13 ms·

Illinois just passed a law that puts Linux on the hook for age verification

345 points by speckx 3mo ago

donald-trump 3mo ago
[flagged]
LPisGood 3mo ago
What does that mean, practically? The person who installed linux on that particular device is liable? >no algorithmic feeds for minors by default Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm?
- stevenalowe 3mo ago
  "Illinois now requires operating system providers, open source projects included, to build age verification by 2028" however "nothing in the bill has teeth against someone with no business presence in Illinois"
  - gh02t 3mo ago
    Companies like Red Hat/IBM operate in Illinois and for better or worse have controlling interests in Linux and across open source projects pretty broadly. Wouldn't they be forced to include the capability in their products, which then percolate out to everyone just by network effects?
    - FuckButtons 3mo ago
      finally the die hard systemd haters will have an actually valid point.
      - LPisGood 3mo ago
        I’m unfamiliar with systemd’s haters or why this would give them a valid point. Could you please elaborate?
        genewitch 3mo ago
        systemd is a massive blob of code that infects every part of a system and all of its subsystems. It completely changed the way system administration was done, the way init scripts work, and added tons of things to init that some argue aren't necessary, like dhcp and DNS. Newer linux folks like it because they're used to it, people who don't like it use devuan, gentoo, or one of the others that still lets one use openRC or whatever else. upthread someone mentioned that systemd already has the ability to store the birthdate of a user. Why would an init system need that? It doesn't, but here we are.
        Melonai 3mo ago
        Maybe I'm about to be too pedantic, but I never quite got the argument of systemd being massively bloated based on examples of it including DNS and DHCP. Sure it's a mono-repository that includes all these services, but in the end you do run them separately? The actual "systemd, the init system" doesn't have DNS, DHCP or a user birthday database built-in, those are contained in their own services, namely systemd-resolved, systemd-networkd, and systemd-userdbd respectively, and, although systemd does genuinely lead you down the path of using them (which might be a real problem!), there isn't actually a definite requirement to do so. systemd will gladly run your BIND, ISC DHCP and NetworkManager for you if you tell it to, no? In fact we do so at my place of work. Just because they are under the same project as the init system doesn't mean they are one monolith, I think. To me that feels like saying "Why does the GNU C library include a bootloader!". Now it's not like there's not plenty to dislike about systemd, it is a wide-reaching project that has managed to get a huge mindshare of the lower-level services needed to run a basic Linux server or desktop, and that has caused many utilities and services to appear that have a hard dependency on it, which is obviously bad for anyone running services that aren't part of the systemd package set, just take a look at NixOS, it's practically built purely on systemd, with efforts to support alternative init systems essentially archived at this point. Plenty of people also quite dislike Lennart, or how involved corporations are in the systemd development, and other people have loads of other reasons. One of my own gripes is speed for quite a few basic procedures in networkd. There's enough stuff to hate about it! I think it's not really necessary to pretend that your init system runs a DNS server and stores birthdays.
    - johnsmith1840 3mo ago
      I don't see how they enforce it though? Isn't this saying every linux instance needs basically a backdoor network access? How would verify the 30 pods on my node are from minors or adults without that? Or this is more about a user facing node? So my aws nodes need to verify my age before I ssh in? Remote desktop services? Sounds so complicated to actually do.
      - dd8601fn 3mo ago
        I suppose they only have to confirm that the OS supports age bucket reporting... not that you're using it.
      - MrJohz 3mo ago
        There's no verification necessary. Instead, you'd just set a flag on all of those pods that says "this is an adult". Or more likely, you wouldn't set anything, there would be no changes at all, because that would be the default. However, if I gave my child a laptop with Linux installed, the law would force the OS to provide some setting somewhere that I can toggle that switches the installation to child mode. (On Linux, I imagine it would make sense to have this be a per-user toggle, so my kid's account would be in child mode, and the root account would not.) The applications on that computer would then be required to check that setting if they want to show "adult content" (here defined as algorithmic feeds, notifications between certain hours, the ability to receive messages from identified adults). Similarly (this isn't clear but would presumably be technically required) browsers would pass this setting on to websites in some way. Another way of seeing it is this: you know the DNT/Do Not Track header that you can optionally set in your browser and (theoretically at least) websites will not track you? This is essentially that but for certain kinds of content. If you set the header, websites won't be allowed to show algorithmic feeds, etc. Basically all of this is in the article, which lays it out very clearly (if you ignore the Claude-isms).
        johnsmith1840 2mo ago
        Oh, that's not that bad? Literally a flag at bios/admin layer defaulting to adult. I mean completely unenforcable but still not that crazy
- monocasa 3mo ago
  That part hasn't really been decided since it's a regulatory question. Basically the bill defines > "Operating system provider" means a commercial or non-profit entity that controls the Internet-enabled device's operating system, including the design, programming, or supply of operating systems for the Internet-enabled devices. Which is an extremely broad definition that could be interpreted in a whole bunch of ways.
- deleted 3mo ago
  [deleted]
- koutakun 3mo ago
  Presumably this means no targeting the user's preferences and just showing everything by newest/most liked.
  - genewitch 3mo ago
    "most liked" won't work. has to be chronological, and manually curated. the way fediverse works. when you make an account somewhere, you can choose to see the local people, or the entire network, but it's all chronological. There's things like hashtag searches and whatnot, but none of it is algorithms; in the sense we understand it to mean, here, these are not manipulative algorithms designed to keep people on a site and keep ads rolling by. on the fediverse, there are bots to curate content such as "most liked", one can subscribe to these bots to see such "views" of the feed. there's absolutely no reason for any of that crap to be built in, other than that's how reddit (and HN) do it.
    - Groxx 3mo ago
      There's a "trending" feed on nearly every implementation including the official Mastodon one (hashtags have their own "trending" too), and chronological definitely fits "an algorithm" imo - it has all the hallmark problems of one, such as encouraging bad behavior (frequent spamming is the most effective strategy to be seen). Lemmy is even further down this path, with "hot", "controversial", "active", etc, and defaults to "algorithmic" sorts for its front page and all comments. Fediverse absolutely has "algorithms". People generally want them. I agree that it's broadly less user-hostile (I'm very much a fan), but it's very much moving down the same paths as twitter (mastodon), reddit (lemmy), etc.
      - genewitch 3mo ago
        chronological feed nuisances can be blocked or not followed in the first place. It is absolutely not an algorithm by the definition we're all using here. It is an algorithm on a data structure, but it is not an algorithm to drive ad impressions. do you see the difference? this is why people say "Algo" when talking about the latter, and "Algorithm" when talking with other like-minded people about data structures and algorithms.
- harvey9 3mo ago
  They want an explanation of what an algorithm is. The world is full of people using words they don't understand and sometimes of them work in legislatures.
  - queenkjuul 2mo ago
    Read the bill, it defines what it means, unlike this clickbait claudeslop article
- duped 3mo ago
  The text of the bill is here: https://ilga.gov/Legislation/BillStatus/FullText?GAID=18&DocNum=5511&DocTypeID=HB&LegId=167486&SessionID=114 https://ilga.gov/Legislation/BillStatus/FullText?GAID=18&Doc.... There's about 3.5 pages of text defining this. The relevant text doesn't call it an "algorithmic feed" for what it's worth. They define an "addictive" feed and it's essentially any kind of personalized recommendation. > "Addictive feed" means a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met.
  - kube-system 3mo ago
    It seems that it mostly bans behavior-based personalization that is opaque to the user. It seems to allow for several types of personalization where the user has agency.
- kube-system 3mo ago
  > Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm? That's a paraphrasing of what law says. The law is more clearly defined: > "Addictive feed" means a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met: (1) the recommendation, prioritization, or selection is based on information that is not persistently associated with the user's device and does not concern the user's previous interactions with media generated or shared by other users; (2) the recommendation, prioritization, or selection is based on data controlled by user-selected privacy or accessibility settings or technical information concerning the user's device; (3) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information that is not permissible under this definition; (4) the user expressly and unambiguously requested the specific media by a specific author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to as described by paragraph (3), be blocked, prioritized, or deprioritized for display, provided that the media is not recommended, selected, or prioritized based, in whole or in part, on other information associated with the user or the user's device that is not permissible under this definition; (5) the media is direct and private communication between users; (6) the media is recommended, selected, or prioritized only in response to a specific search inquiry by the user; (7) the media that is recommended, selected, or prioritized for display is exclusively next in a preexisting sequence from the same author, creator, poster, or source; or (8) the recommendation, prioritization, or selection is necessary to comply with the provisions of this Act. "Addictive social media platform" means a covered platform that offers users or provides users with an addictive feed as a part of the service provided by that website, online service, online application, or mobile application.
- Marsymars 3mo ago
  > Any choice of what content to display is an algorithm. You could argue about the language and the meaning of "algorithm", but for practical purposes I'd consider a manually-curated feed to be non-algorithmic.
  - akersten 3mo ago
    sure, if we can make words mean whatever we like, yeah
- delecti 3mo ago
  > Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm? Phrases can have meanings beyond just a naive combination of the words in them. And indeed "algorithmic feed" in the bill means what what we all understand that term to mean when we aren't paralyzed by pedantry. > Under the law, [...] these users will only be shown content they request or search for or that is posted by a creator or friend they follow. You may disagree with the motivation behind the bill, but you do the discussion a disservice to assume the people writing it are incompetent enough to not define their terms.
  - spullara 3mo ago
    Algorithmic feeds are just search algorithms based on what the user is asking to see with their behavior.
    - wtallis 3mo ago
      I think it's pretty obvious that your explanation cannot be complete or accurate. Algorithmic feeds usually have a strong influence of what they want to show you, commonly pushing stuff you aren't interested in, or anything that will keep you on their app/site longer so they have more opportunities to show you ads. There are strong conflicts of interest here.
      - spullara 2mo ago
        No one produces a feed that purposefully delivers content or ads that you aren't interested in. Those are bugs. Go look at the published X algorithm. You won't find anything in there that would attempt to show you things that don't match your interests.
        queenkjuul 2mo ago
        I have no interest in anything Musk has to say, and yet, he's in everyone's feed
- tzs 2mo ago
