Discussion
Nanny state discovers Linux, demands it check kids' IDs before booting
iamnothere: I think it’s more that they have no idea that Linux exists, or headless operating systems used on servers and embedded devices. They are trying to legislate based on the experience of having an iPhone.FOSS (and frankly all systems that don’t use walled garden commercial app stores) should be exempted from this, at a minimum.
forinti: Or maybe the likes of MS lobbied for this because it suits them.
NoraCodes: This headline is misleading. The California law requires that the OS store and provide the age bracket. It does not require that any verification take place.I am not arguing that this is a good idea, but it is simply false that the law requires that Linux 'check kids' IDs before booting'.The New York law is worse, and should be opposed, but the article only mentions it at the end - and even then, we actually don't know what the verification mechanism would be. I've heard a proposal that "age verification passes" be sold at liqour stores and porno shops, for example, who already seem to do an acceptable job of checking ID without destroying people's privacy.
dd8601fn: If it’s like the Illinois one, all of tech are probably behind them, because these shift age verification away from service providers to a self-reported age bracket at the OS level.It’s much safer than what some states are doing (upload your id to services)… for both parties. I still think it’s meddlesome stupidity, though.
m132: From the article:> These laws can, and almost certainly will, get worse. New York's proposed Senate Bill S8102A explicitly forbids self-reporting. The state Attorney General will decide how to enforce it. For example, to use Linux, you might need to submit a driver's license.
m132: > The real problem is this hodgepodge of laws; it's the growth of the surveillance state. From voting rights in the United States, facing Trump's Orwellian-named SAVE America Act, to Ring's doggie tracking system that can also be used to follow people, to Trump booting Anthropic to the side for refusing to allow its AI tools to be used for mass surveillance, privacy is on the decline.I understand it is popular to pick on the current administration, and there are plenty of rightful reasons to, but let's not forget this has been happening way before either of Trump's terms (see: KYC laws). The only difference between then and now is that current administration has essentially taken a mask-off approach, so we get to see this discussion finally brought up by mainstream media outlets.
quesera: You're not wrong, but there is a huge difference between moving US government regulated currency to (possibly) foreign and (possibly) nefarious actors, and this.
m132: Ever since cryptocurrency exchanges have become one of the primary targets of KYC, I have given up any faith in that this is solely about regulated currencies, or money laundering at all.
hamdingers: The initial mislead comes from the bill[1] where it's described as "verification" in the name and digest but nowhere in the law itself.1. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
iamnothere: Who is paying FOSS devs who will be implementing this? Who is providing them with legal indemnification since they are now apparently subject to fines for a fucking hobby if they do it wrong? Who is making CA the only jurisdiction instead of the myriad contradictory laws all over the place? Who is stepping in to make sure no additional legislation comes across regulating how FOSS has to include backdoors or weaken encryption?
LtWorf: It's funny that they want to do these checks in a country where even the checks for voting are very iffy.
alphabetag675: When we are installing docker repositories on my Rockylinux installation on 100 nodes at once, should we need to manually put an age of the person who is running the script somewhere in the process? Will docker be forced to prevent me from downloading its packages if I do not transmit the age in a header?
GoblinSlayer: Server sends age rating, and client checks it.
quesera: FWIW, there are vanishingly few problems with improper voting in the US, and the extremely unusual occurrences are mostly PartyB voters trying to "counteract" the imaginary PartyA violations.Anyone who tells you differently is lying or ignorant.
linksnapzz: If there's no problem w/ improper voting, then why would anyone object to measures intended to verify that the proprieties involved are being followed?
duskdozer: If it were out of genuine concern for verification, those supporting it would want to ensure that all citizens are able to easily, quickly, and cheaply get ID. That is not the case, however.
jwrallie: I started using Linux when I was in high school. I got my first job years later because I knew my way around Linux much better than other candidates. My OS never tried to track my age to prevent me doing what I wanted. I used to live in one of these places where OSs should report user’s age and I am glad my kid will grow up in one that doesn’t (yet?).
dv_dt: Hmm the Reg article seems to have missed the reporting on Meta being behind many of the US lobbying groups - https://news.ycombinator.com/item?id=47362528
nszceta: There is no limit to the power grab. The only acceptable thing to do is to dig the trenches before it gets worse.
