4 ms·

I think the header/metatag is designed poorly. The RTA proposal is that every operator of every site must verify the content and add the header to mark the site

I think the header/metatag is designed poorly. The RTA proposal is that every operator of every site must verify the content and add the header to mark the site as "safe" or "unsafe". This is unnecessary burden that they have to bear if this proposal is given a green light and this is wrong. Instead, the default should be, that if there is no header or it cannot be parsed, then the content is unsafe. And if there is a header, it describes the page rating, like what kind of dangerous content it may contain. The header may be added to any displayable content like HTML, text, images, audio or videos, but not to machine-readable content like JS files or AJAX responses. So only those who wants their site to be accessible by minors, have to add headers. For social networks, the user might have an option to mark his content as "safe". This means that with my proposal existing site operators need not to do anything to mark their sites as "unsafe" - all sites are "unsafe" by default. This means that millions of site operators need to spend 0 dollars to adapt their sites. How great is that? The browser on a device with parent mode, should not allow displaying any content which doesn't have a header or that is marked as unsafe, or that contains header with invalid value. The parents may whitelist some sites. There should be a reponsibility for intentionally marking unsafe content as "safe". We should also think what to do with foreign operators, intentionally putting invalid headers for unsafe content. Maybe they should be added to some kind of blacklist that the browsers would periodically update. Search engines like Google could work by default in "safe" mode, but add "unsafe" header if the user wants to turn off restrictions. > If a site is not adding the RTA header then progressively fine them into oblivion. I think my proposal is better because it requires only fining those who intentionally misrepresent content safety.

