-news/kidnapping-roblox-rcna2... [2] https://www.nbcmiami.com/news/local/nebraska-man-charged-with-kidnapping-florida-sisters-after-talking-to-them-on-roblox-sheriff/3758900/ https://www.nbcmiami.com/news/local/nebraska-man-charged-wit... [3] https://www.fbi.gov/contact-us/field-offices/boston/news/open-letter-to-parents-guardians-and-caregivers https://www.fbi.gov/contact-us/field-offices/boston/news/ope...
hooverlabs 6mo ago
Servers can then infer user’s ages by whether or not the client renders pages given those headers or not no? See if secondary page requests (e.g images, scripts) are made or not from a client? A bad actor could use this to glean age information from the client and see whether the person viewing the page is a small child. That should be scary
- Bender 6mo ago
  I disagree. The ability to render a page could simply mean that parental controls were not enabled on the device. Some parents have assessed the situation and trust their children to be psychologically ready for adult situations. The client could be literally any age. Today devices do not default to accounts being child accounts. Some day this may change and may require an initial administrator password or something to that affect but this can evolve over time.
  - NoMoreNicksLeft 6mo ago
    >I disagree. The ability to render a page could simply mean that parental controls were not enabled on the device. Not being able to detect all children doesn't mean that being able to detect 80% of them is somehow less disturbing.
    - Bender 6mo ago
      The point and overall goal should be to not signal anything to the server operator unless a credit card is being used. Everyone is whomever they claim to be as far as anyone is concerned, until payments are required which today means sharing identity and age (via the credit card information on file with the financial institution and is shared today). In the case of RTA the only signalling taking place is a server header being transmitted to the client. The client could be anyone at any age. Nothing to explicitly leak or disclose. Server operators can guess all they desire as some do using AI based on user behavior of which they sometimes get wrong.
      - 6mo ago
kevin_thibedeau 6mo ago
> fine sites not participating into oblivion. That would also amount to compelled speech.
- Bender 6mo ago
  That would also amount to compelled speech. I disagree. The legal requirement to apply a warning label is a well known, understood and accepted process that is applied to a myriad of hazards to children and adults. As just one example businesses in some states, most notably California are compelled to add warning labels to foods and other products that could cause cancer.
  - sailfast 6mo ago
    Do you believe using the Internet should require a license? Isn’t that what covers these product warning labels?
    - Bender 6mo ago
      I never implied an internet license. Rather if a server operator a business has content that may be adult in nature they must label their site. Businesses require a license already but that is unrelated to this.
  - SpaceNoodled 6mo ago
    That's not the best example, since the levels set for Prop 65 warnings are so low that the warnings are effectively useless; every single commercial building in CA now somehow causes cancer.
    - Bender 6mo ago
      Surely we both understand the point I was making in that labels are already compelled by laws today. Fine, cigarettes must be labelled as being a risk of causing cancer. The punishment for failing to do this is both civil and federal penalties including massive fines and federal prison time.
traderj0e 6mo ago
Or could have a header saying this is not adult-only content, and a parentally-controlled device will block things that don't participate.
- Bender 6mo ago
  That's a good idea. There could be two headers, the existing RTA header that adult sites use today [1] and another static header that explicitly states there shall be no adult content. [1] - https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-RTA https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-R... [THESE ARE ADULT SITES, NSFW]
  - bluGill 6mo ago
    What is adult content? I know parents who have no problem with their kids seeing porn. I know parents who give their kids a beer. I know parents who take their kids to violent movies. I used to know parents who will give their kids cigarettes. Most parents I know will disagree with their kids doing one of the above. I know songs that were played on the radio in 1960 that would not be allowed today, even though today we allow some swearing on the radio.
    - Bender 6mo ago