Bender: My trench is keeping backups of ISO's that do not contain this creeping garbage. I will manually patch apps and where I can't the OS will be read-only and ephemeral. This will be my process until governments are no longer unacceptable to bribery.
randusername: Many parents will not be proactive in protecting their children online and I think this is a legitimate societal problem. The idea of algorithmic feeds for adult content that descend into increasingly "engaging" depictions is something I find horrifying.I do not want my kids to experience those "loss of innocence" moments too soon by letting their curiosity lead them into things they are not equipped to confront yet. Hell, I still have those moments as an adult on occasion.There has to be steps we can take as a society to address these legitimate challenges ourselves so that governments can no longer hide behind them in tinkering with mechanisms for stability and control. Maybe a "sunlight disinfects" approach.
butILoveLife: Huh... I am the opposite.I want my kids exposed to the brutal realities of the world asap.I reflect that my innocence caused me to make some extreme major mistakes as a young adult that took a decade to show itself. I cannot go back, and now I am suffering terribly.I blame my parents at least a little bit, but I blame western idealism more majorly.
quesera: I don't understand this position. Cryptocurrency exchanges are the primary legal touch point (fiat offramp) for a lot of criminal activity. Of course they will get attention for AML.
m132: I can understand the regulation of fiat/crypto exchanges, but the verification extends to centralized exchanges that merely facilitate exchanges one kind of purely virtual currency for another, neither of which have to be recognized as legal tender.
alephnerd: > Who is paying FOSS devs who will be implementing thisMost Linux maintainers are employed by Google, IBM, Facebook, and other similarly sized organizations.> Who is making CA the only jurisdiction instead of the myriad contradictory laws all over the placeThe US is a federal system. It's part of our checks and balances.> Who is stepping in to make sure no additional legislation comes across regulating how FOSS has to include backdoors or weaken encryptionNo one. This is why organizations with actual security requirements do their own dependency checks.
iamnothere: Linux is the kernel, it has nothing to do with this.The law apparently seems to target the packager/distributor of the distribution. Many small distros are hobby distros!> The US is a federal system. It's part of our checks and balances.Nonsensical answer. Different states are passing different requirements that often contradict each other. This is going to be a nightmare.> No one. This is why organizations with actual security requirements do their own dependency checks.So you’re saying that we should expect those laws too? Because before now “code is speech” has ruled, and the US government have not been able to be so invasive about how computers should work. If this is the direction we’re headed in, we need to organize and fight like hell.
alephnerd: > Many small distros are hobby distros...Then region lock. You don't have to support California or NY or ...> Different states are passing different requirements that often contradict each other. This is going to be a nightmareCreate regional feature flags or region lock. It's a solved problem.> So you’re saying that we should expect those laws tooThey already de facto exist contractually speaking.> Because before now “code is speech” has ruled, and the US government have not been able to be so invasive about how computers should workThe mindset around tech regulation shifted after the 2016 election and Jan 6th.---The overlap between Linux daily drivers and "voters who can flip an election in California, NY, or <insert_state_here>" is nonexistent.This also appears to be a front-run at reducing the risk of an Australia-style regulation being proposed.
rmast: Age verification passes? Now not only would extra costs be added for users to verify their age, that sounds like an age verification passes is a form factor that could easily be resold to someone else.
wongarsu: The California law only stipulates that there's an "accessible interface at account setup" to set the birthday or age at account setup, and an interface to query the age bracket. Plus the crap for "application stores"I don't think it's a very well thought-out law. But realistically this will end up as setting some env variable for your docker containers to assure them that you are 99 years old. And yes, maybe transmitting a header to docker hub that you are 99 years old. Probably configured via an env variable for the docker cli to use. It's stupid, but nothing a couple env variables wouldn't comply withThe real issue is when the law inevitably gets expanded to get some real teeth, and all the easy workarounds stop being legal
browningstreet: Gavin said he's open to amending the law. I hope someone's taking him up on that..
