OS must verify your age before use

[jonovid]

California lawmaker wants to require anyone using ANY operating system -- Windows, Linux or otherwise -- to verify their age before use
WTF is it with some people that like dystopian things.

https://www.pcgamer.com/software/operating-systems/a-new-california-law-says-all-operating-systems-including-linux-need-to-have-some-form-of-age-verification-at-account-setup/


https://www.reddit.com/r/linux/comments/1rgl4hy/a_new_california_law_says_all_operating_systems/

[Andy Chee]

In the old days where the software could be installed with a separate installer, or even further back in the DOS days where the software was simply in a separate subdirectory, the integration between the program and the OS was minimal.

These days, apps and OS are now highly integrated for the purposes of security. And due to the high integration, it can be difficult to ascertain which part of the system would be responsible for age verification.

I haven’t even mentioned the philosophical rationale for age limits, only the technical justification that doing it in the OS is probably the only way to do it today.

[soldar]

You have to laugh when they accuse China of being so controlling and then they turn around and do the same and more.

And I cannot see how it could be enforced. How can they prevent anyone from installing any OS?

[AndyC_772]

Manufacturers are in a very strong position right now.

They can simply say 'no', our product is not and will not be made compliant with this law, which is (for now at least) specific to California. Therefore, our product is not for sale or use there.

The rest of the world market is huge. Apple, Microsoft and Google will survive. And as for Linux, there's no-one to sue.

That creates an interesting situation in California, of course. Literally everyone needing a new OS setting up hits a brick wall, and it shouldn't take too long before that sways opinion in a very decisive way indeed.

[NE666]

They can simply say 'no', our product is not and will not be made compliant with this law, which is (for now at least) specific to California. Therefore, our product is not for sale or use there.

It's already started. "MidnightBSD Responds to California's Age Verification Law by Excluding California"

[aeg]

Manufacturers are in a very strong position right now.

They can simply say 'no', our product is not and will not be made compliant with this law, which is (for now at least) specific to California. Therefore, our product is not for sale or use there.

this law is binding on vendors with california nexus and does not relate to products sold in california

And as for Linux, there's no-one to sue.

there is an individual or corporation behind every linux distro

[Karel]

They can simply say 'no', our product is not and will not be made compliant with this law, which is (for now at least) specific to California. Therefore, our product is not for sale or use there.

It's already started. "MidnightBSD Responds to California's Age Verification Law by Excluding California"

[soldar]

My take is that this proposal is just posturing by some politician who knows full well it will never happen.

[SiliconWizard]

The disaster is that if it starts in California, serving as a lab for the most dystopian stuff for a good while now, it will spread to the whole western world. This is almost certain, unless of course there's a sudden change in how the western world operates. We can always dream. But you can already see that this "age verification" frenzy is currently spreading like cancer everywhere in the western world. Doing it as the OS level looks ridiculous and unenforceable for now, but otherwise this is spreading to everything else very rapidly.

This thing is absolutely insane. Yes, it looks impossible to enforce, but see MidnightBSD's reaction: they don't want to bother figuring out if it can be enforced or not, they just choose to bail out.

This also looks like the death of "free software" in general, as the very features required in software to enforce this are against the principles of free software. So projects have actually no choice but say: ok, we're out.

Insane stuff. Soon you'll have to prove your age to drink tap water?

I said long ago that one of these days, there will be politicians who will try making using free software illegal. This is increasingly looking like the mechanical consequence of this series of measures: to comply, software will inevitably have to be linked to opaque, commercial services, which is not only against free software principles, but will probably have a cost that most projects can't support, apart from the bigger ones.

We can just reasonably hope this will never succeed, but this is not looking good anyway.

[tom66]

It's completely unenforceable. 

It's just like the online safety act in the UK.  You just put a VPN on and go, yeah, Adult-Content-Site.com I'm from Norway let me in.  The law doesn't and can't require vendors to detect VPNs, that's technically infeasible.

The other issue is that a UK regulator can't sue a US company for not complying with their law.  No US court will uphold Parliament's sovereignty in the US. And too right!  It's our stupid law not theirs.  So all they can do is stomp around and maybe apply for a DNS level block.

Ultimately all that will happen is that VPN use will go through the roof.

[SiliconWizard]

They are all working on making VPNs illegal for individuals. Yes, don't underestimate their will to make this dystopia work out.
Whether this one measure is enforceable is dubious, but it would sure deter many people from using a VPN.

[MathWizard]

Installing Windows is creepy enough these days, if they start asking for my ID, I'll just switch to Linux again. (hmm they want it for all OS's tho)

Years ago I had a facebook acc., I wouldn't join now since they basically want you to upload your ID. I also hate how a landline phone number does't work for much of anything online, they want a cell#. But not all cellphones even need payment plans, and ID for billing/etc. So it's extra annoying, since I hate giving out my cell #.

[tom66]

They are all working on making VPNs illegal for individuals. Yes, don't underestimate their will to make this dystopia work out.
Whether this one measure is enforceable is dubious, but it would sure deter many people from using a VPN.

Even the most totalitarian / authoritarian states fail to block VPNs (Russia, China, UAE...)