      That's between parents and their local governments. Yes when I was a kid my mom let me watch whatever and go wherever. The parent in my example ultimately decides what a kid may or may not do which is in alignment with existing laws. If the parent is endangering their kid that is up to them and their government to sort out. Point being, put the controls entirely into the hands of the device owner. Options can be to default to: - Block everything by default unless header states otherwise. - Block only sites that state they are adult. - Do nothing. Obey the operator. (Controls disabled on child accounts or make them an adult or otherwise unrestricted account on the device). I think the options are just limited to our imagination.
      - ryandrake 6mo ago
crabbone 6mo ago
How would this work with sites like YouTube which allow sharing of content, potentially not appropriate for children, but the content is generated by the site's users? Who will be fined for "violations"? And how would such a fine be levied, especially internationally?
- Bender 6mo ago
  I think that initially the onus would be on Youtube to figure this out. They have some very intelligent engineers. For example, if the Youtube client is receiving affiliate funds then they are easy to ID and fine. If they are random people then Youtube would have to share the violation data with the other countries and the US or UK would have to pressure those countries to participate in fining the end user. There could be financial incentives for the foreign country to participate. They can also just force label a video to be adult as they do today when enough people report it which is admittedly not uniformly applied.
- Tanoc 6mo ago
  This already has been solved. Youtube disables viewing via embeds for any content that has been age restricted. Either you view it on Youtube which requires logging in to see age restricted content in the first place, or you get the ! icon and the warning about needing to log in.
kyledrake 6mo ago
Interesting, I've never heard of this. I see an example that involves an HTTP response header "Rating: RTA-5042-1996-1400-1577-RTA". But does this actually still get used by parental controls? I didn't run into a lot of documentation about this, including on the very badly designed RTA web site https://www.rtalabel.org/ https://www.rtalabel.org/ For anyone curious about the value, the numbering on the value is just a fixed number everybody decided to use for some reason that isn't clear to me. I would deeply prefer to do it this way, but my goodness the RTA org needs a serious brush up of their web site and information on how to use this.
- Bender 6mo ago
  But does this actually still get used by parental controls? Some parental control applications will look for it but it is not yet legislated to be mandatory on a majority of user-agents. All I am suggesting is we legislate the header to be added to URL's that may contain material not appropriate for small children and mandate the majority of user-agents the ones that are default installed on tablets and operating systems look for said header to trigger optional parental controls. Child accounts created by parents on the device should not be able to install alternate user-agents or bypass the controls (at least not easily). Parents should be guided through this on device setup. Indeed their site is old and rarely touched. The ideas and concepts have not changed. It really could just be a static text site formatted in ways that law makers are used to or someone could modernize it.
rpdillon 6mo ago
This is exactly the way it should be done. Device with parental controls enabled disables content client-side when the header is detected. As far as I can tell, it's a global optimum, all trade-offs considered.
- SoftTalker 6mo ago
  Well why haven't all the big tech companies done it then? They have only themselves to blame. They had years to fix the problem of inappropriate content being delivered to kids and their response was sticking their fingers in their ears and saying "blah blah blah parenting blah blah blah" And it really should be the opposite. Assume content is not kid-safe by default, and allow sites to declare if they have some other rating.
  - fc417fc802 6mo ago
    Because it isn't in their financial interest. They've either done nothing or actively lobbied for these ID laws. You can plausibly explain it in a number of ways, including regulatory capture, deanonimization, spam reduction, etc.
  - jonplackett 6mo ago
    The reason is that this whole push for age verification is nothing to do with actually stopping kids seeing the content. If it was then this kind of solution would be being legislated for. It’s just about making everyone identifiable.
    - slg 6mo ago