parineum: Gavin doesn't make laws and should have vetoed this one.
slashdev: The register is a satirical publication.
shadowgovt: [delayed]
jeroenhd: Work on a standardised solution has already been done and proposals are already being discussed. Things aren't moving as fast as they could be because every time something like this hits a front page somewhere a bunch of people have to come in and comment that they dislike the law, but the people behind open source projects don't seem to be bothered by the time they need to put into this. Their employer is probably just paying them to do so anyway.Linux desktops already have APIs for profile management. This is just another field to add to those APIs.Very few core Linux desktop development is coming from hobbyists compared to the massive corporations maintaining Linux as a real option. Companies like Red Hat and System76 isn't going to drop California as a customer base to make a statement that no politician will ever listen to.
EGreg: The trenches will eventually be overwhelmed regardless. Once the government has AI and sensors, it will mandate its ubiquitous use.For minors, we have this lovely law coming in NYC: that will broadcast to everyone that you’re a minor: https://www.nysenate.gov/legislation/bills/2025/S8102But let’s talk about around the US. For example, all cars manufactured in 2029 and onward will be required to have a built-in alcohol detector / breathalyzer and to shut down and not let you drive if they detect your blood alcohol level is too high: https://www.clear2drive.com/the-pass-act-explained/And in 2027 — next year — new cars are required to watch where you are looking, how much you’re blinking or nodding and alert authorities if you aren’t alert enough: https://www.gadgetreview.com/federal-surveillance-tech-becom...And it’s not just the US government. That phone in your hand? Governments have mandated tha all vendors preinstall spy software, filters and apps on it, that are not removable: https://www.aclu.org/news/privacy-technology/government-mand...Also these phones no longer shut down when you shut them down. They continue operating and sending telemetry so the government can eventually know where they are at all times. https://android.stackexchange.com/questions/228682/why-do-ce...This is in addition to the interlinked CCTV cameras that are the norm in various cities (eg in the UK), new Flock cameras in US, etc. But the government doesnt even need Flock or Ring to cooperate. They have plenty of their own housing programs to install thousands of cameras to spy on citizens 24/7, and can now deploy AI to sift through it all. Here in NYC we already have the lovely Domain Awareness System: https://nysfocus.com/2025/08/11/eric-adams-nycha-nypd-camera...To sum up: the government can know what you’re doing at all times, with sensors in your car, mandated apps on your phone, cameras on your street, and soon, mandated telemetry sent by your operating system. Caretakers of kids are required to report anything to authorities and not let parents know, in case the department of child services might need to know. Every child is required to be vaccinated too, with lots of different vaccines.I wouldn’t be surprised if toilet plumbing in every apartment in the future will be required to install a test for what you’re eating or drinking, to catch diseases early and for public health.Looks like this short film is a documentary about our future, except with AI doing the snitching instead of humans: https://www.youtube.com/watch?v=vJYaXy5mmA8
rmast: The sobriety check requirement for cars is so optimistic:“Once data prove the tech cuts drunk-driving crashes, insurers may trim rates.”Why would any insurance company want to cut into their profits by reducing rates?
wat10000: Because it's a competitive market and offering a lower price than your competitors helps you earn more business. If your competitors lower their prices and you don't lower yours then you'll lose business.
hrimfaxi: I am intrigued by this. I have long thought that exposing children to optimism and "what could be" allows them to envision a world different from our own. Kind of like how once you're in capitalism it's hard to think of alternatives.
iamnothere: I think it would be better to create a parallel economy of underground unrestricted distributions while encouraging everyone to openly flaunt the law, and simultaneously fighting via lawfare and media. But maybe that’s just me!
alephnerd: > encouraging everyone to openly flaunt the law> But maybe that’s just meIf you are fine taking the legal liability and are open to civil and criminal prosecution, go right ahead.Western jurisdictions tend to cooperate on extradition as well, and American free speech laws are significantly more expansive than those in the EU, Canada, or ANZ so taking a principled approach wouldn't be a viable defense if you decided to go and incite via that route.> fighting via lawfareThat is being done.> and mediaYou heard about it via the media.
iamnothere: Fine by me, I’m willing to fight. The freedom to compute is one of our most fundamental freedoms, connected inherently with freedom of thought and speech. Cowards like you don’t deserve the benefits you enjoy, and you will surely complain about their absence when they are gone!
k33n: Totally inaccurate. The actual technical requirement is to add a self-reported age field to user creation flows, and that the value selected be made available to applications.But let's just pretend something totally different is happening. It's more exciting that way.
