Suggestion: aged(8) should have a "not required in the user's jurisdiction" response.

[matthewmummert5]

aged(8) could return [-2, -2] by default for users outside of California, New York, Colorado, Illinois, Brazil, etc to indicate "Not required in the user's jurisdiction". This jurisdiction-specific behavior could be handled at compile time with #ifdef CALIFORNIA or something. Users with the non-California version could enable the California behavior, if they want it for their children, with a config file option.

If you went with this approach you'd have to make sure people with California IP addresses get the California version when they download MidnightBSD from official mirrors, so it would be extra work to maintain regional builds of MidnightBSD.

Pros:

• It's a more bare-minimum compliance approach to limit the societal issues caused by these laws to only the jurisdictions where they exist.
• It still puts parents in the driver seat since they can enable the California behavior if they want to.

Cons:

• More work to maintain regional builds and have the mirror infrastructure hand out the correct ISO to the correct regions
• May enable additional user fingerprinting.

[laffer1]

I was planning to add some type of compliance configuration eventually to handle variations in the law between regions. Not a compile time ifdef, but a setting that could be set by root with the agectl command.

Having the alternate return code is an interesting idea. I'll think about that and leave this open for now.

[matthewmummert5]

Definitely. Whether it's through a compile-time ifdef or a config file, I do think that an alternate return code to explicitly say "not required" has a lot of social value, even if it's a technical annoyance for application developers. It would force application developers to deal with the world not revolving around California. It would almost be like the way protocols introduce "grease" to prevent protocol ossification.

Also, some jurisdictions in the future might pass privacy laws that outright ban the age verification APIs that California is requiring, so it would be useful for future compliance.

[caligulansystem]

The deliberation over and effort put into age attestation mechanisms on MidnightBSD is genuinely hilarious. You're an extremely niche BSD derivative without a legal entity, I don't know who needs to tell you this but you're not Google or Microsoft. You wouldn't exactly be making headlines if you chose not to comply, or even if you just chose to wait for an upstream implementation in FreeBSD to adopt silently. The amount of individuals under the age of 18 who have booted and casually used MidnightBSD on real hardware is probably in the double or even single digits. And to even think for a second that "aged" and package ratings are going to stop these hypothetical, underage technological prodigies is laughable and extremely illogical. It's equally insane to think that there's families out there in affected jurisdictions whose children run MidnightBSD. Grandpa's compiling a Wi-Fi driver. Little Timmy, 14, just contributed 35,000 lines of C to the project GitHub. Anna, 9, just tried to install a PDF reader, but thank the Lord we have agectl to prevent her from installing it. What would we do without it? You need to understand that there is not a single individual in the United States government who knows what MidnightBSD is. There is not a single individual who knows an individual who works for the United States government who knows what MidnightBSD is, at least prior to this baffling and unnecessarily hasty compliance. You are now known for being the first operating system in history to comply with age verification laws - not ChromeOS, not Android, not Windows, MidnightBSD. Fantastic job.

[laffer1]

You are now known for being the first operating system in history to comply with age verification laws - not ChromeOS, not Android, not Windows, MidnightBSD. Fantastic job.

I'm not the first. iOS has it. I even referenced their APIs in my google doc linked on the front page of the website! Some linux devs have also proposed FOLLOWING apple's approach.

The point of me doing the work was to protect users in those jurisdictions from hefty fines in the event something comes up. I also look at it as a parental control system beyond what the law says. It wasn't worth doing at all if it didn't at least act as a parental control feature for packages in the OS.

It's reasonable for a desktop OS to offer a parental control feature. It shouldn't be legally required to do so, and we all agree on that point.

[matthewmummert5]

@caligulansystem I'm not affiliated with the MidnightBSD project.

I came here to suggest that the technical implementation returns "not required in the user's jurisdiction" by default except in a (hopefully small) whitelist of jurisdictions because it makes it easy to remove jurisdictions from that whitelist as their respective laws are overturned in the courts. Once all the jurisdictions are removed from the whitelist, aged could be phased out altogether. In the meantime, engage with your lawmakers to oppose these laws. Don't just send them angry emails, they can ignore those. Call their office and ask for a meeting. I've actually had some success with doing that with my California state elected representatives and they've actually sat down with me to hear me out. I'll cross my fingers that this goes somewhere.