      >If it was then this kind of solution would be being legislated for. What's more likely a global conspiracy to get age verification passed to allow these unnamed groups to identify everyone for some unknown purpose or politicians just not understanding tech? The way people try to pretend that there can't be any organic desire for these proposals is so bizarre and is a major cause for all these proposed solutions being so technically dubious. Refusal to recognize the problem means you won't be part of solving the problem.
LooseMarmoset 6mo ago
An outstanding idea. Those lobbying for age verification hate it though, because they want to be the arbiters of age, and all that juicy PII that they can analyze and resell.
- phendrenad2 6mo ago
  I'm not so sure. I think the push is from the government actually. But companies are not exactly opposed to it. Quite the contrary. Big corporations see compliance as a moat. Tobacco companies supported stricter regulations on tobacco advertisements, because they had the deep pockets required to follow the changing laws. Mr. Altman is all-in on AI regulation, because it will mire down competitors while OpnAI has already "slipped past the wire" and done all their training pre-crackdown. When given a choice between regulating their industry (platforms and operating systems) vs regulating someone else's (porn sites and the like) they'll always helpfully "volunteer" to be the first to be regulated. It's just good business.
  - elliotec 6mo ago
    "The government" is the same as those lobbying the government. The people in the government get paid to push it, so they push it, and get paid more when it goes through, by the people who want that PII to analyze.
- intrasight 6mo ago
  What PII? They get a boolean "old enough"
  - LooseMarmoset 6mo ago
    Think about how they validate how old you are. Meta and Google, who are lobbying in support of this legislation,will force you to sign up with your real ID, and be the arbiter for questions like “are you old enough for this website”. For every request that you make through some third-party website that needs to know your age, Meta and Google will know where you tried to login, and for which content. They will then resell this data to the highest bidder. Additionally, through all their ad networks and tracking, they will follow your session and have verified ID to match your entire browsing history. This is the end of anonymity and privacy on the Internet.
snvzz 6mo ago
>I a small server operator and a client of the internet will not participate in any other methods period, full-stop. You will however follow the law if it mandates you to do else. Which is we "age verification" should be stopped before it's too late.
- tardedmeme 6mo ago
  Many people don't follow many laws, how do you know that person will follow that law?
- Bender 6mo ago
  I have probably never met anyone that is not committing at least three (3) felonies per day. That is at least how legal theory is applied. It's a fun topic to research. As a side note it would be interesting to see how far down the totem pole they venture in terms of verification of what sites are using age/ID verification and tracking.
thayne 6mo ago
I agree with the general idea, but I would like this header to be more fine grained than just a binary "adult" or not. For example, so that you can distinguish between content that is age appropriate for teenagers and older from content that is suitable for all ages.
- tardedmeme 6mo ago
  It should indicate which exact HTML elements are classified, so that a social media feed can selectively tag posts on the home feed.
- jayd16 6mo ago
  A MIME type for every genre.
areeh 6mo ago
Yeah this seems like the best tradeoff. You avoid the central control infrastructure and you provide information to clients. It's also a great match with free computing devices, which can then utilize the new information, empowering users (eg parents -> parental control on device, or individuals who want to skip some kinds of content). There are issues today with this approach such as lacking granular information for sites that have many kinds of context, but if you stop investing in the central control infra and invest in this instead that could be remedied.
hackernudes 6mo ago
RTA = restricted to adults
sneak 6mo ago
“solutions” like this presume that age verification/gating is the goal. it’s not. it’s a cover story. the goal is eradicating anonymous publishing. the goal is making strong government ID mandatory to use the internet. any privacy preserving age gating system is useless toward that goal, so it is irrelevant.
jayd16 6mo ago
If they can scrape and fine, they can just make a list and the browser can use that.
marcosdumay 6mo ago
The header should be the other way around. It should inform your site will not contain adult material. The local government should scan sites participating. Anyway, yes, that would just solve the problem and not destroy anything. What is the reason why nobody is talking about it.

