• Lost_My_Mind@lemmy.world
    link
    fedilink
    English
    arrow-up
    236
    ·
    1 month ago

    Simple solution. From now on Linux distros should ship with a big message “NOT FOR USE IN CALIFORNIA”.

    You want to force age verification? No server in all of California will run. Period.

            • SanctimoniousApe@lemmings.world
              link
              fedilink
              English
              arrow-up
              2
              ·
              1 month ago

              If the only server OS legally capable of running in CA is Microsoft’s - be it Windows, or their particular spin of Linux - guess who’s gonna sop up all that government contract money?

                • SanctimoniousApe@lemmings.world
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  edit-2
                  1 month ago

                  Wow, I’ve really got to spell it out for you, huh? Azure Linux will not be exempt - Microsoft will add the required routines to it, and if they are the only ones to do so, then they soak up the server market in CA.

                  ETA: I doubt that will wind up being the case as other commercial vendors will not want to be left behind, but we were discussing the theoretics.

            • TotalCourage007@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 month ago

              Because these scumbag companies are essentially running business like mafia thugs. Every OS is just linux with DRM if you dig deep enough.

      • Willoughby@piefed.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        1 month ago

        “We’re every datacenter in Canada e Mexico and we collectively and politely agreed it’s a good move as well.”

    • ColeSloth@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      12
      arrow-down
      9
      ·
      1 month ago

      Yeah… It says just that in the article. You did read the article, right? I mean you didn’t just read the title and then rush in here to make a comment?

    • JasonDJ@lemmy.zip
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 month ago

      Whose age do they want on the server? The admins? Whoever staged it? Lol. Sure. Jan 1 1970.

      Do I need to put my birthdate onto my firewalls?

      Ooh are all enterprise firewalls going to start coming with CISA filters pre-enabled? Gotta protect those kids!

    • Gigasser@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 month ago

      Supposedly the age verification thing that’s needed is the equivalent to a porn site verification. Just enter a birthday that’s in the 1800s, and you’re set. This is still a bad direction to go towards though, as it’ll set precedent for future bullshit.

      • Virtvirt588@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 month ago

        There is nothing that’s “needed”. Its an OS not some demonic construct. It should also be noted that teens will be impacted in it as well - all minors. All this age gating, discriminatory behaviour is eating us alive. Age verification should not exist at all.

      • Broken@lemmy.ml
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 month ago

        Exactly. Today you can enter Jan 1 1800 and it will take it. That’s not the problem.

        The real problem is the precedence it sets. An asinine rule gets passed and companies adhere to it, meaning they are enforcers.

        Tomorrow when laws require real verification, like ID scan then they’ve already agreed to be the gate keeper for said asinine laws. It’s harder to back out at that point.

        It’s all surveillance and it should be stopped.

  • sicktriple@lemmy.ml
    link
    fedilink
    English
    arrow-up
    203
    ·
    1 month ago

    So now when I spin up a VM at my sysadmin job I have to tell the server I’m an adult? Does anyone actually know what the fuck we are doing here? What an absolute clown show.

    • zewm@lemmy.world
      link
      fedilink
      English
      arrow-up
      140
      arrow-down
      2
      ·
      1 month ago

      This is what happens when boomers never die and stay in office for a lifetime. They don’t understand technology but are allowed to make the laws that govern their use.

      • a4ng3l@lemmy.world
        link
        fedilink
        English
        arrow-up
        48
        arrow-down
        2
        ·
        1 month ago

        Nha boomers are not the cause for this shit. Smart ass marketeers and tech bro pushing for more precise target identification and thus more reach for them are to blame. And those I stumble upon are definitely on the younger side.

      • 0x0@lemmy.zip
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        5
        ·
        1 month ago

        They don’t understand technology

        Considering most said technology was built by boomers… yeah sure, buddy.

  • RobotToaster@mander.xyz
    link
    fedilink
    English
    arrow-up
    98
    arrow-down
    3
    ·
    1 month ago

    How will this affect embedded os like freertos or vxworks? There are lightbulbs that have operating systems these days, am I going to have to show ID to turn on my light?

    • themurphy@lemmy.ml
      link
      fedilink
      English
      arrow-up
      19
      ·
      1 month ago

      My guess would be these OS’s just wont do it and stop doing business in that state.

      Lucky for you, you can just download them anyway.

      My guess is also that these lawmakers dont care nor considered other OS’s than Windows, MacOS, iOS and Android.

    • pulsewidth@lemmy.world
      link
      fedilink
      English
      arrow-up
      14
      arrow-down
      1
      ·
      1 month ago

      As those are not general purpose computing devices, and additionally have no app store - no, and no.

