Apparently this will include Linux…
I forgot the name, but I saw a BSD distro state that they are going to block users in California when this law gets put into place. I hope that more OSs do the same. Especially Windows, it could be devastating to California’s economy and make them, along with other states and countries, reconsider their decisions on age verification.
I don’t live in California but I’m interested in seeing if there are any other OSs that will be blocking California users. I’m probably fine to just continue using Linux Mint but I’m open to trying other distros/OSs in order to participate in this protest if Linux Mint doesn’t.
How will this affect enterprise systems with remote installs or ramdisks?
Please explain to a complete doofus how can someone enforce this?
Cant they just download any linux distro from millions of different places and install them on any machine, even offline?
Bios are becoming more and more locked down, that’ll be the next thing, at the tech lobbyists behest.
soon we will need bootloader unlock exploits (or the blessing of our overlords) to install anything other than the stock os, not unlike android and chromebooks.
we desperately need to break free from US tech.
In essence, while the bill doesn’t seem to require the most egregious forms of age verification (face scans or similar), it does require OS providers to collect age verification of some form at the account/user creation stage—and to be able to pass a segmented version of that information to outside developers upon request.
So you just fake a date and call it a day… thank you Cali…
For real though I can’t imagine the sysadmin and docker nightmares that arise from having to completely overhaul your account orchestration scripts to input a garbage birthday.
I don’t think anyone thought of the fact that an account on an OS doesn’t always correspond to a human.
Gotta love it when people who have no understanding of how Linux works writes laws about how Linux should work…
It goes way beyond Linux. Think any device that could download something at some point. Gas station pump, calculator, FreeDos, VxWorks, etc.
There is a lot of language like “or can download an application”, so if you can download something, then that thing could be an application, and thus that device and it’s OS is covered.
And every point of sale system everywhere
I have never internally facepalmed harder in my life
I have genuinely no idea how that could work.
I believe I get the genuine intent (protecting children) but I have so far never encountered any device or software or both that didn’t relatively easily bypass user authentication.
The closest I’ve tried are (expensive) XR headsets like the Apple Vision Pro or the Microsoft HoloLens both thanks to eye tracking. Basically for these you have to validate you are who you claim to be when you put the headset on. If you remove it, put it back (or on someone else head) you have to do it again. Nobody else (unless you explicitly share) can then see what you are looking it.
Every other devices I’ve seen, including mobile phones with banking apps, typically ask you to authenticate then assume than you are the one who keeps using the device. Meanwhile anybody else can grab the device from your hand and be “you”. Typically specific action (e.g. password change) do require to authenticate again but “normal” usage does not.
I don’t care if there is a package called gnome-age-verification distributed in my linux distro and would prefer it if it means fewer sites with facial biometric tests. If I have concerns about the age verification, then I should be able to type:
sudo dnf remove gnome-age-verification
California probably wants it in linux distros so that linux can’t be a justification for big tech still demanding Orwellian stuff in every website (ie “but what about the children who use linux? we need to protect them with Persona too!”)
But where would it stop? The hell version of this would be kernel-level-approved-AI-agent-checks, with an OS required to have an approved AI agent with a validated third party key that reports to the government with required telemetry and the kernel makes sure the OS won’t run without the approved AI and then makes illegal any scripts for unapproved kernel code modification. And post-Tornado cash, we know code is unfortunately not protected US speech.
env USE=-fascism emerge -ave worldmust be between the ages of 13 and 65 let’s go ahead and set it to retirement age
Doesn’t even make sense. Virtually all Linux distros can function completely offline. How do you do age verification completely offline? Classic politician who doesn’t understand tech trying to look like they’re doing something to save the kids.
"(1) Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
Sounds like it’s a text box that enter input into. Making it completely pointless.
According to Gabe Newell, something like 90% of steam users were both on 1/1/99 (might be fudging the numbers somewhat but presumably you get the idea).
They will make it a crime to not have any OS that is not compliant, that simple.
The only platforms for now where this might work are Windows, macOS, iOS, and stock Android, however as Muta hypothesized, if this extends to hardware-level, a law could just mandate SecureBoot and lock out the ability to implement custom keys, and then only allow a short list of state-approved OSes to boot on the hardware, which no doubt Windows would be on that short list.