by Bender 6mo ago

big85 6mo ago

Back in the late 90s or so, there was a proposal to have sites voluntarily set an age header, so parents/employers/etc could use to block the site if they wish. People said it would never work, because adult sites had a financial incentive not to opt in to reduce their own traffic.

Bender 6mo ago
What I am suggesting could address most of that. If they do not participate they get fined. The government loves to fine companies. This assumes they put enough "teeth" into a law that prevents companies from accepting fines as the cost of doing business. This would also require legislation that could block sites that operate from countries that do not cooperate with US laws. Mandatory subscriptions to BGP AS path filters, CDN block-lists which already exist, etc... People could still bypass such restrictions with a VPN but that would not apply to most small children. Sanctions and embargoes are always an option.
- Barbing 6mo ago
  >fined Exactly. If you’re hurting kids to make more money selling porn videos, straight to jail. I’m glad there are solutions that won’t ruin the Internet. Now the uphill battle to convince our legislators (see: encryption & fundamentally technically ignorant calls for backdoors). I’m here to die on this hill!
iamnothere 6mo ago
You’d think that one could simply block sites that don’t have the age header set on child computers. This may block kids from hobbyist sites that don’t bother to set their headers as kid-friendly, but commercial sites would surely set their headers properly. Over time sending proper rating headers would become more normalized if they were in common use. This still isn’t perfect, as it creates an incentive for legislators to criminalize improper age header settings and legislate what is considered kid-appropriate. But it’s still better than this age verification crap.
- Scaled 6mo ago
  Yes, that's how parental filters already work. They use a combination of rta tags and external data to block pages. Even works with Google safe search, firewall devices, etc. The rta ecosystem is already built out and viable.
  - nativeit 6mo ago
    I think the better tack is to stop acting like these laws are being pushed by honest actors with good faith intentions of protecting children.
- ryandrake 6mo ago
  An age header is not the answer. Why should a site have to decide what content is appropriate for a 18 year old and what content is not? Who is qualified to make that decision for every 17 year old in the world? Do they know my 17 year old? Do they know the rules in our home? What if I'm OK with my kid seeing sex-education stuff, but some lawyer at Wikipedia just decides to tag sex ed articles as 18+? Now I have a shitty choice: Open up the floodgates of "18+" to my kid, do it temporarily while the kid browses the sex ed sites, or not let the kid browse them. Letting a company or government decide what's appropriate for what exact specific age is fraught with problems.
  - chlorodose 6mo ago
    Then this leads to a very unwelcome view that most of the problems we face are actually rooted in parents' unwillingness to invest too much time in education :)
Lammy 6mo ago
> Back in the late 90s or so, there was a proposal This one: https://www.w3.org/PICS/ https://www.w3.org/PICS/
- Bender 6mo ago
  PICS was very complicated and attenpted to cover all possible "categories" of adult content. It was confusing, incomplete and only a handful of sites voluntarily labelled their sites with it. RTA is one simple static header that any site operator could add in seconds unless they get more complicated with it by dynamically adding it to individual videos say, on Youtube which means in that case the server application would need to send that header for any video tagged as adult. I added PICS to my forums but it was missing many categories of adult content. I ended up just selecting everything as I could not predict what people may upload which made for a very long header.
  - dylan604 6mo ago
    > unless they get more complicated with it by dynamically adding it to individual videos say, on Youtube YT already does this. I never watch YT signed in, and I often see videos that require you to be logged in as the video is age restricted.
    - Bender 6mo ago
      Agreed though in my example the point would be to set the header in the case the child is logged in but for whatever reason the site does not know their age. Instead of a third party site, a header is sent with the video tagged as adult that triggers parental controls if they are enabled by the device owner.
masfuerte 6mo ago
The porn companies already set the RTA header. It was designed by an organisation funded by the porn companies. https://en.wikipedia.org/wiki/Association_of_Sites_Advocating_Child_Protection https://en.wikipedia.org/wiki/Association_of_Sites_Advocatin...
- motbus3 6mo ago
  It seems there is a GitHub repo somewhere mapping Meta money to lobbyists inside other companies Which is at least interesting
  - bryan_w 6mo ago
    That was created by AI. Ai is great at playing six degrees of Kevin Bacon
thesuitonym 6mo ago
What, in the same way movie studios wouldn't comply with the Hayes Code, or comic book publishers wouldn't comply with the CCA, or games publishers wouldn't comply with the ESRB? The financial incentive is to police yourself, because government policing is much, much worse.
- nine_k 6mo ago
  There's a great relevant quip: "If you think that the cost of compliance is high, try noncompliance".
  - californical 6mo ago
    If only it were true today :|
- breezybottom 6mo ago
  Sure but the government doesn't police corporations in the US anymore. The Hayes code was before neoliberalism.
  - shevy-java 6mo ago
    Quite true. The US corporations act like a giant global rabid dog. Fake legislation appears in the USA - lo and behold, it is copy/pasted into the EU. At the least lobbyists are getting rich right now.
    - htek 6mo ago
      At least the EU has GDPR. In the US, our personal data is collected by every app and website and company and packaged, sold and sifted through by a vast collection of private data brokers which the government already ingests.
  - flumes_whims_ 6mo ago
    The Hayes code wasn't policed by the government.
btilly 6mo ago
People were wrong. We pay money online mostly through credit cards. Credit card transactions can be reversed. If children spend money on porn, those payments are likely to be reversed. This is really bad for the ability of the porn sites to continue receiving credit card payments, and continue making money. An age header is a trivial step that can reduce the odds of the adult site receiving payments that later get reversed. Win, win. But if someone is willing and able to pay, then the adult industry wants the choice of whether to access content to be up to them. If government tries to regulate them, they'll engage in malicious compliance - do the minimum to not be sued, in a way that they can still reach customers. For example Utah tried to institute age verification. The porn industry blocked all IP addresses from Utah. Business boomed for VPN companies in Utah. Everyone, including porn companies, knows that a lot of that is for porn. But if you show up with a Nevada IP address, the porn's position is, "You're in Nevada. Utah law doesn't apply." Even if the credit card has a Utah zip code. If you live in Utah, and you're able to purchase a VPN, the porn companies want your money.
- scythe 6mo ago
  >But if someone is willing and able to pay If someone is willing and able to pay, they have a source of money. If they aren't allowed to buy something, that control should be applied at the level where they get the money. If the child is using an adult's credit card, responsibility lies with the adult. If children need to have their own credit cards, the obvious point of control is the credit card itself. But also, most porn is ad-supported, pirated or free. Directly paid content is a small fraction. So all of this is moot for porn.
- numpad0 6mo ago
  There was a random comment here on HN few days back that adult contents have lower chargeback rates than everything else. So ig stop spreading hallucinatory misinformations?
  - fragmede 6mo ago
    link?
  - 6mo ago