Plus use of a VPN is essential for some people, to access my work network for instance, I need a VPN.   

VPN traffic looks just like any other encrypted traffic especially if VPN-over-HTTPS tunnel is used.   And you can't block HTTPS because then you basically just blocked 99% of the internet, even poxy sites like eevblog.com.  I'm looking forward to widespread rollout of DNS-over-HTTPS too which will block the last path for governments to block websites via DNS queries.  Your ISP will have no idea what you're accessing, so implementing court orders becomes impossible.

I can pay for my VPN with crypto or cash.  (I don't, because that would be inconvenient, but it's absolutely an option.)

About the only thing that could happen is seizure of your devices & checking what apps/programs are in use. Sure, it could happen, but we're a long way from this. Right now we have a moral panic over kids looking at boobies on the internet. 

[NiHaoMike]

Right now we have a moral panic over kids looking at boobies on the internet. 

A lot of guys probably got disappointed after finding out that the "forbidden" female nipple looks just like their own.
https://www.dailymail.co.uk/lifestyle/article-4011576/Can-tell-male-female-Genderless-Nipple-account-Instagram-challenges-double-standard-app-s-anti-nipple-policy-close-ups-men-women.html

The genitals are a different story, but I have to say the first time I saw a picture of female genitals was completely unexpected, in a high school library. And in an old fashioned paper book, not online. It was a human biology book targeted towards medical students, so it had full color pictures of various body parts with labels explaining what each part is. My first thought was "girls are so complicated down there!" It was before social media, but I'm sure it would have been fun to make an anonymous note that such a book exists in the school library.

[soldar]

Even the most totalitarian / authoritarian states fail to block VPNs (Russia, China, UAE...)

Plus use of a VPN is essential for some people, to access my work network for instance, I need a VPN.   

VPN traffic looks just like any other encrypted traffic especially if VPN-over-HTTPS tunnel is used.   And you can't block HTTPS because then you basically just blocked 99% of the internet, even poxy sites like eevblog.com.  I'm looking forward to widespread rollout of DNS-over-HTTPS too which will block the last path for governments to block websites via DNS queries.  Your ISP will have no idea what you're accessing, so implementing court orders becomes impossible.

I can pay for my VPN with crypto or cash.  (I don't, because that would be inconvenient, but it's absolutely an option.)

About the only thing that could happen is seizure of your devices & checking what apps/programs are in use. Sure, it could happen, but we're a long way from this. Right now we have a moral panic over kids looking at boobies on the internet.

This topic of VPNs is quite complex and I have been thinking of starting a thread in the appropriate section ... but I'n sort of lazy.

I can speak about my experience in China. They do detect regular VPN connections and they allow some according to their own policies and to their policy of that day.

For example, if you travel in China with a US roaming plan you have your VPN already baked in and no problem. I suppose they figure foreigners need to access the outside world while in China.  I have never had any problems using this system.

In China you can buy VPN plans. I have no personal experience but I suppose just the cost discourages the great majority of the population and the government does not need to block 100%.  Most people I have talked to in China do not feel any loss by not being able to access Youtube or western social sites. They live in their own Chinese universe. If someone for some reason really needs to access the outside they can do it but that small hurdle is enough to keep the majority inside the firewall. And that is all the government wants or needs to do.

When I am in China I can access my computer desktops in Europe or US using Anydesk. No problem. I can access anything and everything with the browser, email, etc.  I also leave behind my own VPN servers which are my own and not on any list of known VPN services. I can connect to these VPN servers (using OpenVPN) but the connection is so slow as to be unusable. The Chinese firewall detects it is VPN traffic and slows it down drastically. I suppose it detects the Open VPN protocol. 

So, for my next visit I was thinking of studying the possibility of somehow cloaking the VPN traffic but it requires studying the issue and it is probably more complicated than it is worth my effort. I would need to modify the servers and the clients' softwares.

As I am using Open VPN I was also considering studying WireGuard but I am further put off by the fact that Linux Mint Network Manager does not natively support Wireguard.

At any rate, it seems VPNs are becoming more necessary for several reasons. Not only do some countries block access to some sites outside their country but also some sites block access from outside their country. Many US web sites block access from outside the US.

The Internet, which was going to unite the world, is becoming a group of isolated internet islands.

[Electrodynamic]

Soldar

So, for my next visit I was thinking of studying the possibility of somehow cloaking the VPN traffic but it requires studying the issue and it is probably more complicated than it is worth my effort. I would need to modify the servers and the clients' softwares.

As I am using Open VPN I was also considering studying WireGuard but I am further put off by the fact that Linux Mint Network Manager does not natively support Wireguard.

At any rate, it seems VPNs are becoming more necessary for several reasons. Not only do some countries block access to some sites outside their country but also some sites block access from outside their country. Many US web sites block access from outside the US.

The Internet, which was going to unite the world, is becoming a group of isolated internet islands.

That's interesting, it would be neat to have an app where all our cell phone personal/business information was held remotely. Then if someone wanted to search our phone emails, contacts etc. there would be nothing on it. Would they need a search warrant to access our private remote vpn server which could be in another country?. As well if we lost our cell phone we could just delete the connection authorization.