Bender 4mo ago
For what its worth this header has been around for a very long time. It's actually the second iteration and much simpler than it's predecessor. Parents today can accomplish what you are suggesting by installing parental control software and only allowing access to things they explicitly approve. This can also be done via headers explicit blocking of all the things and was suggested in another thread. [1] Some people liked the idea. [1] - https://news.ycombinator.com/item?id=47952999 https://news.ycombinator.com/item?id=47952999
- codedokode 4mo ago
  The point is that it is unrealistic to expect millions of people to mark the content. Also, the header is better than the metatag because it can be added to images, videos and other non-HTML content as well.
  - Bender 4mo ago
    The header (for videos and other) was mentioned in [1]. I agree that is the way to go. Adding a header to a web server or load balancer or app server if done globally can be done in a minute or two. Maybe 5 minutes for the intern not counting QA testing. But you are right, the inverse is easier. I like that too. That was debated in the other recent thread. [1] - https://news.ycombinator.com/item?id=47950091 https://news.ycombinator.com/item?id=47950091
  - farley13 4mo ago
    I tend to agree - making folks intending to interact with minors comply makes more sense. That said, outside of the merits of this approach, I am dubious of any actual implementation given 2 points. 1) Protecting the youths will always be a leaky bucket. With disadvantaged youths possibly more at risk. Those exposed to non-compliant parents ("cool" parents who are ok with sharing unsuitable content) or lacking strong parental involvement, likely won't benefit a great deal from any implementation. 2) Anti privacy social networks stand to gain the most from targeting ads utilizing signals from most child safety acts. They also might be able to reduce some costs from moderation if they can make it someone else's problem. I'd argue the net social impact from these social networks is likely both more normalized and strongly negative for our youths than any smut. On the balance I'd say we are better off investing our energy in other places.
    - nodar86 4mo ago
      > "cool" parents who are ok with sharing unsuitable content Or simply parents who won’t agree with the government on what is suitable for their children. We already have parental control on all mainstream operating systems, why cannot this simply be the responsibility of the parent as are so many other things regarding what children do, watch, eat etc?
xoa 4mo ago
Yes, exactly, this should be really simple as a foundation: by default the Internet is for adults. All of it. Where it's desirable for things to be available for kids, create the economic incentive and easy tools for parents to use and run on a white list, not a black list. I'd actually go somewhat further though and ask whether it's a good idea to even do this via web pages at all. We have a great potential system for this already: DNS. Do something useful amongst all the ridiculous vanity and spam TLDs for once and set up a ".kids" gTLD, or ccTLD for that matter so that different countries can set their own regulatory standards naturally (ie, .kids.us, .kids.uk etc). Domains could also be used for some broad buckets for people who don't want to drill in, ie, .1-6.kids, .7-12.kids, .13-17.kids, or whatever is deemed appropriate, but simple age brackets that would offer some sane defaults. 1-6 could simply not allow any ads, user generated content or algorithmic feeds whatsoever for example. There are a lot of knobs to turn. And then at the registry level it can be ensured from the get-go that anyone getting a .kids domain is fully identified, located in the country in question, has valid ID, has specific credentials or is an accredited organization, or whatever other criteria makes sense. But ultimately the point would be to create something that is built right from the ground up, and in turn that doesn't interfere with what has already been built at all. Something that can also be worked with at the gateway and thus cover every device on a LAN, and for that matter can easily be plugged into the vast number of powerful tools we have for working with that stuff. It'd be easy to put a nice UI on all this, even to make it higly automated. For example, have a setup wizard where you enter children, put in date of birth for each, and it'll spit out a password for each one. This then auto-provisions the network such that each kid has their own VLAN (password for PPSK or even wired connection) and is automatically limited to the domain groups of their age bracket, which then changes as their age changes. Parents should be able to dig further in and get more granular with content categories, metadata for which could be required for anyone hosting a site within that domain, but I think there is the potential to make something both pretty bullet proof and pretty accessible, using existing tech stacks, and without impinging on the present internet at all including privacy and anonymity.
- lokar 4mo ago
  I think it really needs to be per-page. And, if we are going to do this the “design” should be global and anticipate a range of cultures.
lokar 4mo ago
The page having a simple rating assumes there can be one mapping from content to rating for the whole world. I doubt we can even have one for North America and Europe.
- deleted 4mo ago
  [deleted]
- californical 4mo ago
  Come up with a few categories and let the browser/OS decide. Websites by default are ‘true’ for every category, unless they specify. Categories are, for example of some: nudity, sexual, violence, etc. It doesn’t have to be perfect but sites will have to err on the side of caution. We could even create an html tag <restricted type=violence> for example, and the browser can simply not render that portion of the page of the user has that type disabled. And we could give companies a pass for best-effort categorization using tech to assess user-generated content, along with allowing users to flag their own content as “safe”
  - lokar 4mo ago
    A header is probably better than a tag. The goal should be to satisfy most reasonable governments. A neutral technical standard and an international organization to maintain the the ontology for content descriptors
    - californical 4mo ago
      Ah I was proposing the tag as another option - maybe a news article is fine for kids but the comment section is unmoderated. That way they could still read the article but not the comments
      - tardedmeme 4mo ago
        Better idea is just tell the server if you want to hide restricted content. Then it can make any changes necessary. Yes it's a fingerprinting bit. Not a new one, because they could already detect whether the restricted tag was rendering or not, anyway.
fc417fc802 4mo ago
The problem with your proposal is that it's already the status quo. Various whitelists exist but service operators don't generally bother with these things. What you end up with is a largely unusable experience if you enable whitelist filtering. The core problem is the lack of buy in. Unfortunately that likely needs to be forced. I think it's not unreasonable to legally require people to make a claim about the nature of what they are serving up. They already need to be aware of the legal status of what they're doing anyway so it hardly seems as though making such a determination should pose a burden when you consider that it's an alternative to either requiring ID, requiring the client send age bracket information, or other heavy handed interventions. The choice here isn't "the status quo vs a header" but rather "some other age related regulation vs a header". An easy way to enforce this "voluntarily" (ie coerce) without sending government agents after every small time website operator would be to require that mainstream browsers and other client software (based on MAU or similar metrics) refuse to process content that does not send a classification header. Doesn't matter what the header says or what the status of the user account or parental controls or whatever else is, it has to send the header regardless or it will be blocked without exception. That would presumably trigger broad compliance with the relevant regulations.
- iamnothere 4mo ago
  Should books require an age rating? What about spoken words? What makes online speech different, from the perspective of the Constitution that limits the power of the state?
  - fc417fc802 4mo ago
    The difference is one of redressing a concrete dysfunction. Libraries or the local bookstore or whoever aren't trying to sneak into your home, onto your child's school bus, into your child's classroom, while pushing various extremist publications purely for their own profit (ie "engagement"). We do in fact have zoning laws - I can't inadvertently encounter a strip club in a quiet residential area. Meanwhile it's commonplace for children to carry a network terminal around with them with which one can readily access the equivalent of things far worse than that. What I've described does not restrict one's ability to speak freely. It is most similar to an impressum except it bears no identifying mark thus poses no hazard to anonymous speech.
AnthonyMouse 4mo ago
> Instead, the default should be, that if there is no header or it cannot be parsed, then the content is unsafe. That's something the client should be doing. You can configure your own device (or your kid's) to have whatever default you want. The actual problem is that classifying the entire firehose of user-generated content is precarious and uneconomical, so the default tag is going to be whatever minimizes liability. If untagged implies "unsafe" and "unsafe" minimizes liability then the majority of content will be untagged. If untagged implies "safe" then the majority of content will end up explicitly tagged as unsafe, because tagging it as unsafe minimizes liability. But either way if you disable "unsafe content" you'll end up disabling almost everything, specifically including the huge amount of "safe" content which isn't tagged as safe because accurately classifying it is uneconomical.
- bsdetector 4mo ago
  If the default wasn't "almost nothing" then you'd be sanctioning exposing some kids to content their parents didn't want them to see. If there's no economic incentive to tag content then it's not valuable content for kids. Ultimately the problem is the provider knows what category the content is and the parent knows what the content policy is. Providers can't say whether it's "safe" or "unsafe", only what standards it complies with. Some parents will have weird policies like "only G-rated movies or any Jim Carey movie" that can't even be delegated in any reasonable way to providers. So the header has "PG-13, US-legal" because it's a movie rated PG-13 and constitutionally-protected legal content in the US, and whatever other markets you want to open up. Providers could even include AI ratings so as to mass-tag their content at low cost, and parents can decide if a particular AI rating is okay. Parental controls could even restrict official ratings to country of origin, so if you approve PG-13 it'll block that content from countries where you can't sue them for lying about it.
  - AnthonyMouse 4mo ago
    > If there's no economic incentive to tag content then it's not valuable content for kids. Those two things are completely disjoint. In one case you're measuring the value of the content to the platform and in the other you're measuring the value of the content to the kids. Suppose there is some content that the platform would get $10 in ad revenue to show to kids, would cost $100 to classify, and is worth $1000 to the kids. In the land of spherical cows you could have the users pay the money, but that gets killed by transaction costs, privacy issues with payment systems, and that kids generally don't have money. So the kids lose access to valuable information because the platform isn't willing to spend $100 to make $10. And it's still a problem even if the platform could make as much revenue from showing the content as the user receives value from it. Consider the entire firehose of social media posts on some unspecified site. Classifying it all would cost e.g. a billion dollars. So even if the value of kids having the content was half a billion dollars -- a huge sum equivalent to multiple human lifetimes of labor effort -- to the kids and the platform both, it's not happening because the cost of classifying the content is even larger yet. > Ultimately the problem is the provider knows what category the content is That's the problem though. The provider doesn't know what category the content is. There are Wikipedia pages that contain nudity etc. Who is going to pay someone to read the millions of articles and classify each one? But if they instead just mark the whole site as adult content, the amount of non-adult content kids lose access to is large.