_ink_ 6mo ago

How are they supposed to fine sites out of their jurisdiction?

Bender 6mo ago
One possible method [1] though I am sure the network and security engineers here on HN could come up with simpler methods. Just blocking domains on the popular CDN's would kill access for most people as by default most browsers are using them for DoH DNS. [1] - https://news.ycombinator.com/item?id=47950843 https://news.ycombinator.com/item?id=47950843
- filoleg 6mo ago
  The question was about fining entities outside of the original jurisdiction, so I am not sure what you have in mind that could be done by network/security engineers here.
  - Bender 6mo ago
    In terms of fines if they do not pay the fine their country is at risk of sanctions or embargoes which is probably a bit heavy handed but may incentivize their government to also enforce the rules, collect fines keeping some for themselves and passing the original fine back to the countries implementing child safety controls.
    - filoleg 6mo ago
      This is extremely naive and short-sighted. There is a literal example of this happening rn, and hopefully you will see why your approach isn't that good. UK's OFCOM is currenly issuing legal threats to 4chan, for allegedly serving adult content and not willing to implement age verification. 4chan's lawyer tells them to pound sand[0], on the basis that 4chan is hosted in the US and has zero business presence in the UK, and UK is more than welcome to ban the website on their end through UK ISPs. The saga has been ongoing for a while, and the lawyer has been pretty prolific online talking about the case. Anyway, following your approach, UK should embargo US over 4chan not willing to implement age verification as required by UK law? I plainly don't see this happening, or even being considered, ever. 0. https://www.bbc.com/news/articles/c624330lg1ko https://www.bbc.com/news/articles/c624330lg1ko

duped 6mo ago

This doesn't address the wider array of age-verification related problems that people want to solve, like social media where age verification is needed to police interactions between users.