      From the law text:

      © “Application” means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device that can access a covered application store or download an application.

      • lime!@feddit.nu
        link
        fedilink
        English
        arrow-up
        13
        arrow-down
        1
        ·
        1 month ago

        cool, then neither is my desktop pc. i get all my software on 5 1/4" floppies.

            • despoticruin@lemmy.zip
              link
              fedilink
              English
              arrow-up
              3
              ·
              1 month ago

              I forgot to include nm and wpa supplicant to my arch install before I committed it to disk and am now stuck installing everything from offline pacman caches carried to my via local homeless people in the form of random USB sticks found in parking lots. Prove me wrong.

      • dondelelcaro@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 month ago

        The law defines a public webpage as a covered app store. Anything that can run doom and view a webpage is potentially covered.

        It’s way overbroad and unclear how it could be implemented, and likely to be challenged in court if it even gets that far.

        • njordomir@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 month ago

          Definitely broad and “just trust us bro” energy.

          I’m looking for orgs fighting the Colorado one. I got “replaced” by AI recently, so I have all the time in the world to write letters, make calls, and go to town halls. I just don’t want to do it alone.

    • Attacker94@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 month ago

      It all but makes the law useless, but the law characterizes viable age verification as being self reported, so the Id wouldn’t be necessary.

  • ZoDoneRightNow@kbin.earth
    link
    fedilink
    arrow-up
    89
    ·
    1 month ago

    uhhh. So would I need to get everyone who uses the household pc to verify age? Whats stopping a child from using the family pc that was age verified by an adult?

      • boatswain@infosec.pub
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        1
        ·
        1 month ago

        They explicitly don’t:

        The law does not require photo ID uploads or facial recognition, with users instead simply self-reporting their age, setting AB 1043 apart from similar laws passed in Texas and Utah that require “commercially reasonable” verification methods, such as government-issued ID checks. Assemblymember Buffy Wicks, who authored the bill, said this “avoids constitutional concerns by focusing strictly on age assurance, not content moderation,” in a press release. The bill passed both chambers unanimously, 76-0 in the Assembly and 38-0 in the Senate.">

        • orange_narange@lemmy.org
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 month ago

          I mean, the point is not to protect the children, they are looking for ways to control data. The more barriers the better

  • JasonDJ@lemmy.zip
    link
    fedilink
    English
    arrow-up
    88
    ·
    1 month ago

    Our president is fucking children, and you’re telling me I gotta verify my date of birth to run Linux, in the name of “Protecting the Children”?

    Get the fuck outta here.

  • CorrectAlias@piefed.blahaj.zone
    link
    fedilink
    English
    arrow-up
    88
    arrow-down
    1
    ·
    1 month ago

    Despite signing it, Newsom issued a statement urging the legislature to amend the law before its effective date, citing concerns from streaming services and game developers about “complexities such as multi-user accounts shared by a family member and user profiles utilized across multiple devices.”

    Then why the fuck did you sign it if it wasn’t ready and needed amendments? Is this what you’re going to do as president too?

    Rhetorical, of course. Note how he doesn’t say he disagrees with the bill, just that it needed to consider family devices.

    If this is who wins the primary, we are done. We’re basically already done, for sure, but him winning the primary would be the final nail in the coffin.

      • VicksVaporBBQrub@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        8
        ·
        1 month ago

        Yup. This. I’m in California and this is not even a topic. This is not even in the local news. It’s as quiet as: the bullet train project, the gigantic water pipeline for the south project, the drought solution, the power grid solutions, etc. But, boy, the amounts of money that it blew thru.

    • Sundiata@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 month ago

      because he is a conservative dumbfucking cunt.

      judge: the jury finds the defendant guilty of 9 counts of child negligence, and will serve 5 months in prison with a fine of $10,000 in damages.

      prisoner: what you here for? what did you do?

      father: I allowed my child to create his own account on Debian Trixie 13.3 with KDE Plasma interface.

      prisoner: chuckles

      • njordomir@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 month ago

        Do you know if any organizations are coming out against it? I’ve been looking for a place to plug in. These people aren’t my representatives, but I know people in their districts and I’m curious why now? Who asked them to do this? Why did they think during the unprecedented expansion of the surveillance state was an appropriate time to propose something like this. There are only two sponsors. I looked through other legislation they cosponsored and some of it was good, some of it was garbage, but this was among the worst. I’ll try calling their numbers and send an email.