  The article is slightly wrong. It is "addictive" feeds that are address, not "algorithmic" feeds. The definition is in in the bill, but the copies I have seen are formatted in ways that make copy/paste too much work, and a quick comparison looks like it is almost identical to New York's law targeting such feeds (except Illinois numbers there list 1-8 whereas NY letters it a-h), and I happen to have that in an easily pastable form, so here is the NY definition: > "Addictive feed" shall mean a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met, alone or in combination with one another: > (a) the recommendation, prioritization, or selection is based on information that is not persistently associated with the user or user's device, and does not concern the user's previous interactions with media generated or shared by other users; > (b) the recommendation, prioritization, or selection is based on user-selected privacy or accessibility settings, or technical information concerning the user's device; > (c) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user's device that is not otherwise permissible under this subdivision; > (d) the user expressly and unambiguously requested that specific media, media by a specified author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to pursuant to paragraph (c) of this subdivision, be blocked, prioritized or deprioritized for display, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user's device that is not otherwise permissible under this subdivision; > (e) the media are direct and private communications; > (f) the media are recommended, selected, or prioritized only in response to a specific search inquiry by the user; (> g) the media recommended, selected, or prioritized for display is exclusively next in a pre-existing sequence from the same author, creator, poster, or source; or > (h) the recommendation, prioritization, or selection is necessary to comply with the provisions of this article and any regulations promulgated pursuant to this article.
nacozarina 3mo ago
as Linus would say, that is a userland issue, not a Linux issue
- wormius 3mo ago
  as Stallman would say, that is a userland issue not a GNU/Linux issue ;P
  - guerrilla 3mo ago
    Incorrect. GNU/Linux includes userland while Linux doesn't.
    - ux266478 3mo ago
      However, unlike GNU plus Linux plus systemd plus FreeDesktop.org, it does not constitute a usable Operating System for a Desktop computer per se. Merely having a notion of userland isn't sufficient! Is age verification to be placed within the coreutils? I think not! Hyperfocusing on putting the API in systemd should be sufficient.... Pay no heed to anyone saying anything different, regulators!
      - genewitch 3mo ago
        $> ls -al User age not set, please verify age before invoking CLI utilities.
      - guerrilla 2mo ago
        Sounds great, get more people to go to systemd alternatives :D
tomrod 3mo ago
I'm surprised we're not seeing heaps of lawsuits here. Age verification in general violates privacy.
- kelseyfrog 3mo ago
  > I'm surprised we're not seeing heaps of lawsuits here. Why do you think that is?
- NavinF 3mo ago
  lawsuits for what? AFAIK you have no right to privacy in this sense
  - monocasa 3mo ago
    Legislating that all complex computing devices must give out your birthday (technically a "signal" of which bucket you're in, but sites are absolutely going to keep track of which bucket you where in, keep asking, and see when it changes). It's constitutional case law that there's an implicit right to privacy in the constitution. I don't see a law that you must wear a band with your birthday out in public passing muster based on that. I don't see why existing in cyberspace changes the inherent privacy question, and in fact makes it more meaningful given ease of automation.
    - otterley 3mo ago
      > It's constitutional case law that there's an implicit right to privacy in the constitution. Constitutional scholar here! I mean, yes, that's true in a very general sense, but no court has held that age verification to gain access to a service, or even a device, is unlawful in practice.
      - cogman10 3mo ago
        Novice, but I'd argue that Dobbs has seriously eroded that case law. The right to privacy used to be pretty settled law, but now the foundation of that settled law is on sandy ground.
selectively 3mo ago
[dead]
2OEH8eoCRo0 3mo ago
So that includes Android? What about the Unix of iOS? You can also thank big tech for this because they'll do anything to not verify age on their platforms they want to push it onto devices and OSes.
badgersnake 3mo ago
It’s bonkers that 50 states all decide to make their own set of rules for this. Maybe talk to each other?
- guerrilla 3mo ago
  Fuck that. Competition and diversity is way better. Anyine who fucks up can just change their laws later.
- SoftTalker 3mo ago
  It's a feature that states can (mostly) decide for themselves what laws they want to live under.
  - Barrin92 3mo ago
    when it comes to commerce it isn't because it makes doing business impossible. How is this practically going to look, Canonical, Red Hat and open source maintainers are going to ship 50 different Linux distributions in the United States? The reason the US has fairly robust interstate commerce laws is because if you don't you'll have trade barriers between states. Even the most well intentioned internet company can't operate in that ecosystem
    - SoftTalker 3mo ago
      Yes the constitution specifically identifies commerce as something Congress has the power to regulate. That doesn't mean states can't have their own rules. Many states have various forms of legalized cannibis, different laws regulating firearms, or automotive emissions.
      - iamnothere 3mo ago
        But this is clearly interstate commerce, given the global nature of the Internet and the distributed nature of development. I look forward to these laws being shut down in the courts.
thrownaway561 3mo ago
I don't understand how you are actually going to be able to enforce this when Linux is not "owned" by a single company. Also how is that fine going to work if you don't have any children?
- johnsmith1840 3mo ago
  Seems impossible to enforce but the goal I suppose is to hit the biggest players to force a trickle down on average users.
roundabout-host 3mo ago
Does it even ask for verification? If not, the problem with it is that it seems to require the OS provider (not the local installation) to store the age.
- warkdarrior 3mo ago
  No, no verification. From the post: > "Nothing in the bill requires a passport scan or a face scan at setup. It’s self-declared, the same way most apps ask your birthday today, just centralized once at the OS level instead of repeated app by app."
thrownaway561 3mo ago
[flagged]
- zamadatix 3mo ago
  You have to show ID to get voter registration in IL, regardless if you do it ahead of time or at the polls, it's just that the ID is not federal. The same situation (no federal ID needed, just proof of a portion of identity) is found with this and I really don't see either of those being measurably better/worse with a national ID. Not that I would mind a national ID. It's a real annoyance moving between states & I'd love to say "sorry state xyz, I'm already registered nationally and don't need a regional ID" when I move.
cptroot 3mo ago
Declaration, not verification
wartywhoa23 3mo ago
One doesn't make Linus disappear for some time and then arrive apologizing for stubborness and embracing the imposed CoC just for the heck of it.
engzaanin 3mo ago
The interesting part here is enforcement. Linux isn't controlled by a single vendor, so I'm not sure who the law would actually target.
- edwinjm 3mo ago
  A Linux distribution is
  - twothreeone 3mo ago
    So presumably the next step is they move their servers out of the US and then DA's target the Linux Foundation directly (e.g., coerce the kernel to take a change by some Meta engineers that "attests" a device when said option is compiled in, then force it as default on.. so in Debian you'd get an "Illinois"-kernel variant). At which point the only move is to relocate the foundation to another country, which will then of course be hit by tariffs and sanctions.
    - RealWed5 3mo ago
      "another country" is drafting this same law right now.
      - twothreeone 3mo ago
        There are 189 active legislative bodies to choose from; it's hard to imagine, but yes in the worst case they all fall in lockstep on this issue and none of them provide this kind of freedom. The obvious next step is to buy a remote island (better yet: some foreign body in Space) and form "Freedom (tm) Republic".
        RealWed5 3mo ago
        Remember that "pirate" guy buying an oil rig and building "freedom" crypto / torrent "country" there, with Datacenter running on the rig? That did not end well. Another case is Kim DotCom. And just look at the "success" of UK's freedom. TBH, we all are f...d.
kube-system 3mo ago
The law: https://www.ilga.gov/documents/legislation/publicacts/104/104-0664.htm https://www.ilga.gov/documents/legislation/publicacts/104/10...
Aurornis 3mo ago
Not that I'm condoning it, but this law requires self-declaration, not verification. It might sound pedantic but the practical difference is huge. Self-declaration means that the system asks the user to declare if they are a minor. Nothing is verified. Age verification typically means a system which checks ID or has other enforcement measures to try to verify age.
- weaksauce 3mo ago
  that is the start of a lot of bills like this... they really only ever increase in scope and invasiveness.
  - bryanlarsen 3mo ago
    On the contrary in my experience once a legislature passes a bill to "fix" a particular problem they consider it fixed and don't update it for at least 20 years.
    - paimapi 3mo ago
      it depends on whether or not there's someone who sees it as a crusade (rare), sees it as a way to get political clout (very common) and/or is getting a lot of lobbying money (extremely common [1]). see, for eg, the anti-trans bills that are being passed this is the same rhetorical and political strategy, that there are 'dangerous' people who will exploit your children so please vote for me, the person who cares the most about children and will go after the 'dangerous' people [1] https://themarkup.org/privacy/2021/04/15/big-tech-is-pushing-states-to-pass-privacy-laws-and-yes-you-should-be-suspicious https://themarkup.org/privacy/2021/04/15/big-tech-is-pushing...
      - frumplestlatz 3mo ago
        What is the connection to “anti-trans bills”?
        3mo ago
dvrp 3mo ago
“You may not be interested in politics, but politics is interested in you.”
bnjms 3mo ago
So in red states porn is being used, and in blue states TikTok and Instagram are being used. Is anyone tracking who is behind the concerted efforts here? For example, which organizations, executives, lobbyists and politicians are valid and responsible parties?
- skinfaxi 3mo ago
  This seems to have more information. https://www.reddit.com/r/linux/comments/1rshc1f/i_traced_2_billion_in_nonprofit_grants_and_45/ https://www.reddit.com/r/linux/comments/1rshc1f/i_traced_2_b...
  - twothreeone 3mo ago
    TL;DR: They claim it's Meta (which yeah it would make a lot of sense).
  - progval 3mo ago
    The Reddit post you linked to was hallucinated by Claude, see https://news.ycombinator.com/item?id=47659552 https://news.ycombinator.com/item?id=47659552 Their website (now offline) also added this page since I posted that comment: https://web.archive.org/web/20260411112604/https://tboteproject.com/notice/ https://web.archive.org/web/20260411112604/https://tboteproj... where they claim their website is under "surveillance" because it got a few thousand requests from Google Cloud et al, most of them to a single page. This shows how low their standards are.
- thewebguyd 3mo ago
  Meta is one of the biggest ones pushing for this, because they don't want to be accountable so these types of laws pass the buck onto the delivery platforms (Apple, Google, other OSes) Meta is then funding/lobbying alongside a bunch of other conservative groups like Heritage Action, and the digital childhood alliance (also made up of a ton of other conservative lobbying groups)
  - ethin 3mo ago
largehotcoffee 3mo ago
Unpopular opinion, but this is objectively better than having to upload your ID to every random website that requires an age check (if that's what the end result is).
- izzydata 3mo ago
  In the sense that a website could just ask your OS if you are over a certain age and that age was self declared? That seems fine to me, but why can't the websites just ask me for my self declared age? That's how things used to be and that makes more sense in my opinion because an OS isn't the thing displaying content. It just run whatever it is told to run.
  - hackinthebochs 3mo ago
    >but why can't the websites just ask me for my self declared age? Because children just click through the age gate when it suits them. With this legislation, a parent that purchases the device and creates an account for the child can set the age once and take the decision out of the kids hands. It's a huge improvement without any significant privacy issues. I can't fathom why the tech crowd is having a collective aneurism over this. >OS isn't the thing displaying content But the account on the OS is the right place for the single source of truth of properties of the current user.