svachalek 6mo ago
This is assuming children should be on social media at all, which I for one would debate.
Bender 6mo ago
I could be misunderstanding the context but to me that sounds like a moderation issue assuming we even want small children on social media in the first place. There should probably be a dedicated child-safe social media site that limits what communication can take place for small children and has severe punishments for adults pretending to be children for the purposes of grooming.
- duped 6mo ago
  Moderation is like law enforcement, it doesn't prevent crimes from happening it just punishes the people they can catch. There exist severe punishments for the kinds of behavior I'm talking about, but unsurprisingly, this does not stop kids from being harmed and it doesn't undo it. This isn't hypothetical, by the way. There are adults catfishing kids into producing CSAM [0], kidnapping and assaulting minors [1], [2], and in the most extreme case, there's a borderline cult of crazy young adults who do terrorize people for fun [3]. It is a constant game of whackamole by moderators/admins to keep this behavior out of online spaces where kids hang out. I recognize that this is a "think of the children" argument, but indeed that's the point. The anonymous web was created without thinking about the children, just like how all social media was created without thinking about how it could be used to harm people. Age verification is the smallest step towards mitigating that harm. Now I disagree very strongly with the laws proposed (and indeed, I've been writing/calling/talking with state reps about this locally, because I don't want my state's bill passed). But the technical challenge needs to address the real problems that legislators are trying to go after. [0] https://www.justice.gov/usao-wdnc/pr/discord-user-who-catfished-young-victims-sentenced-21-years-prison-production-child https://www.justice.gov/usao-wdnc/pr/discord-user-who-catfis... [1] https://www.nbcnews.com/news/us-news/kidnapping-roblox-rcna201795 https://www.nbcnews.com/news/us-news/kidnapping-roblox-rcna2... [2] https://www.nbcmiami.com/news/local/nebraska-man-charged-with-kidnapping-florida-sisters-after-talking-to-them-on-roblox-sheriff/3758900/ https://www.nbcmiami.com/news/local/nebraska-man-charged-wit... [3] https://www.fbi.gov/contact-us/field-offices/boston/news/open-letter-to-parents-guardians-and-caregivers https://www.fbi.gov/contact-us/field-offices/boston/news/ope...

hooverlabs 6mo ago

Servers can then infer user’s ages by whether or not the client renders pages given those headers or not no? See if secondary page requests (e.g images, scripts) are made or not from a client? A bad actor could use this to glean age information from the client and see whether the person viewing the page is a small child. That should be scary

Bender 6mo ago
I disagree. The ability to render a page could simply mean that parental controls were not enabled on the device. Some parents have assessed the situation and trust their children to be psychologically ready for adult situations. The client could be literally any age. Today devices do not default to accounts being child accounts. Some day this may change and may require an initial administrator password or something to that affect but this can evolve over time.
- NoMoreNicksLeft 6mo ago
  >I disagree. The ability to render a page could simply mean that parental controls were not enabled on the device. Not being able to detect all children doesn't mean that being able to detect 80% of them is somehow less disturbing.
  - Bender 6mo ago
    The point and overall goal should be to not signal anything to the server operator unless a credit card is being used. Everyone is whomever they claim to be as far as anyone is concerned, until payments are required which today means sharing identity and age (via the credit card information on file with the financial institution and is shared today). In the case of RTA the only signalling taking place is a server header being transmitted to the client. The client could be anyone at any age. Nothing to explicitly leak or disclose. Server operators can guess all they desire as some do using AI based on user behavior of which they sometimes get wrong.
    - 6mo ago

kevin_thibedeau 6mo ago

> fine sites not participating into oblivion. That would also amount to compelled speech.

Bender 6mo ago
That would also amount to compelled speech. I disagree. The legal requirement to apply a warning label is a well known, understood and accepted process that is applied to a myriad of hazards to children and adults. As just one example businesses in some states, most notably California are compelled to add warning labels to foods and other products that could cause cancer.
- sailfast 6mo ago
  Do you believe using the Internet should require a license? Isn’t that what covers these product warning labels?
  - Bender 6mo ago
    I never implied an internet license. Rather if a server operator a business has content that may be adult in nature they must label their site. Businesses require a license already but that is unrelated to this.
- SpaceNoodled 6mo ago
  That's not the best example, since the levels set for Prop 65 warnings are so low that the warnings are effectively useless; every single commercial building in CA now somehow causes cancer.
  - Bender 6mo ago
    Surely we both understand the point I was making in that labels are already compelled by laws today. Fine, cigarettes must be labelled as being a risk of causing cancer. The punishment for failing to do this is both civil and federal penalties including massive fines and federal prison time.

traderj0e 6mo ago

Or could have a header saying this is not adult-only content, and a parentally-controlled device will block things that don't participate.

