Post #1047342

2026-04-07 16:08 UTC

What I wrote elsewhere about the California age verification law: If this is meant as a security system, having it default to &quot;fail-open&quot; is insufficient. The Unix APIs don&#39;t have age information. The systemd project has graciously decided that they are willing participants in this, and have accepted a patch to add a dbus API, and subsequently refused to revert that commit. So, dbus API it is. If I start &quot;env -u DBUS_SESSION_BUS_ADDRESS firefox&quot;, does that mean that the browser must pretend that I&#39;m in elementary school and only present &quot;age-appropriate&quot; material, or will it default to &quot;full access&quot;? Likewise, will curl/wget be required to implement a dbus query? Do we mandate that build chroots now become full containers with a running dbus instance that has an age information service connected, so they can access the entire Internet, or do we allow bypassing the filter by doing a recursive curl/wget download of an URL and then displaying it locally? The bits that were added to systemd (and which we cannot remove without creating evidence that we mean to disregard the California legislation) are not sufficient for the stated goal, so we must expect that further enforcement infrastructure becomes mandatory. This entire law assumes that people are using managed infrastructure exclusively, i.e. with an Apple or Microsoft cloud account, and accessing cloud based services. There is simply no niche for user-managed infrastructure here, because it circumvents all these enforcement mechanisms. I don&#39;t even see it being legal for a sixteen year old to be root on their own computer, like it was for me when I started out, because that would give them access to age-inappropriate material, and we cannot have that. I fully expect that we will soon reach a point where we have to decide between following US or EU law, with no option to remain compliant with both. A requirement to include the user&#39;s age bracket in browser queries is already likely to be in violation of EU data protection legislation. (1/2)

Replies (4)

@GyrosGeier@hachyderm.io 2026-04-07 16:08

If people are unwilling to parent their children, that is not something we can solve with technology. We can, however, by acceding to these demands, maneuver ourselves into a situation where we have invested a lot of time into this, indicating that it is a viable idea, and then have to admit failure because it is simply impossible to solve with technology that leaves even a modicum of control in the users' hands. (2/2)

Open ##1854982
@erincandescent@akko.erincandescent.net 2026-04-07 20:06

@GyrosGeier If this is meant as a security system, having it default to “fail-open” is insufficient. If it was meant as a security system, it would require more than self attestation of age. A perfectly compliant system can have an “I am older than 18” checkbox (as the highest age the system covers) in the account creation wizard and have that be the only information about the user stored. The only time you need more detail is when the person creating the user account / the system administrator specifies that the user is under 18.

Open ##1854983
@dragonfi@social.jsteuernagel.de 2026-04-07 20:57

@GyrosGeier Seeing that this only affect a small geographical region -- not even a full country -- it sounds unprofessional to put this into core software like systemd. My professional advice is that it should be a collection of separate, optional programs and plugins the admin can install to satisfy local regulation. I know it's probably not that popular around systemd, but the UNIX philosophy of "do one thing and do it well" is still a very good one.

Open ##1854984
@leto_fregar@wehavecookies.social 2026-04-08 08:15

@GyrosGeier I see two paths regarding this: 1) The legislative situation remains mostly "as is". As a result, big players in the FOSS world will implement code to formally comply with age verification requirements (like systemd has done). Closed systems (windows, apple, ...) will implement solutions that follow the law but also benefit their data harvesting strategies, i.e. taking age verification rather serious. Politicians will point to big tech complying and be happy. Tech savvy users will find convenient workarounds. The desired results will not manifest. The cycle starts again. 2) Age verification requirements gain more and more popularity among politicians. International law starts to align on this, increasing pressure to not only formally, but actually comply with these new laws. No difference for the big tech companies. FOSS will more and more be forced to make a decision: comply or shut down. Bigger players will comply, small maintainers will give up (as it happened before with other laws). The FOSS community will be poorer for it, the tech companies gain power. Tech savvy users will find less convenient workarounds. The desired results will not manifest. The cycle starts again. Sadly, I see 2 the more likely path

Open ##1854985