    - genewitch 3mo ago
      I hope i can find this comment in a few years. Also children can "come upon" devices, so this is still completely pointless unless there's a way to ban devices that don't have this ability. and the only way to do that is to ban devices that cannot verify the user's age. since a device can't really verify an ID, some third party (ideally meta, but also the government works) needs to verify id and age, write something to the secure enclave of the device, and now that's stuck with the verified age set. If "just let someone report the age" worked, pornhub wouldn't be blocked in TX.
      - 3mo ago
HoldOnAMinute 3mo ago
Backdoor way to get data centers out of your state.
InitialLastName 3mo ago
Since TFA can't be bothered, here's the text of the actual bill: https://my.ilga.gov/Legislation/BillStatus/FullText?GAID=18&DocNum=5511&DocTypeID=HB&LegId=167486&SessionID=114 https://my.ilga.gov/Legislation/BillStatus/FullText?GAID=18&...
shevy-java 3mo ago
I predicted this would happen. Others also predicted this would happen. I think now even the last person realises that this has nothing to do with age "verification". They simply hate us for our freedom. And it is clearly a move coordinated by private business here; their lobbyists are acting. This is also why it is the same law essentially in so many different countries at the same time. It is quite fascinating to watch, actually. People used to say "conspiracy nut!" - well, the facts are too clear now. That's no longer a conspiracy.
kej 3mo ago
I feel like all of these laws are being designed backwards. Content providers, like MPAA films, should have to identify what sort of content they are providing. Then I can give my kids a device configured to allow some or all of that at my discretion. Requiring my kids' devices to advertise their age (or their age "bucket", as if that was a meaningful difference) to protect them is not doing me or my kids any favors.
- nickff 3mo ago
  Having the ability to identify who is watching or saying what on the internet would be immensely useful to the government; the justifications are really meaningless. Anti-money-laundering is a comparable field, as all the AML regulations and laws are ineffective at identifying money launderers, but they're wonderful for verifying (auditing and prosecuting) tax compliance.
  - avianlyric 3mo ago
    > Anti-money-laundering is a comparable field, as all the AML regulations and laws are ineffective at identifying money launderers, but they're wonderful for verifying (auditing and prosecuting) tax compliance. As someone who’s implemented AML, KYC, and tax reporting functions in a bank. I think you would be very surprised at how shit they are for tax auditing at scale. Unless the tax man is specifically auditing you, and basically requesting all your transaction details, the reporting that banks do would only allow tax agencies to catch the most brazen and incompetent tax dodgers. All of the tools however do make much harder to perform money laundering, forcing criminals to recruit and pay huge numbers of naive bank customers to allow criminals to launder money via their personal accounts, using them as money mules. Which then gets flagged and shutdown pretty quick by banks because the behaviour is generally pretty obvious. Unfortunately (or fortunately depending on your perspective) banks can’t/don’t coordinate on identified money mules or know launderers, so criminals just move on to other banks and repeat.
    - nickff 3mo ago
      Criminals don't have to "recruit and pay huge numbers of naive bank customers"; in my jurisdiction, they just walk into a casino with a few hundred thousand dollars, exchange for chips, pretend to gamble for an hour, then exchange the chips for cash, and walk out with a nice receipt. There're more complex schemes involving real estate and other mediums too.
Bender 3mo ago
These laws still do not sit well with me. This is just going to create endless lawsuits. In my opinion the safer choice would be to avoid doing anything with current teens, that's just a non starter. Instead think of sliding windows of time and sandbox small children on a child account that if all goes well will one day be a teen and then an adult. They will thank you when they are an adult for looking out for them when they were too young to consent to the data leaked by these laws. Why not just signal age ranges? Simple, the way the legal system works is one puts in a benign sounding law, then tweak it every year since the mechanism exists. (scope creep) "Now add city, state", "Now add DOB and address", "Now add your federal wallet ID." - For small children set an RTA header (previous discussions) [1] for any URL that may potentially contain content not appropriate for small children. Give site operators 1 year to implement this. Not counting QA and change control this takes minutes. - Require app and device vendors to create a properly sand-boxed child account. Pen test it but it does not have to be perfect. This is for small children and default installed applications. If the child visits a URL that contains the RTA header then trigger parental controls. It is entirely up to the parent when that child is ready for mature content. It must be impossible for the child to install any applications, addons, etc... There are a myriad of ways to accomplish this. - How is this enforced? Same way as any other parenting issue. If there is an incident that involves law enforcement, then social services can investigate and determine if negligence was occurring. When the child is mentally mature enough to deal with all the crap that is the internet their account is converted to an adult account. If the parent is giving the child an adult account before they are ready then the parent(s) go to mandatory parental training. If the child was being bullied or groomed, redirect law enforcement to go after the bullies or groomers. - Set the laws to be active for any small child that would be under 13 as of the year 2034. Presto! One need not try to confine teens. When these small children are teens they will either be used to the sandbox account or the parent may have converted the account to adult. As a side note all public and private schools should be legislated to have classes on dealing with all the crap the internet has to offer. Bullies, Cry-bullies, Trolls, Groomers, Scammers, Devious companies, Astroturfers, Gas Lighters, Propagandists, NGO's and so on. Also teach and help them build friend networks so there is protection in numbers. No child should be friendless. [1] - https://nochan.net/b/Internet-Crap/20230829-Think-Of-The-Children/ https://nochan.net/b/Internet-Crap/20230829-Think-Of-The-Chi...
afspear 3mo ago
Is being concerned that this article is obviously AI slop matter anymore?
- tstrimple 3mo ago
  It's only ever brought up by people with absolutely nothing to contribute to the conversation. So you've got that going for you.
corsendonk 3mo ago
It's none of your business. Go pound sand.
mutagenysis 3mo ago
Lets check how that state votes. "Solid Democrat". Yep.
WalterGR 3mo ago
2 days ago, 123 comments: https://news.ycombinator.com/item?id=49228350 https://news.ycombinator.com/item?id=49228350
unethical_ban 3mo ago
Here's my slight defense of something like this, in theory. I have not read the text of the bill. If OSes build a standards-based way to query age of user that is logged-in, where non-admins are not allowed to adjust the age bucket, then parents can configure devices on first use to have an OS-wide enforcement of age controls. Apps and sites would query the OS, not individual app/site accounts, for user age and act accordingly. Apps can then lock out certain features like algo feeds and adult content more consistently. Responsibility for proper use is still on the parent, and no verification process is put upon the operators of sites. Not sure how I actually think about this; I'm only putting this out for discussion.
- hdgvhicv 3mo ago
  Storing age is no different to storing name or address to me, it’s just a field in /etc/passwd, and root can change it.
  - ButlerianJihad 3mo ago
    I would disagree. First, passwd(5) is a venerable and rigidly-defined format. Can we please stop abusing poor GECOS for everything? Second, storing PII in a world-readable file is unacceptable. Linux is multi-user so the administration needs to be responsible about sensitive data like that! Find somewhere else to stash it!
- queenkjuul 2mo ago
  That is literally exactly what this bill does
lrvick 3mo ago
Linux distro founder here (stagex) I will never be compelled to implement this, and would never merge it. Every release requires quorum signatures by an international maintainer team, and the distro is designed to work offline-first, with some variants not even supporting network drivers in the kernel, so Illinois legislators can eat shit.
- otterley 3mo ago
  If you're in the USA or plan to visit someday, I would recommend you speak with your attorney before making such commitments.
  - lrvick 3mo ago
    I am in the USA, but I literally cannot comply because by design it is not possible for me to ship changes without the international maintainer team agreeing to them. And Illinois legislators have no power over them. Also, we are not a company. We are an independent community owned project. Our code is free speech and I will burn the world down to defend that right. Truly I dare someone to try to take me to court over this. Would be great publicity for our coercion resistant approach. They might as well try to mandate code changes to a blockchain and mandate the whole world host them.
    - rsyring 3mo ago
      Thank you.
    - mebizzle 3mo ago
      Thank you for fighting the good fight.
    - EA-3167 3mo ago
      I respect your principled stance on one hand, while on the other I’m amazed that someone as successful as you hasn’t learned that logic doesn’t dictate how governments work. Don’t make a target of yourself, there are countless ways for a government to make your life miserable.
LAC-Tech 3mo ago
What does this have to do with us? Illinois can put up a great firewall like China and search citizens devices for contraband operating systems. The onus is not on tech to enforce it, it's on them.
tangamandapio 3mo ago
Cool. I'd like to propose a federal law wherein every lawmaker, state or otherwise, musts either demonstrate they correctly enough understand the subject they're legislating over (for every single instance of legislative act they perform) or get approval from an actual accredited expert panel before being allowed to push any more inane bullshit that will help noone in the future.
- samgranieri 3mo ago
  It’s a series of tubes! It’s not a big truck!
exabrial 3mo ago
Democrat Representative Jennifer Gong-Gershowitz in the House Democrat Senator Willie Preston [D] in the senate
deleted 3mo ago
[deleted]
ChrisArchitect 3mo ago
[dupe] Earlier: https://news.ycombinator.com/item?id=49228350 https://news.ycombinator.com/item?id=49228350
- pseudalopex 2mo ago
  [dupe] Earlier: https://news.ycombinator.com/item?id=49250112 https://news.ycombinator.com/item?id=49250112
p0w3n3d 3mo ago
This renders all servers in Illinois illegal. Thanks.
- deleted 3mo ago
  [deleted]
josefritzishere 3mo ago
Gross. Age verification is a completely degenerate level of privacy violation
normalaccess 3mo ago
Thankfully for now this dragon is a hydra. Too many paths to block for now. The whole TPM fiasco with windows is preparation to put the genie back in the bottle. Soon, much sooner than I would like you will need a Global ID to access the internet, which will require an "internet safe operating system". It's only a matter of time. Get your sneakers ready folks.
- metal696heart 3mo ago
  How about a second internet ?
  - normalaccess 2mo ago
    My Opinion on that: It would be branded as unsafe and something only terrorists and extremists use. Aside from the propaganda campaigns that would run 24/7 to influence public opinion it would (and will) be outlawed to run an unmonitored personal compute system. I'll bet they will use the fact that open models can generate c-sam materials.
xp84 3mo ago
Serious question: This is a out-of-box "ask for age" requirement. No one is "verifying" anything. Why are we using this misleading headline? Face scans, ID cards, all that stuff that makes everyone nervous, are specifically not a part of this. To imply that it is verification is propaganda. As a parent, I'd be very happy with this "age declaration" method, as I also don't think the 'verification' others push for is at all worth the risks. All parents want is to put the devices permanently into a mode that flags it to third parties as belonging to a minor, so they can't just hold up their hands and say "idk they said they're 18" like they do today.
- JoshTriplett 3mo ago
  Two reasons people are arguing against it: It moves the Overton window, making worse things easier to pass in the future. And it enforces requirements on projects the state should have zero jurisdiction over.
  - chneu 3mo ago
    Yeah this is just step one and the evidence to support this is simple: history. Governments very, very rarely give up power. Once they have it they only work to expand that power. Next will be stronger and more restrictive shit.