Bender 6mo ago
That's a good idea. There could be two headers, the existing RTA header that adult sites use today [1] and another static header that explicitly states there shall be no adult content. [1] - https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-RTA https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-R... [THESE ARE ADULT SITES, NSFW]
- bluGill 6mo ago
  What is adult content? I know parents who have no problem with their kids seeing porn. I know parents who give their kids a beer. I know parents who take their kids to violent movies. I used to know parents who will give their kids cigarettes. Most parents I know will disagree with their kids doing one of the above. I know songs that were played on the radio in 1960 that would not be allowed today, even though today we allow some swearing on the radio.
  - Bender 6mo ago
    That's between parents and their local governments. Yes when I was a kid my mom let me watch whatever and go wherever. The parent in my example ultimately decides what a kid may or may not do which is in alignment with existing laws. If the parent is endangering their kid that is up to them and their government to sort out. Point being, put the controls entirely into the hands of the device owner. Options can be to default to: - Block everything by default unless header states otherwise. - Block only sites that state they are adult. - Do nothing. Obey the operator. (Controls disabled on child accounts or make them an adult or otherwise unrestricted account on the device). I think the options are just limited to our imagination.
    - ryandrake 6mo ago

crabbone 6mo ago

How would this work with sites like YouTube which allow sharing of content, potentially not appropriate for children, but the content is generated by the site's users? Who will be fined for "violations"? And how would such a fine be levied, especially internationally?

Bender 6mo ago
I think that initially the onus would be on Youtube to figure this out. They have some very intelligent engineers. For example, if the Youtube client is receiving affiliate funds then they are easy to ID and fine. If they are random people then Youtube would have to share the violation data with the other countries and the US or UK would have to pressure those countries to participate in fining the end user. There could be financial incentives for the foreign country to participate. They can also just force label a video to be adult as they do today when enough people report it which is admittedly not uniformly applied.
Tanoc 6mo ago
This already has been solved. Youtube disables viewing via embeds for any content that has been age restricted. Either you view it on Youtube which requires logging in to see age restricted content in the first place, or you get the ! icon and the warning about needing to log in.

kyledrake 6mo ago

Interesting, I've never heard of this. I see an example that involves an HTTP response header "Rating: RTA-5042-1996-1400-1577-RTA". But does this actually still get used by parental controls? I didn't run into a lot of documentation about this, including on the very badly designed RTA web site https://www.rtalabel.org/ https://www.rtalabel.org/ For anyone curious about the value, the numbering on the value is just a fixed number everybody decided to use for some reason that isn't clear to me. I would deeply prefer to do it this way, but my goodness the RTA org needs a serious brush up of their web site and information on how to use this.

Bender 6mo ago
But does this actually still get used by parental controls? Some parental control applications will look for it but it is not yet legislated to be mandatory on a majority of user-agents. All I am suggesting is we legislate the header to be added to URL's that may contain material not appropriate for small children and mandate the majority of user-agents the ones that are default installed on tablets and operating systems look for said header to trigger optional parental controls. Child accounts created by parents on the device should not be able to install alternate user-agents or bypass the controls (at least not easily). Parents should be guided through this on device setup. Indeed their site is old and rarely touched. The ideas and concepts have not changed. It really could just be a static text site formatted in ways that law makers are used to or someone could modernize it.

rpdillon 6mo ago

This is exactly the way it should be done. Device with parental controls enabled disables content client-side when the header is detected. As far as I can tell, it's a global optimum, all trade-offs considered.

SoftTalker 6mo ago
Well why haven't all the big tech companies done it then? They have only themselves to blame. They had years to fix the problem of inappropriate content being delivered to kids and their response was sticking their fingers in their ears and saying "blah blah blah parenting blah blah blah" And it really should be the opposite. Assume content is not kid-safe by default, and allow sites to declare if they have some other rating.
- fc417fc802 6mo ago
  Because it isn't in their financial interest. They've either done nothing or actively lobbied for these ID laws. You can plausibly explain it in a number of ways, including regulatory capture, deanonimization, spam reduction, etc.
- jonplackett 6mo ago
  The reason is that this whole push for age verification is nothing to do with actually stopping kids seeing the content. If it was then this kind of solution would be being legislated for. It’s just about making everyone identifiable.
  - slg 6mo ago
    >If it was then this kind of solution would be being legislated for. What's more likely a global conspiracy to get age verification passed to allow these unnamed groups to identify everyone for some unknown purpose or politicians just not understanding tech? The way people try to pretend that there can't be any organic desire for these proposals is so bizarre and is a major cause for all these proposed solutions being so technically dubious. Refusal to recognize the problem means you won't be part of solving the problem.