In the meantime, asking open source developers to risk their freedom is unreasonable. Thanks for all you do @laffer1.

chose to wait for an upstream implementation in FreeBSD to adopt silently

MidnightBSD is ahead of everybody else on this. Maybe FreeBSD will end up copying this implementation. Maybe Linux will even copy it. If that happens, and returning "not required in the user's jurisdiction" becomes standard practice across the open source world, then the damage done to the open source ecosystem by these jurisdictions will be much more easily undone as these laws are thrown out over time.

[caligulansystem]

@laffer1 A parental control system? Are you serious? What family are you picturing here? Is there a single household in the entire world, in affected jurisdictions or otherwise, that has children casually running MidnightBSD? Even if that were a real demographic (it's not and will never be), what on Earth makes you think a parental control system would stop the children of or be of use to this family at all? Little Timmy was unhappy with the FreeBSD licensing, so he decided to run Midnight, but thank god we had agectl to stop him from installing a PDF viewer. Give me a break. This is laughably, inexcusably ridiculous compliance theater and you know it.

[laffer1]

@caligulansystem I've had users ask me about adding games for their kids before. It's a real scenario, whether you like it or not.

Further, if you think our user base is so small, why do you even care that we are adding features?

[PPPDUD]

I'll point out that this age verification system is unfair by its very nature. Honest, mature children are forced to only consume content deemed by some arbitrary entity as fit for their "age range", whereas people who lie about their age are given the freedom to consume almost any content that they wish. Instead, I propose that parents and their children are allowed to decide what's best for their own families.

@caligulansystem I've had users ask me about adding games for their kids before. It's a real scenario, whether you like it or not.

Further, if you think our user base is so small, why do you even care that we are adding features?

Because you're penalizing honest people and rewarding dishonesty.

[PPPDUD]

It's reasonable for a desktop OS to offer a parental control feature.

No, it's really not, because that defeats the entire point of free software if it actively seeks to restrict your conduct.

[laffer1]

It's reasonable for a desktop OS to offer a parental control feature.

No, it's really not, because that defeats the entire point of free software if it actively seeks to restrict your conduct.

It's an optional feature in most jurisdictions. The point of free software is that you can customize it and use it as you want. That is retained. I'm not scanning IDs.

[PPPDUD]

It's reasonable for a desktop OS to offer a parental control feature.

No, it's really not, because that defeats the entire point of free software if it actively seeks to restrict your conduct.

It's an optional feature in most jurisdictions. The point of free software is that you can customize it and use it as you want. That is retained. I'm not scanning IDs.

It's an optional feature, but it's integrated into the OS by default, which in my view constitutes endorsement. It should be written by a third-party and distributed using their own means.

[laffer1]

It's reasonable for a desktop OS to offer a parental control feature.

No, it's really not, because that defeats the entire point of free software if it actively seeks to restrict your conduct.

It's an optional feature in most jurisdictions. The point of free software is that you can customize it and use it as you want. That is retained. I'm not scanning IDs.

It's an optional feature, but it's integrated into the OS by default, which in my view constitutes endorsement. It should be written by a third-party and distributed using their own means.

You can feel however you want. It's not going to change my perspective. I've thought about this a lot more than the typical person online. I still think the law is incredibly stupid. That hasn't changed. I decided to take this lousy requirement and turn it into a parental control feature at least so it does some good. Gnome has parental controls. Are you posting there to ask them to remove them because kids are mature?

[PPPDUD]

It's reasonable for a desktop OS to offer a parental control feature.

No, it's really not, because that defeats the entire point of free software if it actively seeks to restrict your conduct.

It's an optional feature in most jurisdictions. The point of free software is that you can customize it and use it as you want. That is retained. I'm not scanning IDs.

It's an optional feature, but it's integrated into the OS by default, which in my view constitutes endorsement. It should be written by a third-party and distributed using their own means.

You can feel however you want. It's not going to change my perspective. I've thought about this a lot more than the typical person online. I still think the law is incredibly stupid. That hasn't changed. I decided to take this lousy requirement and turn it into a parental control feature at least so it does some good. Gnome has parental controls. Are you posting there to ask them to remove them because kids are mature?

As a user of GNOME, I don't like that one bit either, but you know how the GNOME devs are. If I were to bring it up with them, they'd be more likely to ban me for life than actually consider my opinions.