Okay calling it a lie is a harsh term, and I thought we were coming to at least a mutual understanding of each other’s points.

I do not disagree with you, that it shouldn’t be them getting involved. However, what is happening is that they are getting involved whether we like it or not. This is the fundamental difference in our viewpoints. If you think there is still a chance to hold out, go for it, but I think there is no way to avoid it at this point.

I see it very clearly. That it’s going to happen whether we like it or not. I personally think if all the OSes just held out and said “No way we’re not doing anything” then the obvious response is that sites will need to require IDs for everything, and we lost even harder. It’s better to suggest a tech forward privacy based approach now rather than let them dictate that everyone should take IDs.

That’s my point of view. I know you disagree, and we’re not going to come to an agreement, so I don’t see the need to continue this thread.

For this:

These two statements are in conflict and cannot both be true.

“There is no section mentioning penalties for individuals entering false age information. You are completely free to submit whatever age you wish.”
“It’s literally just closing the giant loophole of “I’m totally over 21” that we all made fun of for years.”

They are not in conflict, because the onus is on the parents to set up a child’s account. So if the parent did their job, then the child can never click “I am over 21” because at the OS level it’s blocked. They would need their parent to bypass that again. For adults, on your device, you simply never set up a child’s account, and you don’t need to worry about it. So yes, I consider that closed. A child loses the ability to click “I’m over 21”. Adults if anything hopefully don’t have to click that anymore, but I’m guessing for safety they’ll still force us to tick the box.

And what if a website or app doesn’t check this or add a nudity flag for the device/browser to check? Do you think porn sites in other countries will care?

So far this isn’t for the web at all, but I see this as clearing up the grey areas. Maybe they don’t care, maybe they do. Maybe it puts more power on the browser to help stop it. If a website or app does not listen to it there are consequences for it, but seeing how it’s quite literally a boolean check it sounds pretty easy to be in compliance. That’s the monetary damages we saw above.

I don’t know man, I see this, which is a simple thing a parent can set on an account: are they a child or not. Or, the alternative, which is everyone has to upload their government ID to some third party site, have it stored for all of eternity, and collated and collected, just so they can access discord, or social media, or whatever. The thing is that I do not believe there exists governments right now who are willing to let any of it slide anymore, they are demanding that something be done. Nothing is no longer an option. If we have to choose one of the options, (and by not choosing it means they will choose for you), this seems like the safest most privacy focused option.

I hate lists in comments, but fine.

1. This is irrelevant, it doesn’t matter how you use your computer
2. They don’t specify it has to be the user’s exact birthdate. It can quite literally be anything the parent wants to put in there. In fact when you read the law, it says “Age brackets”. The birthdate will not even be exposed in the API, only what bracket the user is in.
3. Correct, which is why it has to be mandated.

• I supposed that’s on each distro to decide? It’s a mandate, they’re not defining payroll.
• I read the laws for both CA and CO, it doesn’t say, but it does say that above applications will listen to that and may block functionality if the account says they are underage. As for circumventing, I assume each distro will want to prevent that from being circumvented.

4. What possible legal consequences might there be?

Up to $2,500 per affected child for negligent violations
Up to $7,500 per affected child for intentional violations

How would the state know that a user in compliance with the law?

They don’t, there is no mandatory reporting, there is no “phone home” of compliance. It is only, and I mean only a boolean check in the OS, “Is the user a child or not”.

What are the consequences if a user or operating system is not in compliance?

There is no section mentioning penalties for individuals entering false age information. You are completely free to submit whatever age you wish. This is 100% for parents to create a childs account.

Is this data being recorded in a database?

No. This is the largest bit of misinformation about these bills. There is no place where a database is created. It is literally an OS level signal that says “Child is under X age”. A browser can check that signal, and if little Billie wants to see something adult related, the browser blocks it saying that they are under aged. It is still 100% opt in, there is no requirement for an OS to take an age, only that they must allow the option.

If they suspect you have a child using an “adult” account, does the state have the right to seize your computer?

NO. They have no idea! There is no tracking at all! Seriously. Read the law for yourself.

if a child uses an “adult” account to access “harmful” content and that somehow leads to damages, is there no ability to sue for those damages since the child was committing “fraud”?

NO. If the account is a default, normal adult account, all developers can trust that signal. “A developer that relies in good faith on a signal… is presumed to have accurately determined the user’s age and to be in compliance…”

What if an adult is logged in and a child uses the computer?

This is the only slightly ambiguous part, which CA at least knowledges is a gap, if there is a shared account. This law does not state anything about that, and only puts in place that a child should be able to create a child account. At this point the OS would say that the user is an adult, and would fire the signal that they are an adult, and from the other parts of the law there is no liability if the parent didn’t set it up as a child’s account.