LooseMarmoset 6mo ago

An outstanding idea. Those lobbying for age verification hate it though, because they want to be the arbiters of age, and all that juicy PII that they can analyze and resell.

phendrenad2 6mo ago
I'm not so sure. I think the push is from the government actually. But companies are not exactly opposed to it. Quite the contrary. Big corporations see compliance as a moat. Tobacco companies supported stricter regulations on tobacco advertisements, because they had the deep pockets required to follow the changing laws. Mr. Altman is all-in on AI regulation, because it will mire down competitors while OpnAI has already "slipped past the wire" and done all their training pre-crackdown. When given a choice between regulating their industry (platforms and operating systems) vs regulating someone else's (porn sites and the like) they'll always helpfully "volunteer" to be the first to be regulated. It's just good business.
- elliotec 6mo ago
  "The government" is the same as those lobbying the government. The people in the government get paid to push it, so they push it, and get paid more when it goes through, by the people who want that PII to analyze.
intrasight 6mo ago
What PII? They get a boolean "old enough"
- LooseMarmoset 6mo ago
  Think about how they validate how old you are. Meta and Google, who are lobbying in support of this legislation,will force you to sign up with your real ID, and be the arbiter for questions like “are you old enough for this website”. For every request that you make through some third-party website that needs to know your age, Meta and Google will know where you tried to login, and for which content. They will then resell this data to the highest bidder. Additionally, through all their ad networks and tracking, they will follow your session and have verified ID to match your entire browsing history. This is the end of anonymity and privacy on the Internet.

snvzz 6mo ago

>I a small server operator and a client of the internet will not participate in any other methods period, full-stop. You will however follow the law if it mandates you to do else. Which is we "age verification" should be stopped before it's too late.

tardedmeme 6mo ago
Many people don't follow many laws, how do you know that person will follow that law?
Bender 6mo ago
I have probably never met anyone that is not committing at least three (3) felonies per day. That is at least how legal theory is applied. It's a fun topic to research. As a side note it would be interesting to see how far down the totem pole they venture in terms of verification of what sites are using age/ID verification and tracking.

thayne 6mo ago

I agree with the general idea, but I would like this header to be more fine grained than just a binary "adult" or not. For example, so that you can distinguish between content that is age appropriate for teenagers and older from content that is suitable for all ages.

tardedmeme 6mo ago
It should indicate which exact HTML elements are classified, so that a social media feed can selectively tag posts on the home feed.
jayd16 6mo ago
A MIME type for every genre.

areeh 6mo ago

Yeah this seems like the best tradeoff. You avoid the central control infrastructure and you provide information to clients. It's also a great match with free computing devices, which can then utilize the new information, empowering users (eg parents -> parental control on device, or individuals who want to skip some kinds of content). There are issues today with this approach such as lacking granular information for sites that have many kinds of context, but if you stop investing in the central control infra and invest in this instead that could be remedied.

hackernudes 6mo ago

RTA = restricted to adults

sneak 6mo ago

“solutions” like this presume that age verification/gating is the goal. it’s not. it’s a cover story. the goal is eradicating anonymous publishing. the goal is making strong government ID mandatory to use the internet. any privacy preserving age gating system is useless toward that goal, so it is irrelevant.

jayd16 6mo ago

If they can scrape and fine, they can just make a list and the browser can use that.

marcosdumay 6mo ago

The header should be the other way around. It should inform your site will not contain adult material. The local government should scan sites participating. Anyway, yes, that would just solve the problem and not destroy anything. What is the reason why nobody is talking about it.