Bender 4mo ago

For what its worth this header has been around for a very long time. It's actually the second iteration and much simpler than it's predecessor. Parents today can accomplish what you are suggesting by installing parental control software and only allowing access to things they explicitly approve. This can also be done via headers explicit blocking of all the things and was suggested in another thread. [1] Some people liked the idea. [1] - https://news.ycombinator.com/item?id=47952999 https://news.ycombinator.com/item?id=47952999

codedokode 4mo ago
The point is that it is unrealistic to expect millions of people to mark the content. Also, the header is better than the metatag because it can be added to images, videos and other non-HTML content as well.
- Bender 4mo ago
  The header (for videos and other) was mentioned in [1]. I agree that is the way to go. Adding a header to a web server or load balancer or app server if done globally can be done in a minute or two. Maybe 5 minutes for the intern not counting QA testing. But you are right, the inverse is easier. I like that too. That was debated in the other recent thread. [1] - https://news.ycombinator.com/item?id=47950091 https://news.ycombinator.com/item?id=47950091
- farley13 4mo ago
  I tend to agree - making folks intending to interact with minors comply makes more sense. That said, outside of the merits of this approach, I am dubious of any actual implementation given 2 points. 1) Protecting the youths will always be a leaky bucket. With disadvantaged youths possibly more at risk. Those exposed to non-compliant parents ("cool" parents who are ok with sharing unsuitable content) or lacking strong parental involvement, likely won't benefit a great deal from any implementation. 2) Anti privacy social networks stand to gain the most from targeting ads utilizing signals from most child safety acts. They also might be able to reduce some costs from moderation if they can make it someone else's problem. I'd argue the net social impact from these social networks is likely both more normalized and strongly negative for our youths than any smut. On the balance I'd say we are better off investing our energy in other places.
  - nodar86 4mo ago
    > "cool" parents who are ok with sharing unsuitable content Or simply parents who won’t agree with the government on what is suitable for their children. We already have parental control on all mainstream operating systems, why cannot this simply be the responsibility of the parent as are so many other things regarding what children do, watch, eat etc?