LtWorf: But how are any of them able to carry out the violations?
slopinthebag: > The real issue is when the law inevitably gets expanded to get some real teeth, and all the easy workarounds stop being legalWhich will happen. The road to hell is built one brick at a time.
whywhywhywhy: So once my application is running I can just keep querying an age bracket until it flips and then I've successfully determined a date of birth.
bee_rider: This is a neat attack (in that it is obvious and a big flaw but also it makes sense that the lawmakers wouldn’t have thought of it), but it would only affect users who have an age-bucket transition while your application is running, right?
bigfishrunning: Not necessarily, depending on how the application is logging it just means the resolution to which you know a birth date is limited by how often the application is run. If i check my email every morning at 8am, and my email app logs my "age bucket", then it can know to a resolution of one day. If i only check my email on Monday mornings, it knows to a resolution of one week, etc...
pelagicAustral: Be nice to hear Linus' take on it.
LtWorf: If you want interesting takes ask RMS.
pas: is there any mention of granularity? so if the user sets their age bracket, then there's no DoB stored. if the user is old enough to fall into some other age bracket they can set that if they want. (and then somehow making this a bit more data driven - ie "verifying" - is a different matter altogether.)
shadowgovt: [delayed]
AlotOfReading: Then you store the user age every time it's run and check for changes on start. Maybe that only gives you a 7 day range for birthdays, but you can narrow that over time and it's still good enough for targeting.
soulofmischief: Have you heard of the slippery slope? A cornerstone of American political philosophy?Arguments like this one are why the authoritarian ratchet continues to turn unimpeded over time.
wat10000: What "arguments like this one"? It isn't an argument at all, it's just pointing out some actual facts.If your slippery slope argument can't withstand a simple statement that something is at the top of the slope, it's not much good.
slopinthebag: Authoritarianism rarely happens overnight, it happens one step at a time and at every step the useful idiots [0] exclaim "It's just one step! What's the big deal? Stop overreacting!".Next thing you know you've walked 100 miles and it's too late to turn back.[0] https://en.wikipedia.org/wiki/Useful_idiot
iamnothere: A number of distros (even some large and well known ones) have signaled noncompliance or do not believe they are impacted due to technical reasons (Gentoo) or jurisdiction (OpenBSD, NixOS). Other US distros are not yet signaling agreement because of uncertainty regarding different laws in different states/countries and potential legal challenges. This is not set in stone and it’s still possible to present a united front of noncompliance.
duckerduck: When I was very young I installed OpenSUSE on my underpowered windows PC, it was really a hacker man experience that is engraved in my mind as a core memory. As a child I just thought it was cool to have a new and faster desktop, but as I've grown older I've stayed with Linux for its ideas and principles. Hopefully these laws can be overturned...
hackinthebochs: I've always found it strange how Americans like to validate their ideals using their kids as vehicles. Instead of teaching kids how to be successful in a less than ideal world, we teach them our ideal view of the world. Like teaching kids violence is never the answer, instead of sometimes a situation does call for violence. We raise kids for a world that doesn't exist. It's just up to the kid/adult to unlearn those obviously bogus ideals after they make contact with the world. It's just odd how we're so practiced at setting up our children for less success in the real world.
wat10000: Voting is far more important. If someone is falsely denied access to some web site, it doesn't matter. But everyone with the right to vote must be allowed to vote, no exceptions.In any case, voting is substantially more intrusive. You must register with your full name and address, which is made public record. Each time you vote, that is also made public record (not who you voted for, but the fact that you voted). In states with closed primaries, your party membership is public record. In states with open primaries, it's public record which party's primary you vote in. It's way more invasive than a text box in your computer's account setup screen that asks for your age.