    - queenkjuul 2mo ago
      Multiple states already have actual verification laws, Illinois is specifically choosing not to use that power
- Jtsummers 3mo ago
  Step 1: Shift the burden from service providers to OS providers (on devices owned by individuals). Step 2: Recognize that the system is trivially bypassed by a kid who sets up their own device without their parents' oversight or parents who just think this is a stupid law and lying for their kids. Or bypassed by anyone using open source operating systems which are (for a feature like this) going to be trivial to amend to always claim the person is an adult regardless of which account is being used. At this point there are three possible futures that are worth considering: 1. Throw out the rules because they're stupid and everyone with any common sense or sense of decency has been saying it since the start. The service provider is responsible, not the OS developer or device manufacturer. (Best case) 2. Keep the stupid rules on the books and pretend they work. Let the service providers off the hook. (Second best case) 3. Create more rules that effectively cedes more control of personal devices to the government to make this actually work, but the effect of this is to essentially outlaw OSes like Linux and many, many devices and even raw hardware without a government permitted OS pre-installed. (The worst case) (3) is extreme, but it's the only way that this law actually has the desired effect. (1) and (2) are the most likely outcomes, but reflect that this whole exercise is just a waste of time.
buzzwords 3mo ago
I love how everyone knows this has nothing to do with kids safety. However no one can or is willing to put up a fight. In the UK where I live its the same. Government does whatever they want and most of us just shrug our shoulders and say "that's messed up" and go on about our day.
- ethin 3mo ago
  The reason is ridiculously simple: people don't put up a fight because they don't want to be labelled as a peto or as someone not in favor of the protection of Children. This is primarily why this cudgel is brought out so often: it's very difficult to oppose because you risk getting shunned for it.
- anigbrowl 3mo ago
  How has this fatalism been working out for your society?
  - doublerabbit 3mo ago
    It sucks for sure. But how is it going for yours or any other country? I can't even get the politician of my city to reply to me in email because of his arrogant persona. How am I suppose to change something when I can't even get the local politician to listen? Cash would; but I'm stripped for that. You have any?
    - anigbrowl 3mo ago
      The UK is relatively small and I see surveys suggesting 70-80% of the population think the country is on the wrong track. Perhaps you should have a national strike or something, make the politicians come crawling to you instead of the other way around.
- xyst 3mo ago
  Don’t worry. It will all burn down soon. This administration is preparing the narrative to "cancel the midterms" if they lose the senate and house. Using the illegal war as cover.
deleted 3mo ago
[deleted]
Buttons840 3mo ago
I think this is a bad thing overall, but if the OS is responsible for reporting my age, that means I get to pick my own age... I'll take what I can get. Some states will pass laws that companies cannot show advertisements to minors. So... I think I'm about to become a bit of a minor myself, at least whenever it serves my interests.
RealWed5 3mo ago
TL;DR: learn how to live without computers. This will end Linux as end user OS, it will stay only in Cloud and containers. Arguably, the goal here is to destroy home PC altogether. maximum we will be allowed is a laptop with endpoint verification and mandatory touch ID, locked boot and non-replaceable hardware. If you think Linux is the end of it – think again. The same crap will be implemented in BIOS/UEFI, on "HW management" level. Essentially, your bare HW only laptop will not even start without you touching fingerprint sensor and allowing it to "validate your age" against – of course government approved – HW manufacturer. Same with smart phones – it's already here, if you tried to activate iPhone. And projects like Open/Free BSDs? Government will sure their leaders happily retire and ... well, the community will just "die" naturally.
CommanderData 3mo ago
Insert X reason to steal user freedom
Razengan 3mo ago
Oh come on guys, don't... Can't believe all this shit just allowed to happen then Muricans still claiming to have more freedom than China or Russia for long..
btbuildem 3mo ago
Ok so, all the appliances and cars and TVs and who knows what other embedded electronics sold in Illinois will require the user (?) to verify their age?
- dd8601fn 3mo ago
  Not verify. Voluntarily attest an age bracket.
kyledrake 3mo ago
Can someone tell me why all of the sudden everyone's totally cool with letting political hacks choke the internet to death? We used to make fun people like Ted Stevens for calling the internet "a series of tubes" and now we're just totally cool with letting a failed, bankrupt state in the US dictate what code needs to go into voluntary open source software. We need to fight back, now.
semiquaver 3mo ago
I hate that news you can’t ignore comes packaged as obvious slop you have to trudge through to to comprehend.
bigbuppo 3mo ago
Okay, go scorched earth with malicious compliance.
deleted 3mo ago
[deleted]
belviewreview 3mo ago
Including Tails?
txrx0000 3mo ago
This is worse than the California one. Since this applies to all Internet-capable operating systems, it's effectively forcing people to utter their age bracket in order to communicate digitally, which is compelled speech - a violation of the First Amendment. Here's an idea for the lawmakers that actually want to solve the digital parenting problem: fix the mobile OS duopoly with antitrust. Most kids only know how to use touchscreen devices. If you force mobile hardware vendors to ship smartphones without an OS, then we will get plenty of forks of Android and even entirely new OSes as a result of natural demand, some of which will be toy OSes with all of the child features built in. We'll also get scam-proof OSes for the elderly as a bonus. There is no good reason for the entire population to use the same OS.
- noman-land 3mo ago
  Does this mean you need to register your children and their ages with your smart fridge? The Epsteinocracy wants to know how many children you have and exactly how young they are.
ivl 3mo ago
> The bill’s own text caps penalties at $7,500 per affected child. If the distro does not ship with any hardware, it could only be attained via download? So how would this imperil Linux distros? Not to defend the law, it's comically pointless. Conservative states demanding ID verification for anything 'pornographic' and progressive ones trying to limit anyone under 18 from having any social media access at all. Clownish.
Grombobulous 3mo ago
> The signal itself isn’t a birthday, it’s a bracket: under 13, 13 to 15, 16 to 17, or 18 and up. Operating systems have until January 1, 2028 to have this built. > Nothing in the bill requires a passport scan or a face scan at setup. It’s self-declared, the same way most apps ask your birthday today, just centralized once at the OS level instead of repeated app by app. Maybe this is just a badly written law or purposefully designed to have basically no impact on anyone? Or maybe the age bracket self-declaration part of this might make it a legitimately useful mechanism when a parent sets up a device for their kids. Their device declares “under 13” and apps and sites have to then follow the more strict social media laws which themselves should be relatively beneficial to the target audience. In other words, the part that’s really privacy-destroying is the age verification, but that’s not part of this bill. The part that could be a benefit is the part where companies need to respect an age flag set by parents and comply with a concrete set of parental controls. In other other words, it’s not left up to operators like Meta and Roblox to decide what age their users are, parents can set that device-wide and know it can’t be circumvented.
akersten 3mo ago
https://agelesslinux.org/ https://agelesslinux.org/
shirro 3mo ago
Our political and business elites need age verification added to their penis.
spl757 3mo ago
These laws are so short-sited and willfully ignorant of the unintended consequences. The constitution provides rights and protections, and the government cannot compel speech. This will be appealed on consititional grounds and reversed. If not, I'd ban any Illinois resident from being able to use the site and redirect them to their local government representation. Compelled speech is just one attack the law is open to.
pull_my_finger 3mo ago
I agree with literally everyone who thinks this is pointless and probably malignant. The problem isn't the visibility or the fact that weird stuff "exists" on the internet. The problem is advertisers "showing" it to people who didn't go looking for it. Ads and algorithms that decide what a person to see are 99.8% of this actual problem, and meta lobbying for something like this is just obvious self-interest to absolve them from any liability for showing kids damaging material, and to hit 2 birds with one stone, they get more PII to add to their "anonymized" aggregate data. No good will come from this for the consumer. Websites are suddenly all going to start accurately reporting their content rating, especially ancient documents that have been "online" since before css and javascript were a thing. The only ones that will be implementing these checks will be adtech people that shouldn't have it in the first place. Letting out of touch geriatrics make tech policy decisions in a time when the bleeding edge is moving faster than ever is going to be disastrous for generations to come.
koalak 3mo ago
This is unconstitutional. Code is freedom of speech and cannot be censored in any fashion. Period.
stockresearcher 3mo ago
I would like to take a break from all the complaining and point out how hilarious it is that this law does not apply to any computer that can only connect to the internet via an Ethernet port.
1vuio0pswjnm7 3mo ago
1773350468 | Illinois introduces OS-level age verification law | https://legiscan.com/IL/bill/SB3977/2025 https://legiscan.com/IL/bill/SB3977/2025 | https://news.ycombinator.com/item?id=47357294 https://news.ycombinator.com/item?id=47357294 1773770767 | Illinois Introducing Operating System Account Age Bill | https://www.ilga.gov/Legislation/BillStatus?DocTypeID=HB&DocNum=5511 https://www.ilga.gov/Legislation/BillStatus?DocTypeID=HB&Doc... | https://news.ycombinator.com/item?id=47416131 https://news.ycombinator.com/item?id=47416131 1786248239 | Illinois just told every operating system to start reporting your kid's age | https://itsfoss.com/news/illinois-age-verification-bill/ https://itsfoss.com/news/illinois-age-verification-bill/ | https://news.ycombinator.com/item?id=49228350 https://news.ycombinator.com/item?id=49228350
mrieck 3mo ago
Not surprised - I live in IL and almost every SaaS I pay an extra "15% Chicago Lease Tax". Politicians hate tech here.
jtokoph 3mo ago
How old is the root user? How about the nginx user? How about “nobody”?
jzer0cool 3mo ago
I get the privacy concern in regards to advertising ones age, but I wonder if this is akin to a underage walking into a liquor store, interacting with stranger adults, etc. There are obvious appropriate and inappropriate behaviors to minors. Let's confine only of consumer OS and is provisioned with an underage bracket (you set it to what you want, And Not a Require verify). All sites/app the OS interacts must honor certain child protection laws (privacy, selling, gathering etc)? What is the main discussion surrounding placing (by choice) some 'optional' age bracket to enter during the OS setup/provisioning? The OS as provider only declares an age and it seems the sites/apps it interacts with to be the ones in the hook, not the OS.
zombot 3mo ago
So no more Linux in Illinois?
dorkydev 2mo ago
How gullible and naive is anyone to believe for a single instance that the government would be stupid enough to just say okay age verify anything Apple, Android and Microsoft based. hahaha! Yet people swore linux users were smart! Guess not.
dennysora-main 2mo ago
[dead]
tsoukase 2mo ago
I could accept the solution that the superuser decides about the age bracket of each regular user, that can be changed anytime. sudo chage -u mybob --bracket teen Users cannot change the setting, it can be presented to apps and let parents simply and safely enforce will. The root is the ultimate leader of the system, let him do his thing.
queenkjuul 2mo ago
This isn't really age verification, it's Steam-style "age attestation," there's no mechanism nor enforcement that the age you put in has to be accurate. But i think signaling to websites that the user account is underage is good, and this is really just enhanced parental controls at that point. Parent sets up account for child, puts in age, child can't change it, websites can't ignore it. Seems okay to me.

