Yes, sorry I had a busy month :P

Yeah, that was my point… that’s why I was saying that if a kid is smart enough to to set up a VM like that they are smart enough to find alternative/easy out-of-the-box methods… the “using someone else’s login” in particular is one of the points I made earlier.

This is why I think the control should be local, and with the parents being the ones responsible. Relying on third party authentication and expecting the remote services to be able to determine the age is not gonna work.

It’s going to be an arm race and the most dedicated kids, not necessarily the smartest or wisest, will figure it out. Eventually they’ll get the concepts behind the tools they mindlessly use until then, eventually find much better tools allowing them to bypass a lot more restrictions.

Well… it depends on how do you define “smart” …but to me, that kind of dedication and resourcefulness is already showing problem-solving skills, regardless of whether they “get the concepts” (many adults don’t fully understand the tools they use either).

I don’t see how a browser will be able to prevent this kind of usage

In Firefox, you can disable websockets (and most other features or about:config settings, but the website you linked uses websockets) through a policy.json setting writable only by root, so it wouldn’t be possible for a user without root permissions to change it.

How can the account holder violate the title when the title is not demanding anything of them? the whole document is about what the developer and OS distributor “shall” do… there’s no responsibility attached to the account holder. There’s no “shall” attached to the parent. At most all it says is that the OS provider shall offer an interface that requires the Account holder to enter their age… which again is a mandate directly addressing what the OS provider shall be responsible of doing, not the parent. I think it’s pretty clear that the document is targeting the OS providers & devs.

In fact, it even says that the developer should correct the age themselves, as if the account holder signaling the wrong age was already an expected situation, business as usual:

(B) If a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant to this title, the developer shall use that information as the primary indicator of the user’s age.

But sure, that’s only for the AG to interpret… until it happens, it seems to me that it would be silly to assume that parents are gonna start to get fined, all these years the pressure has always been put into the service providers, with the parents often being given relative freedom to decide what to do (and that mentality is specially big in the US, where many states allow you to even home school your child, California amongst them…). Targeting something as “local” as an OS level question seems to me like a bad choice if they actually wanted to suddenly start putting pressure on the parents about age restrictions with this new law.

No, this law is not placing penalties on the parents. It’s placing them on the OS distributors.

If you come to my house and get sufficient proof that my child is having an account in a web service it should not, and you go to the police with it, do you think they would punish me with a fine or anything? (and you don’t even need any sort of special authentication technology for “age attestation” to start penalizing that, btw)

It is exactly because we cannot trust parents to moderate what their children do online that these laws are coming up.

I disagree. The reason we cannot trust parents is because we are not making them responsible in the first place… there’s not a system in place to assign them responsibility regarding the child accessing places it should not (if we do really think they should not).

So if by “trust” you mean “blind” trust with no accountability, then well, we can’t “trust” NOBODY, not just parents.

The problem is that instead of controlling the bad parent, we are trying to control everyone else to try and child-proof the world.

States require that you get a license, take a test, follow road rules, get your vehicle inspected, and many more requirements. We have these requirements because we know that we should not let an untrained driver on the road.

The reason I removed it is precisely because I expected this kind of misunderstanding. You are assuming that in my comparison getting a license is comparable to a sort of age limit permit, but the way I framed my comparison, the equivalent of “getting a license” would be educating the parents and keeping a “parental license”. The parent is the bad driver.

By “this mess” are you referring to Ch. trafficking? I’d say the responsible people for that are the ones running the criminal rings… but the responsibility for prevention (beyond just plain law enforcement) should still ultimately be with the parent, imho. Since they are the ones with the most power and control over the environment the child is exposed to (I mean, it does not matter how many authentication layers you add, ultimately a child can pass it if they use the parent’s ID…).

If by “this mess” you mean the risk of leaking private information that everyone is concerned about, I don’t think that’s really caused by the “leave it to parents” mentality… if anything, that’s caused by the “parents shouldn’t have the responsibility” mentality, which is pretty much the opposite…

only understand the concept and know where to find a VM.

That’s already smarter than most of my relatives.