Similarly, all non-Apple mobile devices as an extension to that could be locked exclusively to stock Android, eliminating custom ROMs like LineageOS or GrapheneOS as an option entirely, let alone mobile Linux distros.
Me, buying cellphone parts from another state to assemble myself like an 80% lower to avoid having to drink a Verification Can every time somebody calls me:
I think I just invented the concept of a “ghost phone”
Can this be circumvated saying it’s distribution rather than OS ? 🤠
Or just refusing to run servers in California. Much like the US DRM encryption restrictions of the 90s. Where the whole Linux community just had distributions required parts of the download to happen in non US servers.
A single, (although big and very active in Linux) state, will always have more limitations then a nation. The issue comes if it becomes US national. And then the US starts pushing other nations to sign agreements.
Given at some point trumps harm to all international treaties will likely be repaired. Their may come a huge opportunity for US politicians to renegotiate international treaties.
Assuming trust is ever returned.
distinction without a difference - lawmakers won’t care
No more than gun laws can be circumvated by referring to firearms as ‘high energy shooting implements’
Define “Operating System”…
I guess my washing machine & car are also going to be “not for use in California.”
Those Cisco switches & Broadcom DSLAMs would be tricky too … I guess the internet’s “not for use in California.”
And the air-gapped power station control system? “not for use in California.”
It is annoying that these laws come in (I’m also including magical thinking about encryprion backdoors for “the good guys”) without any form of real-world, practical assessment. Complete waste of tax payers money and undue stress for everyone.
FFS.
Imagine you’re not allowed to use your washing machine if you’re under 18.
of all the shit out there, that’s what needed attention?!
Curious for what it’s a distraction, eh?
“At þe account creation screen” þe WHAT NOW? ah yes cause linux definitely has an account creation screen. Could be a loophole
Spotted the thorn þ enjoyer!
Real connoiſſeurs uſe the long s.
The regulation also mentions an APP STORE
My linux has no screen.
That’s the problem. They don’t care if you have a screen, they need the screen.
Sorry but I don’t think the article text backs up the title?
The claim is that they have to enforce age verification, but the quoted law says:
Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
Doesn’t this just mean it needs to ask for an age at setup, so e.g. parents can set it up with an age and they can automatically be restricted?
I don’t see anywhere actual verification is required, if you’re setting it up yourself then just lie?
Honestly, this sounds like my preferred path if we are gonna do anything.
But also, every FreeDos install ,server, managed network switch, IoT device, gas pump, etc. now needs to verify user age.
Also, it has to make “reasonable” effort to verify the age. Maybe just asking your age isn’t considered reasonable by the state. Since the law doesn’t lay out what to do, anything you do might become unreasonable depending on the winds of the day.
Nah it seems it doesn’t apply to physical devices (except general computing devices as mentioned elsewhere)
(f) This title does not apply to any of the following:
(1) A broadband internet access service, as defined in Section 3100.
(2) A telecommunications service, as defined in Section 153 of Title 47 of the United States Code.
(3) The delivery or use of a physical product.
(3) seems to imply the OS that runs your switch or gas pump isn’t included. But I see nothing in the law that clarifies servers or any CLI only interface, or even any OS that doesn’t have accounts.
Where do you quote “reasonable” from? The only part of the law with that word is referring to a different, already existing law (or the bit about reasonable technical limitations causing the wrong signals sent in the API).
Is a mobile phone not a “physical device”? An operating system is always has to run on physical hardware, so does this just invalidate the entire thing?
Nah I don’t think it does. You don’t really get that because the intent of a law is important in court cases.
Mobile phones are specifically covered:
(g) “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.
I’m just not sure. It seems contradictory to me, since the manufacturer of a physical device is also “a person or entity that controls the operating system”. Unless they sell the hardware with no OS installed? This exemption doesn’t seem to mean anything.
With how they’ve defined “App Store”, basically any product that can download applications is affected by this, including devices that don’t even have the concept of a user account. I’m a little unclear still on what’s required of an entirely offline OS.
I am not sure what’s required of a bare bones Linux install (general computing device) that has access to a package manager (application store)!
But why do they assume that I am going to create an account to simply use an OS?