345 points by speckx 3mo ago

[flagged]

What does that mean, practically? The person who installed linux on that particular device is liable? >no algorithmic feeds for minors by default Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm?

stevenalowe 3mo ago
"Illinois now requires operating system providers, open source projects included, to build age verification by 2028" however "nothing in the bill has teeth against someone with no business presence in Illinois"
- gh02t 3mo ago
  Companies like Red Hat/IBM operate in Illinois and for better or worse have controlling interests in Linux and across open source projects pretty broadly. Wouldn't they be forced to include the capability in their products, which then percolate out to everyone just by network effects?
  - FuckButtons 3mo ago
    finally the die hard systemd haters will have an actually valid point.
    - LPisGood 3mo ago
      I’m unfamiliar with systemd’s haters or why this would give them a valid point. Could you please elaborate?
      - genewitch 3mo ago
        systemd is a massive blob of code that infects every part of a system and all of its subsystems. It completely changed the way system administration was done, the way init scripts work, and added tons of things to init that some argue aren't necessary, like dhcp and DNS. Newer linux folks like it because they're used to it, people who don't like it use devuan, gentoo, or one of the others that still lets one use openRC or whatever else. upthread someone mentioned that systemd already has the ability to store the birthdate of a user. Why would an init system need that? It doesn't, but here we are.
        Melonai 3mo ago
        Maybe I'm about to be too pedantic, but I never quite got the argument of systemd being massively bloated based on examples of it including DNS and DHCP. Sure it's a mono-repository that includes all these services, but in the end you do run them separately? The actual "systemd, the init system" doesn't have DNS, DHCP or a user birthday database built-in, those are contained in their own services, namely systemd-resolved, systemd-networkd, and systemd-userdbd respectively, and, although systemd does genuinely lead you down the path of using them (which might be a real problem!), there isn't actually a definite requirement to do so. systemd will gladly run your BIND, ISC DHCP and NetworkManager for you if you tell it to, no? In fact we do so at my place of work. Just because they are under the same project as the init system doesn't mean they are one monolith, I think. To me that feels like saying "Why does the GNU C library include a bootloader!". Now it's not like there's not plenty to dislike about systemd, it is a wide-reaching project that has managed to get a huge mindshare of the lower-level services needed to run a basic Linux server or desktop, and that has caused many utilities and services to appear that have a hard dependency on it, which is obviously bad for anyone running services that aren't part of the systemd package set, just take a look at NixOS, it's practically built purely on systemd, with efforts to support alternative init systems essentially archived at this point. Plenty of people also quite dislike Lennart, or how involved corporations are in the systemd development, and other people have loads of other reasons. One of my own gripes is speed for quite a few basic procedures in networkd. There's enough stuff to hate about it! I think it's not really necessary to pretend that your init system runs a DNS server and stores birthdays.
  - johnsmith1840 3mo ago
    I don't see how they enforce it though? Isn't this saying every linux instance needs basically a backdoor network access? How would verify the 30 pods on my node are from minors or adults without that? Or this is more about a user facing node? So my aws nodes need to verify my age before I ssh in? Remote desktop services? Sounds so complicated to actually do.
    - dd8601fn 3mo ago
      I suppose they only have to confirm that the OS supports age bucket reporting... not that you're using it.
    - MrJohz 3mo ago
      There's no verification necessary. Instead, you'd just set a flag on all of those pods that says "this is an adult". Or more likely, you wouldn't set anything, there would be no changes at all, because that would be the default. However, if I gave my child a laptop with Linux installed, the law would force the OS to provide some setting somewhere that I can toggle that switches the installation to child mode. (On Linux, I imagine it would make sense to have this be a per-user toggle, so my kid's account would be in child mode, and the root account would not.) The applications on that computer would then be required to check that setting if they want to show "adult content" (here defined as algorithmic feeds, notifications between certain hours, the ability to receive messages from identified adults). Similarly (this isn't clear but would presumably be technically required) browsers would pass this setting on to websites in some way. Another way of seeing it is this: you know the DNT/Do Not Track header that you can optionally set in your browser and (theoretically at least) websites will not track you? This is essentially that but for certain kinds of content. If you set the header, websites won't be allowed to show algorithmic feeds, etc. Basically all of this is in the article, which lays it out very clearly (if you ignore the Claude-isms).
      - johnsmith1840 2mo ago
        Oh, that's not that bad? Literally a flag at bios/admin layer defaulting to adult. I mean completely unenforcable but still not that crazy
monocasa 3mo ago
That part hasn't really been decided since it's a regulatory question. Basically the bill defines > "Operating system provider" means a commercial or non-profit entity that controls the Internet-enabled device's operating system, including the design, programming, or supply of operating systems for the Internet-enabled devices. Which is an extremely broad definition that could be interpreted in a whole bunch of ways.
deleted 3mo ago
[deleted]
koutakun 3mo ago
Presumably this means no targeting the user's preferences and just showing everything by newest/most liked.
- genewitch 3mo ago
  "most liked" won't work. has to be chronological, and manually curated. the way fediverse works. when you make an account somewhere, you can choose to see the local people, or the entire network, but it's all chronological. There's things like hashtag searches and whatnot, but none of it is algorithms; in the sense we understand it to mean, here, these are not manipulative algorithms designed to keep people on a site and keep ads rolling by. on the fediverse, there are bots to curate content such as "most liked", one can subscribe to these bots to see such "views" of the feed. there's absolutely no reason for any of that crap to be built in, other than that's how reddit (and HN) do it.
  - Groxx 3mo ago
    There's a "trending" feed on nearly every implementation including the official Mastodon one (hashtags have their own "trending" too), and chronological definitely fits "an algorithm" imo - it has all the hallmark problems of one, such as encouraging bad behavior (frequent spamming is the most effective strategy to be seen). Lemmy is even further down this path, with "hot", "controversial", "active", etc, and defaults to "algorithmic" sorts for its front page and all comments. Fediverse absolutely has "algorithms". People generally want them. I agree that it's broadly less user-hostile (I'm very much a fan), but it's very much moving down the same paths as twitter (mastodon), reddit (lemmy), etc.
    - genewitch 3mo ago
      chronological feed nuisances can be blocked or not followed in the first place. It is absolutely not an algorithm by the definition we're all using here. It is an algorithm on a data structure, but it is not an algorithm to drive ad impressions. do you see the difference? this is why people say "Algo" when talking about the latter, and "Algorithm" when talking with other like-minded people about data structures and algorithms.
harvey9 3mo ago
They want an explanation of what an algorithm is. The world is full of people using words they don't understand and sometimes of them work in legislatures.
- queenkjuul 2mo ago
  Read the bill, it defines what it means, unlike this clickbait claudeslop article
duped 3mo ago
The text of the bill is here: https://ilga.gov/Legislation/BillStatus/FullText?GAID=18&DocNum=5511&DocTypeID=HB&LegId=167486&SessionID=114 https://ilga.gov/Legislation/BillStatus/FullText?GAID=18&Doc.... There's about 3.5 pages of text defining this. The relevant text doesn't call it an "algorithmic feed" for what it's worth. They define an "addictive" feed and it's essentially any kind of personalized recommendation. > "Addictive feed" means a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met.
- kube-system 3mo ago
  It seems that it mostly bans behavior-based personalization that is opaque to the user. It seems to allow for several types of personalization where the user has agency.
kube-system 3mo ago
> Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm? That's a paraphrasing of what law says. The law is more clearly defined: > "Addictive feed" means a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met: (1) the recommendation, prioritization, or selection is based on information that is not persistently associated with the user's device and does not concern the user's previous interactions with media generated or shared by other users; (2) the recommendation, prioritization, or selection is based on data controlled by user-selected privacy or accessibility settings or technical information concerning the user's device; (3) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information that is not permissible under this definition; (4) the user expressly and unambiguously requested the specific media by a specific author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to as described by paragraph (3), be blocked, prioritized, or deprioritized for display, provided that the media is not recommended, selected, or prioritized based, in whole or in part, on other information associated with the user or the user's device that is not permissible under this definition; (5) the media is direct and private communication between users; (6) the media is recommended, selected, or prioritized only in response to a specific search inquiry by the user; (7) the media that is recommended, selected, or prioritized for display is exclusively next in a preexisting sequence from the same author, creator, poster, or source; or (8) the recommendation, prioritization, or selection is necessary to comply with the provisions of this Act. "Addictive social media platform" means a covered platform that offers users or provides users with an addictive feed as a part of the service provided by that website, online service, online application, or mobile application.
Marsymars 3mo ago
> Any choice of what content to display is an algorithm. You could argue about the language and the meaning of "algorithm", but for practical purposes I'd consider a manually-curated feed to be non-algorithmic.
- akersten 3mo ago
  sure, if we can make words mean whatever we like, yeah
delecti 3mo ago
> Any choice of what content to display is an algorithm. Maybe they want a simple or easily explainable algorithm? Phrases can have meanings beyond just a naive combination of the words in them. And indeed "algorithmic feed" in the bill means what what we all understand that term to mean when we aren't paralyzed by pedantry. > Under the law, [...] these users will only be shown content they request or search for or that is posted by a creator or friend they follow. You may disagree with the motivation behind the bill, but you do the discussion a disservice to assume the people writing it are incompetent enough to not define their terms.
- spullara 3mo ago
  Algorithmic feeds are just search algorithms based on what the user is asking to see with their behavior.
  - wtallis 3mo ago
    I think it's pretty obvious that your explanation cannot be complete or accurate. Algorithmic feeds usually have a strong influence of what they want to show you, commonly pushing stuff you aren't interested in, or anything that will keep you on their app/site longer so they have more opportunities to show you ads. There are strong conflicts of interest here.
    - spullara 2mo ago
      No one produces a feed that purposefully delivers content or ads that you aren't interested in. Those are bugs. Go look at the published X algorithm. You won't find anything in there that would attempt to show you things that don't match your interests.
      - queenkjuul 2mo ago
        I have no interest in anything Musk has to say, and yet, he's in everyone's feed
tzs 2mo ago
The article is slightly wrong. It is "addictive" feeds that are address, not "algorithmic" feeds. The definition is in in the bill, but the copies I have seen are formatted in ways that make copy/paste too much work, and a quick comparison looks like it is almost identical to New York's law targeting such feeds (except Illinois numbers there list 1-8 whereas NY letters it a-h), and I happen to have that in an easily pastable form, so here is the NY definition: > "Addictive feed" shall mean a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met, alone or in combination with one another: > (a) the recommendation, prioritization, or selection is based on information that is not persistently associated with the user or user's device, and does not concern the user's previous interactions with media generated or shared by other users; > (b) the recommendation, prioritization, or selection is based on user-selected privacy or accessibility settings, or technical information concerning the user's device; > (c) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user's device that is not otherwise permissible under this subdivision; > (d) the user expressly and unambiguously requested that specific media, media by a specified author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to pursuant to paragraph (c) of this subdivision, be blocked, prioritized or deprioritized for display, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user's device that is not otherwise permissible under this subdivision; > (e) the media are direct and private communications; > (f) the media are recommended, selected, or prioritized only in response to a specific search inquiry by the user; (> g) the media recommended, selected, or prioritized for display is exclusively next in a pre-existing sequence from the same author, creator, poster, or source; or > (h) the recommendation, prioritization, or selection is necessary to comply with the provisions of this article and any regulations promulgated pursuant to this article.

