So, I have actually read the text of California law CA AB1043 and, honestly, I don't hate it. It requires operating systems to let you enter a date when you create a user account and requires a way for software to get a coarse-grained approximation of this that says either 'over 18' or one of three age ranges of under-18s. Importantly, it doesn't require:

  • Remote attestation.
  • Tamper-proof storage of the age.
  • Any validation in the age.

In short, it's a tool for parents: it allows you to set the age of a child's account so that apps (including web browsers, which can then expose via JavaScript or whatever) can ask questions about what features they should expose.

In a UNIX-like system, this is easy to do, with a tiny amount of new userspace things:

  • Define four groups for the four age ranges (ideally, standardise their names!).
  • Add a /etc/user_birthdays file (or whatever name it is) that stores pairs of username (or uid) and birthdays.
  • Add a daily cron job that checks the above file and updates group membership.
  • Modify user-add scripts / GUIs to create an entry in the above file.
  • Add a tool to create an entry in the above file for existing user accounts.

This doesn't require any kernel changes. Any process can query the set of groups that the user is in already.

If a parent wants to give their child root, they can update the file and bypass the check. And that's fine, that's a parent's choice. And that's what I want.

I like this approach far more than things that require users to provide scans of passports and other toxically personal information to be able to use services. If we had this feature, then the Online Safety Act could simply require that web browsers provide a JavaScript API to query the age bracket and didn't work unless it returned 'over 18'.

@david_chisnall And then another state or country passes a law that requires four age ranges, or another one that requires two, but they do not map nicely to the three CA requires.

You have now replicated another timezone mess.

@lerxst @david_chisnall Yeah, like 18 is not even standard across the globe.
@Arcaik @lerxst @david_chisnall true. But the important is the country of child and whether he or she is considered adult in his own country by his own device. Until they are adults, it should require parent's consent.

@pemensik nope. Parents are welcome to manage their children. “It should require” remains a specious claim.

@Arcaik @lerxst @david_chisnall

@cascheranno @pemensik @Arcaik @lerxst

I don't have a problem with laws that say 'organisations interacting with children without parents present must provide tools that allow parental control'. There are lots of laws like this outside of the Internet context.

I do have a problem with laws that say 'you must give up privacy because OMG think of the children!'.

@david_chisnall @pemensik @Arcaik @lerxst there are vastly *more* circumstances without age checks. Between me and midday, I shall interact with coffee, appliances, vehicles, racks of hazardous materials, strangers, countless forms of media, high places I can fall from, low or confined places I can fall into, etc. None need or deserve digital nanny laws. If I take a walk three blocks in a city and into a park, or walk any half mile outside of cities, the breadth of risks soars.

See? This new reg category is Specious.

It also leaps toward a substantial imposition on other (legal) activity with scant need and questionable effectiveness.

As for “organizations”: The bulk of those hazards aren’t interactions with Organizations. It seems an artificial term given how we interact with our world, selected because it gives this misguided concept someone who’ll bear assignment of responsibility.

I’ve lived thru nanny tech initiatives, think-of-the-children lobbying, needed-to-fight-terrirism bills, etc. Through wiretap adaptations, DHS, Clipper chip and putting warning labels on adult stuff. The scary thing is the reg, not unfettered existence. Facial recognition and captured surveillance data, not ‘kid might get root’.

Flip the script and imagine use cases where you deserve to decide but are blocked. An abusive parent. Oppressive leaders (church or state or school).

Also, recall times you ‘colored outside of the lines’ in your learning, saw stuff not yet age appropriate, and (a) didn’t suffer or (b) learned adult lessons like safety or to recognize warning signs.

@david_chisnall @pemensik @Arcaik @lerxst

@cascheranno @david_chisnall @Arcaik @lerxst CA bill doesn't require any identification. Only the OS has to provide age group to apps for minor users. You are opposing things you've imagined, but nobody demands in this case.

@pemensik @david_chisnall @Arcaik @lerxst I’ve been a cypherpunk since Usenet was the hotness. Would you like a thousand examples where the shit imagined became reality?

Oppose ‘has to’. On principle. This time around, if Cali behaves, I fear the states that go further. And then they smooth out the wrinkles and Cali gets a bit more severe, or lack of impact (because, let’s face it, this nanny shit is either draconian or ineffectual or both, sought by folks who don’t deserve to be in the room when digital policy is written) … sorry, the parenthetical got away from me.. or lack of impact will yield a version 2, just a little more. Then a bit more.

Yeah, I’m opposed to it all, since it’s a terrible thing that strips a digital freedom, empowers the controlling, and has no chance of accomplishing the ostensible goals.

@cascheranno @david_chisnall @Arcaik @lerxst Then ensure things go correct direction, watch their good course. Request correct implementation of the bill by your OS vendor. The bill itself is good IMHO. Details can go wrong, but that doesn't have to be. See, we are not using Usenet for our posts. Some things have changed, I think to better things very often. Not always, but that is up to us. Improving the world for everyone is a very difficult task.
@pemensik @david_chisnall @Arcaik @lerxst how is this a good direction? I see an overboard infringement / reduction vs. no nanny in my gear.