I’d argue that controlling / monitoring where a kid goes should already be responsibility of the parent.

If it’s all in the browser then the unprivileged user is at the mercy of whatever rules the installed browser establishes for allowing them access to. So it’s a battle between the parent (helped by the OS) being smarter at setting up local restrictions / monitoring history and the kid being smart enough to break them / act undetected.

I think the idea here would be that the OS would be able to tell the browser (or any app) that the user is only allowed content of a particular target age group, and then the browser (or whichever app) would apply any appropriate restrictions (which could include restricting virtualization primitives like WebVM, other js APIs or even network-level filtering if that’s what it takes).

You can also advocate for making use of the “guest wifi AP” many routers already provide to ensure the access to the internet for their kids is done in an allowlist basis. To the point that the kid would have to be “smart enough” to break through the WPA encryption of the main wifi access point (or find out some other social engineering way to get access to that wifi) in order to have fully free access to the internet and visit websites that allow them to circumvent age restrictions.

Imho, that’s a slippery slope argument. Like arguing that communities should have no moderation at all (not even when it’s fair) because it opens the door for unfair moderation too…

One might as well argue a slippery slope in the opposite direction, the more you reject parental-control methods that you can control, the more incentive they’ll have to instead promote methods where you’ll have no control. So you can equally say that rejecting this method will make their case stronger for proposals that would, progressively, give you less and less capacity for control (or in particular, capacity to actively be disobedient against).

Parental controls means the control is done by the parents… not by the companies. I don’t need to tell any company what age bracket my kid might be, all I need is for them to tell me how can I block / restrict access to their services in my parent-controlled network (or how to allow them, if using allowlist).

Standardization of parental controls would be if routers and/or the OS of the devices came with standardized proxy settings that allowed privoxy-style blocking of sites in a customizable way so we can decide which services to allow… with perhaps blocklists / allowlists circulating in a similar way as adblockers do.

If a web service wants to offer a highly restricted and actively moderated kid-friendly version of their service, they are the ones who need to provide facilities to us so WE can make the filtering (say… they can use a separate subdomain… or make use of special http headers that signal for kid-friendliness), not ask personal information from us just so THEY can take the decision on our behalf…

I mean, ultimately it can always be worked around… even if you were to add stronger forms of identification, a kid can take the parents card / ID / DNA sample / whatever when they are distracted and verify themselves. If a kid is smart enough to set up a VM like that they are smart enough to deceive adults. Teenagers have been finding easy ways to get to forbidden stuff for centuries.

I’d much prefer if the source of trust is in the local device, in the OS, that is responsibility of the family to control, and not on some remote third party service offered by some organization in who knows where with connections with who knows who. If parents don’t properly limit the local user account of their kids, or restrict access to the places they don’t want, it’s their responsibility. Set up proxies, blockers and lock the OS locally, but don’t mess up the internet for the rest of us.

Would they actually go after the people?

I expect the law would place the responsibility on the companies managing / distributing the OS. That’s the reason companies are complying. People can always look for alternatives… I’m sure there will always be homemade distros without stuff like this made by ragtag groups / communities without much of a corporate structure behind.

I mean… there’s nothing stopping anyone from setting their age to 100 years old. It’s not like they are adding any sort of identification check, from what I gather. Just doing the minimum to comply.

It recently overtook Japan, so it’s 4th now…

In general, I agree that you can always use the CLI raw, but a frontend is a lot more friendly for many. It’s the reason some people prefer TUI over CLI as well (some people really like lazygit and lazydocker which are just frontends wrapping git and docker CLI calls and presenting it in a TUI). A TUI/GUI can structure information in panels, it can be more context-sensitive and it can help provide visual representations of the operation.

Also, wrapping CLI commands (whether through a GUI or a TUI) means the wrapper can automatically combine the commands in whichever way it’s best for a particular goal, or more conveniently set up batch processing… it’s helpful for people who don’t like having to make their own scripts, or craft long oneliners.

Plus: lets say you have your computer hooked to your TV and don’t have space for a keyboard (but can use a small wireless mouse on the arm of your couch), a GUI wrapper that allows you to perform operations with just a mouse can be very convenient.