Ok I did it, I read the full text of the law, and you’re right.
The existence of Linux or anything not big tech and the broad range of options within seems to be ignored. Does a CLI only OS need to provide a GUI for its “accessible interface”?
On a different note, I did see the last point here:
(f) This title does not apply to any of the following:
(1) A broadband internet access service, as defined in Section 3100.
(2) A telecommunications service, as defined in Section 153 of Title 47 of the United States Code.
(3) The delivery or use of a physical product.
(3) seems to imply the OS that runs your microwave isn’t included.
I am also using my phone with no account linked to it, as it is not required. It still seems to be an ignored usecase, even with the added context you provided.
Yeah perhaps. Or that “account” doesn’t really need to bw what we think of as an account.
Could it be covered, but they would still have to ask? It says if it wasn’t done at setup it has to ask, so perhaps an account-less OS would still be expected to ask for an age and provide it when asked?
And I don’t understand, because windows already does this and has for years. I don’t live in California though, so I don’t know the particular nuances they are asking for.
The problem is, and has always been, getting parents to use the tools. So unless you’re sending parents to jail for not doing this, then it’s totally optional and most won’t use it.
If you want screentime limits, content filters, browsing history, restricted programs, age verification, wallet control, friends list filters, etc. It exists and is available on Windows and Xbox for free.
I think the next bit from the article I didn’t quote explains that:
“(2) Provide a developer who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface that identifies, at a minimum, which of the following categories pertains to the user.” The categories are broken into four sections: users under 13 years of age, over 13 years of age under 16, at least 16 years of age and under 18, and “at least 18 years of age.”
I think the idea is that you would say that under 16s can’t use social media. Then you’d enforce this not with the horrendous Australian strategy of having everyone IDed, but instead you would enforce it by having an API that websites and apps could use that would tell them the age of the user.
So basically:
- Parent sets up device for kid and sets their age.
- Kid tries to download Facebook app
- Gets denied because they are under age
- Kid tries to go to facebook website instead
- Website sends request to browser for user’s age, browser asks Windows (or whatever OS) for age and provides this age back to Facebook
- Facebook denies access because user is under age
Windows might already have parental controls within Windows, but it’s the ability for apps and websites to know the age (or in this case age range) that is the important part.
I much prefer this than handing over ID.
Windows can do that too, for the applications and websites that support it. There is no point in forcing it onto other ecosystems if parents are not willing to use the tools in the ones they already exist in.
Windows doesn’t ask at install, and also this law requires them to ask for already set up accounts too.
This will make it a lot more visible.
So this is where devils advocate comes into play. Pretty sure we all are agreed that this law, or anything like it, is ‘not good’. And I’ll leave it at that. Just keep that context in mind as I elaborate further.
Windows actually does do this on install. However, the Microsoft Family feature uses Microsoft Accounts. So technically, sure it’s not the OS (though it IS part of the OS, as you don’t need to download anything extra to enable it’s functions).
But you have to go out of your way now to do an offline windows install without a Microsoft Account. If you’re that savvy, you’re capable of monitoring your child without the help of big government. If you’re a child, then nothing but honesty is keeping you from jumping walls.
But that is windows, and this is Linux. Now I’m not making accusations, but do we really want to push the idea that this form of control needs to be pushed out across everything, simply because the current solution that would work for most families isn’t done at the “OS” level?
And to top it off, I don’t even see it working. Most family devices are set up on an account with a single login. Managing access is not a ‘one and done’ process, at some point you will have to provide permissions, install software, change active hours, approve screen time requests, troubleshoot related problems, and more (and soooo much more if your kid is technically adept). Is it no wonder that most parents just give kids free reign to their computers and consoles?
So before we go around and ruin the experience and privacy of everyone, can we at least ask what the people who want this have done instead? Cause it really does feel like it’s coming from a group who wants everything done for them.
I agree. This doesn’t seem any more egregious than clicking a button on a website that says “I am over 18”.
Which website is that?
The one with naked people on it.
Do you have the slightest idea how little that narrows it down?
Mr. Powers, everybody says that nudity and cursing aren’t Internet-safe. How much poem could there possibly be?
Wait, there is more than one?