bigstrat2003: I disagree there. I think that this is far more intrusive, because it impacts your everyday life rather than just a small slice of it, and thus more important.
jasonlotito: I agree. Voting is far more important as laws impact you every day, and I don't install an OS every single day.
shadowgovt: To be fair, "it's just a fucking hobby" no longer being an excuse has been a long time coming, much in the same way that driving cars or flying airplanes started as just a hobby but became no longer one when practicing it had outsized consequences to non-practitioners.Signed, someone who notes frequently that the default apache configs probably put a web developer in violation of the GDPR (since if you just left on collecting IP addresses for no reason, you are de-facto not collecting them for "network security.")
iamnothere: You’re arguing against freedom of computing, itself an extension of freedom of thought and freedom of speech. These laws are an attempt to regulate not just what you do with your computer, but how it operates. This is fundamentally an attack on rights and freedoms, and if it goes unchallenged then it will expand into other areas.Maybe that doesn’t move you; it seems like you don’t care much for personal liberties. (A Euro, go figure.) But this is America and we have constitutional guarantees here.
forshaper: It seems to me that this is a parental responsibility. Understandably, we have shifted increasing amounts of those on to the state. However, there are fireplaces, stoves, drills, and other power tools at home. Is the state responsible for children getting into those?
quesera: I didn't know those existed, and so I kind of see your point.The counterpoint is that if your job was to prevent/punish financial crimes that affect consumers, would it make sense to ignore these exchanges?Heck, if M:TG cards were the medium, and they could be moved across international borders with a few keystrokes, then surely those would be watched too.I won't argue that it's not privacy-invading for legitimate customers, but if the legal structure allows it, regulators have an obligation to look where the problems are expected to be.
bee_rider: Also, like, what about IOT devices. Are lightbulbs and thermostats going to need to attest the age of their users? There are so many computers without a useful concept of a user identity.I honestly think the California law is well intentioned (in the sense that it just asks the OS to attest the age of the user, so, lawmakers probably thought this could be done in a privacy-preserving and minimally annoying fashion), but it seems very focused on desktop and cellphone use-cases.
gzread: It doesn't ask for any attestation. It's literally just a user profile setting that can be changed by the root user.
wongarsu: The size of the age bracket also puts practical limitations on it. There is only one mandated bracket for everyone who's at least 18, preventing that attack on anyone who starts using your software after their 18th birthday. And if a 13 year old signs up it takes three years for you to observe the switch to the >=16,<18 bucket
gzread: Why, what's wrong with it?
superkuh: RMS was right, again. He called it decades ago in "The Right to Read". It must be extremely frustrating to see all this and know what changes need to be made to stop it and then have it happen anyway. Over and over.
gzread: The UI can be implemented using the user's date of birth, but it can also be implemented by selecting an age bracket and then all it tells you is that the user changed the age bracket setting.
wat10000: The comment you replied to only said the first "it's just one step" part. You're imagining the rest. Are we not even allowed to make factual statements when something is, in fact, just one step? "It's bad to factually describe what's happening because it will get worse" is a terrible way to make your case.
soulofmischief: > I've heard a proposal that "age verification passes" be sold at liqour stores and porno shops, for example, who already seem to do an acceptable job of checking ID without destroying people's privacy.
gzread: I'm flagging this for the misleading and incendiary headline.
bee_rider: IIRC the age buckets were defined in the California law. They were something along the lines of age ranges that would intuitively map to adults, teenagers, and kids, I forget the exact borders.I think the intent was for the OS to know the user age, but only provide an age range, so it could automatically upgrade people as they aged (but I could be wrong about that).
Apocryphon: Freedom doesn’t flow one way though. Their GDPR example just gives freedom to non-state malefactors to impinge upon user freedoms. You’re crying about 1984 and they’re crying about Neuromancer. An age-old dilemma.https://theonion.com/the-future-will-be-a-totalitarian-gover...