xoa 4mo ago

Yes, exactly, this should be really simple as a foundation: by default the Internet is for adults. All of it. Where it's desirable for things to be available for kids, create the economic incentive and easy tools for parents to use and run on a white list, not a black list. I'd actually go somewhat further though and ask whether it's a good idea to even do this via web pages at all. We have a great potential system for this already: DNS. Do something useful amongst all the ridiculous vanity and spam TLDs for once and set up a ".kids" gTLD, or ccTLD for that matter so that different countries can set their own regulatory standards naturally (ie, .kids.us, .kids.uk etc). Domains could also be used for some broad buckets for people who don't want to drill in, ie, .1-6.kids, .7-12.kids, .13-17.kids, or whatever is deemed appropriate, but simple age brackets that would offer some sane defaults. 1-6 could simply not allow any ads, user generated content or algorithmic feeds whatsoever for example. There are a lot of knobs to turn. And then at the registry level it can be ensured from the get-go that anyone getting a .kids domain is fully identified, located in the country in question, has valid ID, has specific credentials or is an accredited organization, or whatever other criteria makes sense. But ultimately the point would be to create something that is built right from the ground up, and in turn that doesn't interfere with what has already been built at all. Something that can also be worked with at the gateway and thus cover every device on a LAN, and for that matter can easily be plugged into the vast number of powerful tools we have for working with that stuff. It'd be easy to put a nice UI on all this, even to make it higly automated. For example, have a setup wizard where you enter children, put in date of birth for each, and it'll spit out a password for each one. This then auto-provisions the network such that each kid has their own VLAN (password for PPSK or even wired connection) and is automatically limited to the domain groups of their age bracket, which then changes as their age changes. Parents should be able to dig further in and get more granular with content categories, metadata for which could be required for anyone hosting a site within that domain, but I think there is the potential to make something both pretty bullet proof and pretty accessible, using existing tech stacks, and without impinging on the present internet at all including privacy and anonymity.

lokar 4mo ago
I think it really needs to be per-page. And, if we are going to do this the “design” should be global and anticipate a range of cultures.

lokar 4mo ago

The page having a simple rating assumes there can be one mapping from content to rating for the whole world. I doubt we can even have one for North America and Europe.

deleted 4mo ago
[deleted]
californical 4mo ago
Come up with a few categories and let the browser/OS decide. Websites by default are ‘true’ for every category, unless they specify. Categories are, for example of some: nudity, sexual, violence, etc. It doesn’t have to be perfect but sites will have to err on the side of caution. We could even create an html tag <restricted type=violence> for example, and the browser can simply not render that portion of the page of the user has that type disabled. And we could give companies a pass for best-effort categorization using tech to assess user-generated content, along with allowing users to flag their own content as “safe”
- lokar 4mo ago
  A header is probably better than a tag. The goal should be to satisfy most reasonable governments. A neutral technical standard and an international organization to maintain the the ontology for content descriptors
  - californical 4mo ago
    Ah I was proposing the tag as another option - maybe a news article is fine for kids but the comment section is unmoderated. That way they could still read the article but not the comments
    - tardedmeme 4mo ago
      Better idea is just tell the server if you want to hide restricted content. Then it can make any changes necessary. Yes it's a fingerprinting bit. Not a new one, because they could already detect whether the restricted tag was rendering or not, anyway.