I don’t know what kind of GUIs are you imagining, but I’ve hardly ever seen 1-to-1 recreations to a single individual command (unless that command is extremely complex or a graphical representation would be actually useful).

Some examples:

Gparted creates a job list of terminal commands for the disk manipulation, but it presents a graphical representation of the disks before you actually commit to executing the commands internally, so you can see what would be the result of the changes in the GUI side before actually pressing the button that actually executes parted, fdisk, mkfs, resize2fs, etc. (they do wrap the commands when it comes to executing the changes), without you needing to go through the steps and specific syntax of each of them on your own.

There are wrappers to ffmpeg for video editing or transcoding that some people find convenient for discoverability of the options available and/or to have a limited list of presets / sanitized options for those who don’t want to bother creating their own scripts. Sometimes also showing video previews for the graphical representation (useful when the operation is about cropping the image, or picking the exact millisecond where to cut). An example is LosslessCut, they keep a log of the ffmpeg calls… or maybe Shutter Encoder (press Alt+C to see the console commands).

In Synaptic, the GUI package manager, pressing “Apply” calls the appropriate APT commands as a CLI app inside a VTE with the selection of the packages you have decided to add/remove/update, which you have previously selected in the listing that is generated from the GUI view of the app. Some people like having a graphical detailed listing which might be useful for conveniently browsing packages and seeing their detailed description, while still you get the raw information and accurate log from the installation that you would get when you are just using the CLI.

Personally, I feel that if it uses control characters to update the screen in previous positions, altering the scroll buffer, moving beyond where the cursor is and redrawing the screen, then it’s a TUI.

CLI programs only output plain text in a stream, using just control characters for coloring and formatting, and if they do any re-drawing it’s only for the current line (eg. progressbars and so).

So… even something like less is a TUI program… but things like more or sed would be CLI programs.

Isn’t the T for “text”? (ie. “Text User Interface”)

I mean, in the context of Unix systems it’s most likely gonna be within a terminal emulator, but in theory you can have a TUI inside an SDL window rendering the text there (specially when they are ports from other systems where they might be using different character sets than whats available in terminals… or if they want to force a specific font).

The only example that comes to my head right now is ZZT, but I believe there are many games on Steam that use a TUI rendered within their own program, not a terminal.

I generally agree but it depends on the application and the computer purpose / input you will most use.

Like… it doesn’t make much sense to have a CLI/TUI for an image editor… if you start using things like sixel you are essentially building a GUI that runs in a terminal, not a TUI. The same happens with videogames, video players and related entertainment applications.

But like I said, I do generally agree. I’d even argue that when possible, GUIs should just be frontends that ultimately just call the corresponding CLI programs with the appropriate parameters, avoiding duplication.

The second most restrictive of the Creative Commons licenses (only behind the BY-NC-ND one). CC BY-NC-SA is not considered an open source license.

It gives the most control to the original owners of the Copyright, since only they can produce commercial and proprietary versions of the product. Free as in free beer, but not as in freedom.

While it’s true that Debian installation used to make use of a TUI and it did not have a nice GUI “live-CD” installation image for a long time (I think until 2019), Debian installation process included a default DE for way longer than that (2000). And before they did, the installation offered a choice between different window managers (back in the days before well established DE suites were even a thing).

They don’t customize the DE much, but neither does Archlinux which is a very popular distro nowadays (and the installer on that one is arguably even less friendly than Debian used to be).

Personally, I feel it has more to do with how other distros (like Mint, Ubuntu, Knoppix, etc.) have built on the work of Debian to make their own variants that are essentially Debian + extra stuff, making them better recommendations for the average people (if one thinks of those as Debian variants then I wouldn’t say Debian is “left out”). And for the not-so-average people, rolling release style distros (or even things like Nix/Guix) might be more interesting to experiment in.

At least for the German one, it’s essentially a rebranding of existing open source products packaged/adapted to work as a suite.

For example, for editing documents they are using Collabora online (Libreoffice-based), for chat it’s Matrix, for storage Nextcloud, email & calendar from Ox Cloud, etc.