Seriously. Please go read it yourself. I’ve been an open source advocate for a long time, and I’m a software engineer. Nothing in this law seems alarming to me. Annoying sure, but literally I can’t think of a better more privacy friendly way to do this. It is quite literally only saying “You must have a way to create a child’s account, so that the API is there for other apps to block access”. It’s literally just closing the giant loophole of “I’m totally over 21” that we all made fun of for years.

In fact what I really love is that it’s doing what we always wanted from the beginning. Put the onus on the parents. This quite literally puts 100% of the onus on them. Like as an app developer I can say If !os.isChild showPorn. It’s quite literally saying “Look, we’ve done as much as we can, you had one job to do as a parent and that was to set your child’s account as a child account, and you didn’t. That’s on you.” As an engineer myself, if all I have to do is check a flag to make sure kids don’t use my NSFW app, then that sounds like a win.

https://legiscan.com/CA/text/AB1043/id/3269704

Well great! Because no one is asking you to provide your identity. Both California and Colorado laws say that you only provide a birthdate (that you set) on a child’s account. So, don’t make a child’s account?

Your argument is literally the slippery slope argument, so maybe we can agree that the whole topic is blown out of proportion.

That’s actually my point though, that some sort of this is going to happen no matter what. If you start at the assumption that they’re not going to stop until they can verify that the children can’t access porn, then working backwards this is the best way to accomplish that because it’s privacy focused.

The option of refusing is not on the table. It’s not going to happen. There can be holdouts, but it’s happening whether you like it or not. The only real thing we can do is fight for a version which does handle our privacy, which this one does.

See this is what we call the slippery slope argument. If things like that happen I will be up in arms with all of you. That’s not what is happening though.

Age declaration, not verification. I know I’m in the minority here, but I don’t understand what the big uproar is. All it is is a way for mom and dad to mark an account as under aged.

If this didn’t happen we would keep seeing more mandatory ID uploads and facial scanning. This is probably the best outcome we can hope for. They get to protect the children and we can keep using the internet.

Every developer just died thinking about the maintenance

and it’s going to continue! It’s not even about being green, financially you can’t ignore it.

Do you:

• Put a solar panel up once and plug it in

or

• Pay people to mine old rocks, pull them out of the ground, and then ship it across the country at a regular cadence

It doesn’t take an MBA to see the financials here.

Fuck private equity. Its always a pump and dump. They don’t care about the mission, they want to holding, strip it for parts, and sell to a bigger sucker later.

Good practice. Good luck then! Let us know if you need anything, on matrix I’m @scrubbles:halflings.chat, feel free to DM with questions

That’s how I started too, so very good plan, and good way of thinking ahead. Ssd will be fast so the app will load fast for your users, and images can take a few seconds and no one will mind.

Make sure you have a solid backup plan for both

Basically for a cloud provider s3 storage is just any storage. It’s not a disk that needs to be high availability with programs reading and writing to it with an OS on top, its just blobs of data. Images, video, isos, whatever. Its meant for access that is lower than what a VM would need for an active program.

For matrix this is ideal for its content. An image uploaded will be read a fee dozen times, and then less and less until eventually it isn’t really needed ever unless someone scrolls and scrolls up.

So for hosting, if you store that on a disk you’re saying “this is critical to the operation of the software and must be highly available and optimized for vms reading and writing to it.”. Think like m.2 ssds. Blob storage then analogous to us home labbers to throwing it on a giant nas. Its there, may take a bit to load, but its there.

Then s3 has classes too, where if you need your data even less you can pay even less trading off access times, you can get even better rates if you know you need it extremely infrequently, like audit logs. Tape drives are actually used quite a bit for those opt-in low access tiers because if you think about it the data storage is incredibly dense, but opening up a tape can be minutes or longer to access. No problem if you’re pulling up some archive from 20 years ago.

If you’re running locally on your own system then yes you can use your own. You can use something like MinIO or Garage to self-host an S3 bucket, and then point Matrix to that

Docs would be helpful, I can’t find much of anything, I think you honestly did the best writeup.

Star Trek quotes is hilarious and perfect!

I’m not sure your level of understanding of cloud infrastructure, so let me know if you need me to go into more detail. Disk storage, like what is attached to a VPS/VM is very expensive, and it’s the 100GB drive you have attached. What is much cheaper is object/blob storage, known in AWS and most cloud providers as S3. This is far far cheaper for many reasons.

Matrix (and really I should say Synapse, what I use) can be configured to save images, photos, uploads, etc to save to a blob storage “bucket” instead of disk. So you can lower your disk from 100 down to something lower because your data is stored in blob storage (fully encrypted). For synapse, the module you need is here: https://github.com/matrix-org/synapse-s3-storage-provider

Thank you! I’m going to start playing with this and see what I can figure out! I’ll be referencing this frequently!

How do you do that, I’m very interested! Also good to see you Admiral!

You can set it to use object storage instead, much cheaper

My friend group has already moved to Matrix, and we’ve been happy