fc417fc802 4mo ago

The problem with your proposal is that it's already the status quo. Various whitelists exist but service operators don't generally bother with these things. What you end up with is a largely unusable experience if you enable whitelist filtering. The core problem is the lack of buy in. Unfortunately that likely needs to be forced. I think it's not unreasonable to legally require people to make a claim about the nature of what they are serving up. They already need to be aware of the legal status of what they're doing anyway so it hardly seems as though making such a determination should pose a burden when you consider that it's an alternative to either requiring ID, requiring the client send age bracket information, or other heavy handed interventions. The choice here isn't "the status quo vs a header" but rather "some other age related regulation vs a header". An easy way to enforce this "voluntarily" (ie coerce) without sending government agents after every small time website operator would be to require that mainstream browsers and other client software (based on MAU or similar metrics) refuse to process content that does not send a classification header. Doesn't matter what the header says or what the status of the user account or parental controls or whatever else is, it has to send the header regardless or it will be blocked without exception. That would presumably trigger broad compliance with the relevant regulations.

iamnothere 4mo ago
Should books require an age rating? What about spoken words? What makes online speech different, from the perspective of the Constitution that limits the power of the state?
- fc417fc802 4mo ago
  The difference is one of redressing a concrete dysfunction. Libraries or the local bookstore or whoever aren't trying to sneak into your home, onto your child's school bus, into your child's classroom, while pushing various extremist publications purely for their own profit (ie "engagement"). We do in fact have zoning laws - I can't inadvertently encounter a strip club in a quiet residential area. Meanwhile it's commonplace for children to carry a network terminal around with them with which one can readily access the equivalent of things far worse than that. What I've described does not restrict one's ability to speak freely. It is most similar to an impressum except it bears no identifying mark thus poses no hazard to anonymous speech.

AnthonyMouse 4mo ago

> Instead, the default should be, that if there is no header or it cannot be parsed, then the content is unsafe. That's something the client should be doing. You can configure your own device (or your kid's) to have whatever default you want. The actual problem is that classifying the entire firehose of user-generated content is precarious and uneconomical, so the default tag is going to be whatever minimizes liability. If untagged implies "unsafe" and "unsafe" minimizes liability then the majority of content will be untagged. If untagged implies "safe" then the majority of content will end up explicitly tagged as unsafe, because tagging it as unsafe minimizes liability. But either way if you disable "unsafe content" you'll end up disabling almost everything, specifically including the huge amount of "safe" content which isn't tagged as safe because accurately classifying it is uneconomical.

bsdetector 4mo ago
If the default wasn't "almost nothing" then you'd be sanctioning exposing some kids to content their parents didn't want them to see. If there's no economic incentive to tag content then it's not valuable content for kids. Ultimately the problem is the provider knows what category the content is and the parent knows what the content policy is. Providers can't say whether it's "safe" or "unsafe", only what standards it complies with. Some parents will have weird policies like "only G-rated movies or any Jim Carey movie" that can't even be delegated in any reasonable way to providers. So the header has "PG-13, US-legal" because it's a movie rated PG-13 and constitutionally-protected legal content in the US, and whatever other markets you want to open up. Providers could even include AI ratings so as to mass-tag their content at low cost, and parents can decide if a particular AI rating is okay. Parental controls could even restrict official ratings to country of origin, so if you approve PG-13 it'll block that content from countries where you can't sue them for lying about it.
- AnthonyMouse 4mo ago
  > If there's no economic incentive to tag content then it's not valuable content for kids. Those two things are completely disjoint. In one case you're measuring the value of the content to the platform and in the other you're measuring the value of the content to the kids. Suppose there is some content that the platform would get $10 in ad revenue to show to kids, would cost $100 to classify, and is worth $1000 to the kids. In the land of spherical cows you could have the users pay the money, but that gets killed by transaction costs, privacy issues with payment systems, and that kids generally don't have money. So the kids lose access to valuable information because the platform isn't willing to spend $100 to make $10. And it's still a problem even if the platform could make as much revenue from showing the content as the user receives value from it. Consider the entire firehose of social media posts on some unspecified site. Classifying it all would cost e.g. a billion dollars. So even if the value of kids having the content was half a billion dollars -- a huge sum equivalent to multiple human lifetimes of labor effort -- to the kids and the platform both, it's not happening because the cost of classifying the content is even larger yet. > Ultimately the problem is the provider knows what category the content is That's the problem though. The provider doesn't know what category the content is. There are Wikipedia pages that contain nudity etc. Who is going to pay someone to read the millions of articles and classify each one? But if they instead just mark the whole site as adult content, the amount of non-adult content kids lose access to is large.