nacozarina 3mo ago

as Linus would say, that is a userland issue, not a Linux issue

wormius 3mo ago
as Stallman would say, that is a userland issue not a GNU/Linux issue ;P
- guerrilla 3mo ago
  Incorrect. GNU/Linux includes userland while Linux doesn't.
  - ux266478 3mo ago
    However, unlike GNU plus Linux plus systemd plus FreeDesktop.org, it does not constitute a usable Operating System for a Desktop computer per se. Merely having a notion of userland isn't sufficient! Is age verification to be placed within the coreutils? I think not! Hyperfocusing on putting the API in systemd should be sufficient.... Pay no heed to anyone saying anything different, regulators!
    - genewitch 3mo ago
      $> ls -al User age not set, please verify age before invoking CLI utilities.
    - guerrilla 2mo ago
      Sounds great, get more people to go to systemd alternatives :D

tomrod 3mo ago

I'm surprised we're not seeing heaps of lawsuits here. Age verification in general violates privacy.

kelseyfrog 3mo ago
> I'm surprised we're not seeing heaps of lawsuits here. Why do you think that is?
NavinF 3mo ago
lawsuits for what? AFAIK you have no right to privacy in this sense
- monocasa 3mo ago
  Legislating that all complex computing devices must give out your birthday (technically a "signal" of which bucket you're in, but sites are absolutely going to keep track of which bucket you where in, keep asking, and see when it changes). It's constitutional case law that there's an implicit right to privacy in the constitution. I don't see a law that you must wear a band with your birthday out in public passing muster based on that. I don't see why existing in cyberspace changes the inherent privacy question, and in fact makes it more meaningful given ease of automation.
  - otterley 3mo ago
    > It's constitutional case law that there's an implicit right to privacy in the constitution. Constitutional scholar here! I mean, yes, that's true in a very general sense, but no court has held that age verification to gain access to a service, or even a device, is unlawful in practice.
    - cogman10 3mo ago
      Novice, but I'd argue that Dobbs has seriously eroded that case law. The right to privacy used to be pretty settled law, but now the foundation of that settled law is on sandy ground.

selectively 3mo ago

[dead]

2OEH8eoCRo0 3mo ago

So that includes Android? What about the Unix of iOS? You can also thank big tech for this because they'll do anything to not verify age on their platforms they want to push it onto devices and OSes.

badgersnake 3mo ago

It’s bonkers that 50 states all decide to make their own set of rules for this. Maybe talk to each other?

guerrilla 3mo ago
Fuck that. Competition and diversity is way better. Anyine who fucks up can just change their laws later.
SoftTalker 3mo ago
It's a feature that states can (mostly) decide for themselves what laws they want to live under.
- Barrin92 3mo ago
  when it comes to commerce it isn't because it makes doing business impossible. How is this practically going to look, Canonical, Red Hat and open source maintainers are going to ship 50 different Linux distributions in the United States? The reason the US has fairly robust interstate commerce laws is because if you don't you'll have trade barriers between states. Even the most well intentioned internet company can't operate in that ecosystem
  - SoftTalker 3mo ago
    Yes the constitution specifically identifies commerce as something Congress has the power to regulate. That doesn't mean states can't have their own rules. Many states have various forms of legalized cannibis, different laws regulating firearms, or automotive emissions.
    - iamnothere 3mo ago
      But this is clearly interstate commerce, given the global nature of the Internet and the distributed nature of development. I look forward to these laws being shut down in the courts.

thrownaway561 3mo ago

I don't understand how you are actually going to be able to enforce this when Linux is not "owned" by a single company. Also how is that fine going to work if you don't have any children?

johnsmith1840 3mo ago
Seems impossible to enforce but the goal I suppose is to hit the biggest players to force a trickle down on average users.

roundabout-host 3mo ago

Does it even ask for verification? If not, the problem with it is that it seems to require the OS provider (not the local installation) to store the age.

warkdarrior 3mo ago
No, no verification. From the post: > "Nothing in the bill requires a passport scan or a face scan at setup. It’s self-declared, the same way most apps ask your birthday today, just centralized once at the OS level instead of repeated app by app."

thrownaway561 3mo ago

[flagged]

zamadatix 3mo ago
You have to show ID to get voter registration in IL, regardless if you do it ahead of time or at the polls, it's just that the ID is not federal. The same situation (no federal ID needed, just proof of a portion of identity) is found with this and I really don't see either of those being measurably better/worse with a national ID. Not that I would mind a national ID. It's a real annoyance moving between states & I'd love to say "sorry state xyz, I'm already registered nationally and don't need a regional ID" when I move.

cptroot 3mo ago

Declaration, not verification

wartywhoa23 3mo ago

One doesn't make Linus disappear for some time and then arrive apologizing for stubborness and embracing the imposed CoC just for the heck of it.

engzaanin 3mo ago

The interesting part here is enforcement. Linux isn't controlled by a single vendor, so I'm not sure who the law would actually target.

edwinjm 3mo ago
A Linux distribution is
- twothreeone 3mo ago
  So presumably the next step is they move their servers out of the US and then DA's target the Linux Foundation directly (e.g., coerce the kernel to take a change by some Meta engineers that "attests" a device when said option is compiled in, then force it as default on.. so in Debian you'd get an "Illinois"-kernel variant). At which point the only move is to relocate the foundation to another country, which will then of course be hit by tariffs and sanctions.
  - RealWed5 3mo ago
    "another country" is drafting this same law right now.
    - twothreeone 3mo ago
      There are 189 active legislative bodies to choose from; it's hard to imagine, but yes in the worst case they all fall in lockstep on this issue and none of them provide this kind of freedom. The obvious next step is to buy a remote island (better yet: some foreign body in Space) and form "Freedom (tm) Republic".
      - RealWed5 3mo ago
        Remember that "pirate" guy buying an oil rig and building "freedom" crypto / torrent "country" there, with Datacenter running on the rig? That did not end well. Another case is Kim DotCom. And just look at the "success" of UK's freedom. TBH, we all are f...d.

kube-system 3mo ago

The law: https://www.ilga.gov/documents/legislation/publicacts/104/104-0664.htm https://www.ilga.gov/documents/legislation/publicacts/104/10...

Aurornis 3mo ago

Not that I'm condoning it, but this law requires self-declaration, not verification. It might sound pedantic but the practical difference is huge. Self-declaration means that the system asks the user to declare if they are a minor. Nothing is verified. Age verification typically means a system which checks ID or has other enforcement measures to try to verify age.

weaksauce 3mo ago
that is the start of a lot of bills like this... they really only ever increase in scope and invasiveness.
- bryanlarsen 3mo ago
  On the contrary in my experience once a legislature passes a bill to "fix" a particular problem they consider it fixed and don't update it for at least 20 years.
  - paimapi 3mo ago
    it depends on whether or not there's someone who sees it as a crusade (rare), sees it as a way to get political clout (very common) and/or is getting a lot of lobbying money (extremely common [1]). see, for eg, the anti-trans bills that are being passed this is the same rhetorical and political strategy, that there are 'dangerous' people who will exploit your children so please vote for me, the person who cares the most about children and will go after the 'dangerous' people [1] https://themarkup.org/privacy/2021/04/15/big-tech-is-pushing-states-to-pass-privacy-laws-and-yes-you-should-be-suspicious https://themarkup.org/privacy/2021/04/15/big-tech-is-pushing...
    - frumplestlatz 3mo ago
      What is the connection to “anti-trans bills”?
      - 3mo ago

dvrp 3mo ago

“You may not be interested in politics, but politics is interested in you.”

bnjms 3mo ago

So in red states porn is being used, and in blue states TikTok and Instagram are being used. Is anyone tracking who is behind the concerted efforts here? For example, which organizations, executives, lobbyists and politicians are valid and responsible parties?

skinfaxi 3mo ago
This seems to have more information. https://www.reddit.com/r/linux/comments/1rshc1f/i_traced_2_billion_in_nonprofit_grants_and_45/ https://www.reddit.com/r/linux/comments/1rshc1f/i_traced_2_b...
- twothreeone 3mo ago
  TL;DR: They claim it's Meta (which yeah it would make a lot of sense).
- progval 3mo ago
  The Reddit post you linked to was hallucinated by Claude, see https://news.ycombinator.com/item?id=47659552 https://news.ycombinator.com/item?id=47659552 Their website (now offline) also added this page since I posted that comment: https://web.archive.org/web/20260411112604/https://tboteproject.com/notice/ https://web.archive.org/web/20260411112604/https://tboteproj... where they claim their website is under "surveillance" because it got a few thousand requests from Google Cloud et al, most of them to a single page. This shows how low their standards are.
thewebguyd 3mo ago
Meta is one of the biggest ones pushing for this, because they don't want to be accountable so these types of laws pass the buck onto the delivery platforms (Apple, Google, other OSes) Meta is then funding/lobbying alongside a bunch of other conservative groups like Heritage Action, and the digital childhood alliance (also made up of a ton of other conservative lobbying groups)
- ethin 3mo ago

largehotcoffee 3mo ago

Unpopular opinion, but this is objectively better than having to upload your ID to every random website that requires an age check (if that's what the end result is).

izzydata 3mo ago
In the sense that a website could just ask your OS if you are over a certain age and that age was self declared? That seems fine to me, but why can't the websites just ask me for my self declared age? That's how things used to be and that makes more sense in my opinion because an OS isn't the thing displaying content. It just run whatever it is told to run.
- hackinthebochs 3mo ago
  >but why can't the websites just ask me for my self declared age? Because children just click through the age gate when it suits them. With this legislation, a parent that purchases the device and creates an account for the child can set the age once and take the decision out of the kids hands. It's a huge improvement without any significant privacy issues. I can't fathom why the tech crowd is having a collective aneurism over this. >OS isn't the thing displaying content But the account on the OS is the right place for the single source of truth of properties of the current user.
  - genewitch 3mo ago
    I hope i can find this comment in a few years. Also children can "come upon" devices, so this is still completely pointless unless there's a way to ban devices that don't have this ability. and the only way to do that is to ban devices that cannot verify the user's age. since a device can't really verify an ID, some third party (ideally meta, but also the government works) needs to verify id and age, write something to the secure enclave of the device, and now that's stuck with the verified age set. If "just let someone report the age" worked, pornhub wouldn't be blocked in TX.
    - 3mo ago

HoldOnAMinute 3mo ago

Backdoor way to get data centers out of your state.