I like that idea and privacy is always a concern.

[eutectique]

FOSS projects already strike back: https://github.com/c3d/db48x/blob/dev/LEGAL-NOTICE.md

Important notice to residents of California and Colorado

As a consequence of recent legislative activity in California and Colororado:

•     California residents may no longer use DB48x after Jan 1st, 2027.
  
•     Colorado residents may no longer use DB48x after Jan 1st, 2028.
  

DB48x is probably an operating system under these laws. However, it does not, cannot and will not implement age verification.

[eutectique]

I wonder what would happen to all IoT devices running FreeRTOS, QNX, ThreadX, OpenWrt, Zephyr, ...

[tom66]

I wonder what would happen to all IoT devices running FreeRTOS, QNX, ThreadX, OpenWrt, Zephyr, ...

Good point.  Some home appliances are now complex enough to have operating systems.  Does your "smart dishwasher" running Linux for its network stack have to verify the user's age?  Or is this restricted to devices with viable display devices? (I'm assuming a 7-segment display showing "8008135" isn't dangerous to children.)

[soldar]

That's interesting, it would be neat to have an app where all our cell phone personal/business information was held remotely. Then if someone wanted to search our phone emails, contacts etc. there would be nothing on it. Would they need a search warrant to access our private remote vpn server which could be in another country?. As well if we lost our cell phone we could just delete the connection authorization.

I like that idea and privacy is always a concern.

For many years now UK and US (and probably others) may inspect your devices and corporate workers are told to hold no corporate info in their laptops but to connect to their corporate VPN once at their destination.

They also may ask for your social sites activity. Partly for that reason I am not on any social network but that is also suspicious to them.

Western authorities preach freedom and privacy while doing the exact opposite. 

Years ago I used to encrypt some keys and files and disguise them as digital camera files in the digital camera, separate from the laptop. I suppose that would be discovered if I were a high value target but I am just a regular guy so I guess they would not put too much effort into it.

But I don't have a separate digital camera any more. I suppose I could do something similar with photo files on my phone.

In all my travels around the world the US immigration people have been the worst by far. Just being mean and abusive for no reason.

Yeah, it is a good idea to keep vital info in a server elsewhere and travel with blank devices.

[aeg]

My take is that this proposal is just posturing by some politician who knows full well it will never happen.

unanimously approved by state senate and assembly, signed by governor and chaptered into law 4 months ago

https://leginfo.legislature.ca.gov/faces/billHistoryClient.xhtml?bill_id=202520260AB1043

[soldar]

My take is that this proposal is just posturing by some politician who knows full well it will never happen.

unanimously approved by state senate and assembly, signed by governor and chaptered into law 4 months ago

https://leginfo.legislature.ca.gov/faces/billHistoryClient.xhtml?bill_id=202520260AB1043

Wow. California is much worse than I knew. It will be interesting to see what comes of this in real practice.

I will read it carefully. Tomorrow.

[eutectique]

To put links in one place:

California : https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1043
Colorado : https://leg.colorado.gov/bill_files/111670/download

[Cyclotron]

California gave us Pro 65. I don't know if the labels leak out of the US, but they are all over the US and on everything in California.

The law requires that companies must tell users they are being exposed to cancer-causing agents unless the company tests their product to verify that the agents are below a specified level.

Instead of testing, which costs a fortune, the companies all put the Pro65 label on everything and tell you that you may be exposed to cancer-causing agents.
Seeing a dining room chair with a cancer hazard warning is hilarious. Glass jars, guitar picks, you name it.

I believe it's proof that there's a label maker cabal at work. They have their own police, too. Tear a label off a mattress and find out.

[tom66]

California gave us Pro 65. I don't know if the labels leak out of the US, but they are all over the US and on everything in California.

The law requires that companies must tell users they are being exposed to cancer-causing agents unless the company tests their product to verify that the agents are below a specified level.

Instead of testing, which costs a fortune, the companies all put the Pro65 label on everything and tell you that you may be exposed to cancer-causing agents.
Seeing a dining room chair with a cancer hazard warning is hilarious. Glass jars, guitar picks, you name it.

I believe it's proof that there's a label maker cabal at work. They have their own police, too. Tear a label off a mattress and find out.

Law of unintended consequences.

Lawmaker: We should make it a legal requirement to warn consumers of hazardous compounds in the things they use and eat.
Public: Yeah, that sounds like a Good Idea.  Let's do that! 
Companies: Boy, that law sounds expensive to comply with.  Let's do the bare minimum we can to avoid being sued.  In a few years, no one will care about those silly warnings anyway.

On the face of it, the law is a good idea.  But by having no restriction against including the message, you end up with absurdities like this:



One way to fix it is to set requirements that such a warning only be displayed when there is a demonstrable risk to health by exposure.  No one is going to care about 1 ppb of lead in some paint somewhere, but if that's 1 ppm of lead and it's in drinking water, it's suddenly a problem.  Deciding on those limits isn't easy.

Or just repeal the legislation.  It's clearly defective.