InitialLastName 3mo ago

Since TFA can't be bothered, here's the text of the actual bill: https://my.ilga.gov/Legislation/BillStatus/FullText?GAID=18&DocNum=5511&DocTypeID=HB&LegId=167486&SessionID=114 https://my.ilga.gov/Legislation/BillStatus/FullText?GAID=18&...

shevy-java 3mo ago

I predicted this would happen. Others also predicted this would happen. I think now even the last person realises that this has nothing to do with age "verification". They simply hate us for our freedom. And it is clearly a move coordinated by private business here; their lobbyists are acting. This is also why it is the same law essentially in so many different countries at the same time. It is quite fascinating to watch, actually. People used to say "conspiracy nut!" - well, the facts are too clear now. That's no longer a conspiracy.

kej 3mo ago

I feel like all of these laws are being designed backwards. Content providers, like MPAA films, should have to identify what sort of content they are providing. Then I can give my kids a device configured to allow some or all of that at my discretion. Requiring my kids' devices to advertise their age (or their age "bucket", as if that was a meaningful difference) to protect them is not doing me or my kids any favors.

nickff 3mo ago
Having the ability to identify who is watching or saying what on the internet would be immensely useful to the government; the justifications are really meaningless. Anti-money-laundering is a comparable field, as all the AML regulations and laws are ineffective at identifying money launderers, but they're wonderful for verifying (auditing and prosecuting) tax compliance.
- avianlyric 3mo ago
  > Anti-money-laundering is a comparable field, as all the AML regulations and laws are ineffective at identifying money launderers, but they're wonderful for verifying (auditing and prosecuting) tax compliance. As someone who’s implemented AML, KYC, and tax reporting functions in a bank. I think you would be very surprised at how shit they are for tax auditing at scale. Unless the tax man is specifically auditing you, and basically requesting all your transaction details, the reporting that banks do would only allow tax agencies to catch the most brazen and incompetent tax dodgers. All of the tools however do make much harder to perform money laundering, forcing criminals to recruit and pay huge numbers of naive bank customers to allow criminals to launder money via their personal accounts, using them as money mules. Which then gets flagged and shutdown pretty quick by banks because the behaviour is generally pretty obvious. Unfortunately (or fortunately depending on your perspective) banks can’t/don’t coordinate on identified money mules or know launderers, so criminals just move on to other banks and repeat.
  - nickff 3mo ago
    Criminals don't have to "recruit and pay huge numbers of naive bank customers"; in my jurisdiction, they just walk into a casino with a few hundred thousand dollars, exchange for chips, pretend to gamble for an hour, then exchange the chips for cash, and walk out with a nice receipt. There're more complex schemes involving real estate and other mediums too.

Bender 3mo ago

These laws still do not sit well with me. This is just going to create endless lawsuits. In my opinion the safer choice would be to avoid doing anything with current teens, that's just a non starter. Instead think of sliding windows of time and sandbox small children on a child account that if all goes well will one day be a teen and then an adult. They will thank you when they are an adult for looking out for them when they were too young to consent to the data leaked by these laws. Why not just signal age ranges? Simple, the way the legal system works is one puts in a benign sounding law, then tweak it every year since the mechanism exists. (scope creep) "Now add city, state", "Now add DOB and address", "Now add your federal wallet ID." - For small children set an RTA header (previous discussions) [1] for any URL that may potentially contain content not appropriate for small children. Give site operators 1 year to implement this. Not counting QA and change control this takes minutes. - Require app and device vendors to create a properly sand-boxed child account. Pen test it but it does not have to be perfect. This is for small children and default installed applications. If the child visits a URL that contains the RTA header then trigger parental controls. It is entirely up to the parent when that child is ready for mature content. It must be impossible for the child to install any applications, addons, etc... There are a myriad of ways to accomplish this. - How is this enforced? Same way as any other parenting issue. If there is an incident that involves law enforcement, then social services can investigate and determine if negligence was occurring. When the child is mentally mature enough to deal with all the crap that is the internet their account is converted to an adult account. If the parent is giving the child an adult account before they are ready then the parent(s) go to mandatory parental training. If the child was being bullied or groomed, redirect law enforcement to go after the bullies or groomers. - Set the laws to be active for any small child that would be under 13 as of the year 2034. Presto! One need not try to confine teens. When these small children are teens they will either be used to the sandbox account or the parent may have converted the account to adult. As a side note all public and private schools should be legislated to have classes on dealing with all the crap the internet has to offer. Bullies, Cry-bullies, Trolls, Groomers, Scammers, Devious companies, Astroturfers, Gas Lighters, Propagandists, NGO's and so on. Also teach and help them build friend networks so there is protection in numbers. No child should be friendless. [1] - https://nochan.net/b/Internet-Crap/20230829-Think-Of-The-Children/ https://nochan.net/b/Internet-Crap/20230829-Think-Of-The-Chi...

afspear 3mo ago

Is being concerned that this article is obviously AI slop matter anymore?

tstrimple 3mo ago
It's only ever brought up by people with absolutely nothing to contribute to the conversation. So you've got that going for you.

corsendonk 3mo ago

It's none of your business. Go pound sand.

mutagenysis 3mo ago

Lets check how that state votes. "Solid Democrat". Yep.

WalterGR 3mo ago

2 days ago, 123 comments: https://news.ycombinator.com/item?id=49228350 https://news.ycombinator.com/item?id=49228350

unethical_ban 3mo ago

Here's my slight defense of something like this, in theory. I have not read the text of the bill. If OSes build a standards-based way to query age of user that is logged-in, where non-admins are not allowed to adjust the age bucket, then parents can configure devices on first use to have an OS-wide enforcement of age controls. Apps and sites would query the OS, not individual app/site accounts, for user age and act accordingly. Apps can then lock out certain features like algo feeds and adult content more consistently. Responsibility for proper use is still on the parent, and no verification process is put upon the operators of sites. Not sure how I actually think about this; I'm only putting this out for discussion.

hdgvhicv 3mo ago
Storing age is no different to storing name or address to me, it’s just a field in /etc/passwd, and root can change it.
- ButlerianJihad 3mo ago
  I would disagree. First, passwd(5) is a venerable and rigidly-defined format. Can we please stop abusing poor GECOS for everything? Second, storing PII in a world-readable file is unacceptable. Linux is multi-user so the administration needs to be responsible about sensitive data like that! Find somewhere else to stash it!
queenkjuul 2mo ago
That is literally exactly what this bill does

lrvick 3mo ago

Linux distro founder here (stagex) I will never be compelled to implement this, and would never merge it. Every release requires quorum signatures by an international maintainer team, and the distro is designed to work offline-first, with some variants not even supporting network drivers in the kernel, so Illinois legislators can eat shit.

otterley 3mo ago
If you're in the USA or plan to visit someday, I would recommend you speak with your attorney before making such commitments.
- lrvick 3mo ago
  I am in the USA, but I literally cannot comply because by design it is not possible for me to ship changes without the international maintainer team agreeing to them. And Illinois legislators have no power over them. Also, we are not a company. We are an independent community owned project. Our code is free speech and I will burn the world down to defend that right. Truly I dare someone to try to take me to court over this. Would be great publicity for our coercion resistant approach. They might as well try to mandate code changes to a blockchain and mandate the whole world host them.
  - rsyring 3mo ago
    Thank you.
  - mebizzle 3mo ago
    Thank you for fighting the good fight.
  - EA-3167 3mo ago
    I respect your principled stance on one hand, while on the other I’m amazed that someone as successful as you hasn’t learned that logic doesn’t dictate how governments work. Don’t make a target of yourself, there are countless ways for a government to make your life miserable.

LAC-Tech 3mo ago

What does this have to do with us? Illinois can put up a great firewall like China and search citizens devices for contraband operating systems. The onus is not on tech to enforce it, it's on them.

tangamandapio 3mo ago

Cool. I'd like to propose a federal law wherein every lawmaker, state or otherwise, musts either demonstrate they correctly enough understand the subject they're legislating over (for every single instance of legislative act they perform) or get approval from an actual accredited expert panel before being allowed to push any more inane bullshit that will help noone in the future.

samgranieri 3mo ago
It’s a series of tubes! It’s not a big truck!

exabrial 3mo ago

Democrat Representative Jennifer Gong-Gershowitz in the House Democrat Senator Willie Preston [D] in the senate

deleted 3mo ago

[deleted]

ChrisArchitect 3mo ago

[dupe] Earlier: https://news.ycombinator.com/item?id=49228350 https://news.ycombinator.com/item?id=49228350

pseudalopex 2mo ago
[dupe] Earlier: https://news.ycombinator.com/item?id=49250112 https://news.ycombinator.com/item?id=49250112

p0w3n3d 3mo ago

This renders all servers in Illinois illegal. Thanks.

deleted 3mo ago
[deleted]

josefritzishere 3mo ago

Gross. Age verification is a completely degenerate level of privacy violation

normalaccess 3mo ago

Thankfully for now this dragon is a hydra. Too many paths to block for now. The whole TPM fiasco with windows is preparation to put the genie back in the bottle. Soon, much sooner than I would like you will need a Global ID to access the internet, which will require an "internet safe operating system". It's only a matter of time. Get your sneakers ready folks.

metal696heart 3mo ago
How about a second internet ?
- normalaccess 2mo ago
  My Opinion on that: It would be branded as unsafe and something only terrorists and extremists use. Aside from the propaganda campaigns that would run 24/7 to influence public opinion it would (and will) be outlawed to run an unmonitored personal compute system. I'll bet they will use the fact that open models can generate c-sam materials.

xp84 3mo ago

Serious question: This is a out-of-box "ask for age" requirement. No one is "verifying" anything. Why are we using this misleading headline? Face scans, ID cards, all that stuff that makes everyone nervous, are specifically not a part of this. To imply that it is verification is propaganda. As a parent, I'd be very happy with this "age declaration" method, as I also don't think the 'verification' others push for is at all worth the risks. All parents want is to put the devices permanently into a mode that flags it to third parties as belonging to a minor, so they can't just hold up their hands and say "idk they said they're 18" like they do today.

JoshTriplett 3mo ago
Two reasons people are arguing against it: It moves the Overton window, making worse things easier to pass in the future. And it enforces requirements on projects the state should have zero jurisdiction over.
- chneu 3mo ago
  Yeah this is just step one and the evidence to support this is simple: history. Governments very, very rarely give up power. Once they have it they only work to expand that power. Next will be stronger and more restrictive shit.
  - queenkjuul 2mo ago
    Multiple states already have actual verification laws, Illinois is specifically choosing not to use that power
Jtsummers 3mo ago
Step 1: Shift the burden from service providers to OS providers (on devices owned by individuals). Step 2: Recognize that the system is trivially bypassed by a kid who sets up their own device without their parents' oversight or parents who just think this is a stupid law and lying for their kids. Or bypassed by anyone using open source operating systems which are (for a feature like this) going to be trivial to amend to always claim the person is an adult regardless of which account is being used. At this point there are three possible futures that are worth considering: 1. Throw out the rules because they're stupid and everyone with any common sense or sense of decency has been saying it since the start. The service provider is responsible, not the OS developer or device manufacturer. (Best case) 2. Keep the stupid rules on the books and pretend they work. Let the service providers off the hook. (Second best case) 3. Create more rules that effectively cedes more control of personal devices to the government to make this actually work, but the effect of this is to essentially outlaw OSes like Linux and many, many devices and even raw hardware without a government permitted OS pre-installed. (The worst case) (3) is extreme, but it's the only way that this law actually has the desired effect. (1) and (2) are the most likely outcomes, but reflect that this whole exercise is just a waste of time.

buzzwords 3mo ago

I love how everyone knows this has nothing to do with kids safety. However no one can or is willing to put up a fight. In the UK where I live its the same. Government does whatever they want and most of us just shrug our shoulders and say "that's messed up" and go on about our day.

ethin 3mo ago
The reason is ridiculously simple: people don't put up a fight because they don't want to be labelled as a peto or as someone not in favor of the protection of Children. This is primarily why this cudgel is brought out so often: it's very difficult to oppose because you risk getting shunned for it.
anigbrowl 3mo ago
How has this fatalism been working out for your society?
- doublerabbit 3mo ago
  It sucks for sure. But how is it going for yours or any other country? I can't even get the politician of my city to reply to me in email because of his arrogant persona. How am I suppose to change something when I can't even get the local politician to listen? Cash would; but I'm stripped for that. You have any?
  - anigbrowl 3mo ago
    The UK is relatively small and I see surveys suggesting 70-80% of the population think the country is on the wrong track. Perhaps you should have a national strike or something, make the politicians come crawling to you instead of the other way around.
xyst 3mo ago
Don’t worry. It will all burn down soon. This administration is preparing the narrative to "cancel the midterms" if they lose the senate and house. Using the illegal war as cover.

deleted 3mo ago

[deleted]

Buttons840 3mo ago

I think this is a bad thing overall, but if the OS is responsible for reporting my age, that means I get to pick my own age... I'll take what I can get. Some states will pass laws that companies cannot show advertisements to minors. So... I think I'm about to become a bit of a minor myself, at least whenever it serves my interests.

RealWed5 3mo ago

TL;DR: learn how to live without computers. This will end Linux as end user OS, it will stay only in Cloud and containers. Arguably, the goal here is to destroy home PC altogether. maximum we will be allowed is a laptop with endpoint verification and mandatory touch ID, locked boot and non-replaceable hardware. If you think Linux is the end of it – think again. The same crap will be implemented in BIOS/UEFI, on "HW management" level. Essentially, your bare HW only laptop will not even start without you touching fingerprint sensor and allowing it to "validate your age" against – of course government approved – HW manufacturer. Same with smart phones – it's already here, if you tried to activate iPhone. And projects like Open/Free BSDs? Government will sure their leaders happily retire and ... well, the community will just "die" naturally.

CommanderData 3mo ago

Insert X reason to steal user freedom

Razengan 3mo ago

Oh come on guys, don't... Can't believe all this shit just allowed to happen then Muricans still claiming to have more freedom than China or Russia for long..

btbuildem 3mo ago

Ok so, all the appliances and cars and TVs and who knows what other embedded electronics sold in Illinois will require the user (?) to verify their age?

dd8601fn 3mo ago
Not verify. Voluntarily attest an age bracket.

kyledrake 3mo ago

Can someone tell me why all of the sudden everyone's totally cool with letting political hacks choke the internet to death? We used to make fun people like Ted Stevens for calling the internet "a series of tubes" and now we're just totally cool with letting a failed, bankrupt state in the US dictate what code needs to go into voluntary open source software. We need to fight back, now.

semiquaver 3mo ago

I hate that news you can’t ignore comes packaged as obvious slop you have to trudge through to to comprehend.

bigbuppo 3mo ago

Okay, go scorched earth with malicious compliance.

deleted 3mo ago

[deleted]

belviewreview 3mo ago

Including Tails?

txrx0000 3mo ago

This is worse than the California one. Since this applies to all Internet-capable operating systems, it's effectively forcing people to utter their age bracket in order to communicate digitally, which is compelled speech - a violation of the First Amendment. Here's an idea for the lawmakers that actually want to solve the digital parenting problem: fix the mobile OS duopoly with antitrust. Most kids only know how to use touchscreen devices. If you force mobile hardware vendors to ship smartphones without an OS, then we will get plenty of forks of Android and even entirely new OSes as a result of natural demand, some of which will be toy OSes with all of the child features built in. We'll also get scam-proof OSes for the elderly as a bonus. There is no good reason for the entire population to use the same OS.

noman-land 3mo ago
Does this mean you need to register your children and their ages with your smart fridge? The Epsteinocracy wants to know how many children you have and exactly how young they are.

ivl 3mo ago

> The bill’s own text caps penalties at $7,500 per affected child. If the distro does not ship with any hardware, it could only be attained via download? So how would this imperil Linux distros? Not to defend the law, it's comically pointless. Conservative states demanding ID verification for anything 'pornographic' and progressive ones trying to limit anyone under 18 from having any social media access at all. Clownish.

Grombobulous 3mo ago

> The signal itself isn’t a birthday, it’s a bracket: under 13, 13 to 15, 16 to 17, or 18 and up. Operating systems have until January 1, 2028 to have this built. > Nothing in the bill requires a passport scan or a face scan at setup. It’s self-declared, the same way most apps ask your birthday today, just centralized once at the OS level instead of repeated app by app. Maybe this is just a badly written law or purposefully designed to have basically no impact on anyone? Or maybe the age bracket self-declaration part of this might make it a legitimately useful mechanism when a parent sets up a device for their kids. Their device declares “under 13” and apps and sites have to then follow the more strict social media laws which themselves should be relatively beneficial to the target audience. In other words, the part that’s really privacy-destroying is the age verification, but that’s not part of this bill. The part that could be a benefit is the part where companies need to respect an age flag set by parents and comply with a concrete set of parental controls. In other other words, it’s not left up to operators like Meta and Roblox to decide what age their users are, parents can set that device-wide and know it can’t be circumvented.

akersten 3mo ago

https://agelesslinux.org/ https://agelesslinux.org/

shirro 3mo ago

Our political and business elites need age verification added to their penis.

spl757 3mo ago

These laws are so short-sited and willfully ignorant of the unintended consequences. The constitution provides rights and protections, and the government cannot compel speech. This will be appealed on consititional grounds and reversed. If not, I'd ban any Illinois resident from being able to use the site and redirect them to their local government representation. Compelled speech is just one attack the law is open to.

pull_my_finger 3mo ago

I agree with literally everyone who thinks this is pointless and probably malignant. The problem isn't the visibility or the fact that weird stuff "exists" on the internet. The problem is advertisers "showing" it to people who didn't go looking for it. Ads and algorithms that decide what a person to see are 99.8% of this actual problem, and meta lobbying for something like this is just obvious self-interest to absolve them from any liability for showing kids damaging material, and to hit 2 birds with one stone, they get more PII to add to their "anonymized" aggregate data. No good will come from this for the consumer. Websites are suddenly all going to start accurately reporting their content rating, especially ancient documents that have been "online" since before css and javascript were a thing. The only ones that will be implementing these checks will be adtech people that shouldn't have it in the first place. Letting out of touch geriatrics make tech policy decisions in a time when the bleeding edge is moving faster than ever is going to be disastrous for generations to come.

koalak 3mo ago

This is unconstitutional. Code is freedom of speech and cannot be censored in any fashion. Period.

stockresearcher 3mo ago

I would like to take a break from all the complaining and point out how hilarious it is that this law does not apply to any computer that can only connect to the internet via an Ethernet port.

1vuio0pswjnm7 3mo ago

1773350468 | Illinois introduces OS-level age verification law | https://legiscan.com/IL/bill/SB3977/2025 https://legiscan.com/IL/bill/SB3977/2025 | https://news.ycombinator.com/item?id=47357294 https://news.ycombinator.com/item?id=47357294 1773770767 | Illinois Introducing Operating System Account Age Bill | https://www.ilga.gov/Legislation/BillStatus?DocTypeID=HB&DocNum=5511 https://www.ilga.gov/Legislation/BillStatus?DocTypeID=HB&Doc... | https://news.ycombinator.com/item?id=47416131 https://news.ycombinator.com/item?id=47416131 1786248239 | Illinois just told every operating system to start reporting your kid's age | https://itsfoss.com/news/illinois-age-verification-bill/ https://itsfoss.com/news/illinois-age-verification-bill/ | https://news.ycombinator.com/item?id=49228350 https://news.ycombinator.com/item?id=49228350

mrieck 3mo ago

Not surprised - I live in IL and almost every SaaS I pay an extra "15% Chicago Lease Tax". Politicians hate tech here.

jtokoph 3mo ago

How old is the root user? How about the nginx user? How about “nobody”?

jzer0cool 3mo ago

I get the privacy concern in regards to advertising ones age, but I wonder if this is akin to a underage walking into a liquor store, interacting with stranger adults, etc. There are obvious appropriate and inappropriate behaviors to minors. Let's confine only of consumer OS and is provisioned with an underage bracket (you set it to what you want, And Not a Require verify). All sites/app the OS interacts must honor certain child protection laws (privacy, selling, gathering etc)? What is the main discussion surrounding placing (by choice) some 'optional' age bracket to enter during the OS setup/provisioning? The OS as provider only declares an age and it seems the sites/apps it interacts with to be the ones in the hook, not the OS.

zombot 3mo ago

So no more Linux in Illinois?

dorkydev 2mo ago

How gullible and naive is anyone to believe for a single instance that the government would be stupid enough to just say okay age verify anything Apple, Android and Microsoft based. hahaha! Yet people swore linux users were smart! Guess not.

dennysora-main 2mo ago

[dead]

tsoukase 2mo ago

I could accept the solution that the superuser decides about the age bracket of each regular user, that can be changed anytime. sudo chage -u mybob --bracket teen Users cannot change the setting, it can be presented to apps and let parents simply and safely enforce will. The root is the ultimate leader of the system, let him do his thing.

queenkjuul 2mo ago

This isn't really age verification, it's Steam-style "age attestation," there's no mechanism nor enforcement that the age you put in has to be accurate. But i think signaling to websites that the user account is underage is good, and this is really just enhanced parental controls at that point. Parent sets up account for child, puts in age, child can't change it, websites can't ignore it. Seems okay to me.