    • gedaliyah@lemmy.world
      link
      fedilink
      English
      arrow-up
      7
      ·
      1 month ago

      This kinda seems like a roundabout way of avoiding government /corporate age verification laws? Like it doesn’t require ID verification or biometrics and runs a local api to verify age.

      Can someone smarter than me please explain if this is a good thing or not?

      • Peruvian_Skies@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 month ago

        I’m not saying I’m smarter than you but to me it looks like “Hey yeah we require age verification. So, anyway…”

        A token easily bypassed “verification” law to set and forget. It’s basically the same level of security corrently keeping teenage boys off of PornHub.

        • WhyJiffie@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 month ago

          It’s not really easily bypassed though, if only the administrator can set the date of birth for an account. if the parent does not use the admin account for daily usage (and they shouldn’t for other reasons), then the majority of the children won’t be able to change it

    • 🇰 🌀 🇱 🇦 🇳 🇦 🇰 🇮 @pawb.social
      link
      fedilink
      English
      arrow-up
      13
      arrow-down
      11
      ·
      1 month ago

      Because it’s not that crazy or authoritarian and is basically what most websites already do to “verify” you age (which is to say nothing but asking you your age). But the onus is now being put on OS makers, with an additional clause to build an API for other developers to access so they also can “know” a user’s age.

      The law does not require photo ID uploads or facial recognition, with users instead simply self-reporting their age

      • matlag@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        27
        ·
        1 month ago

        It always ALWAYS comes step by step!

        First they will introduce age “non-real-check”, then they will enforce the check: you have accepted the principle, so what’s the big deal if we actually check it?

        • njordomir@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 month ago

          How do you catch a wild pig? (i dont remember the source)

          1. Day one: leave some rotten apples on the ground.
          2. Day two: Lay some fencing on one side and leave some rotton apples out.
          3. Day three, four and five: add more fencing everyday, but just leave it lying on the ground, keep leaving out apples.
          4. Day six, seven, and eight: leave out apples and stand up the fences one side per day until only the gate is left.
          5. Day 9: Install the gate, when the pig walks in, slam it shut.
          6. Day 10: Eat schnitzel and/or bacon

          We are the pig and they’re already standing up the fences!!!

      • BartyDeCanter@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 month ago

        It’s more than that. Go read the bill, particularly section 1798.501.b, 1798.502.a and b. Every developer of every application that can be downloaded from every package system MUST request your age bracket every time it is downloaded. And possibly every time it is launched. Basic utilities like ‘ls’ and ‘cat’, that pong example I pushed as a test, everything.

  • mechoman444@lemmy.world
    link
    fedilink
    English
    arrow-up
    64
    arrow-down
    1
    ·
    1 month ago

    You guys are asking the wrong questions.

    How is Linux going to do this? There’s no server for the os to send the information to report the age of its users, no way of forcing its user base to comply and no single person or entity to fine, arrest or otherwise force into compliance.

    They made a law they cannot enforce.

    • hector@lemmy.today
      link
      fedilink
      English
      arrow-up
      12
      arrow-down
      1
      ·
      1 month ago

      Which is why we all should aspire to join linux, and reject newsome and other greasy california politicians cynically playing us for the billionaires.

    • dev_null@lemmy.ml
      link
      fedilink
      English
      arrow-up
      12
      arrow-down
      1
      ·
      1 month ago

      How is Linux going to do this? There’s no server for the os to send the information to report the age of its users

      The law doesn’t require sending the data anywhere, so that’s not a problem.

      no way of forcing its user base to comply and no single person or entity to fine, arrest or otherwise force into compliance.

      The law doesn’t require anything of users, it requires something of OS providers. OS providers have addresses and entities to fine.

      • Rivalarrival@lemmy.today
        link
        fedilink
        English
        arrow-up
        7
        ·
        1 month ago

        The law doesn’t require anything of users, it requires something of OS providers.

        For a FOSS OS, any user with root access would be considered an “OS Provider” under the definitions provided in this law. With FOSS, there is no real distinction between “user” and “developer”.

        • dev_null@lemmy.ml
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 month ago

          You are right, it just says whoever “controls the OS”, which is very vague. Even without going to open source, a user still controls the OS even on Windows or macOS. To a lesser degree of course, but in the same way a driver controls a car even if they can’t or won’t try to modify it.

          • Rivalarrival@lemmy.today
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 month ago

            The windows user uses the OS. The windows user does not control the OS. They only have access to the functions that Microsoft has provided. The Attorney General of California won’t be able to argue that the sysadmin is the OS Provider of a Windows installation. The OS Provider of Windows is Microsoft.

            The Attorney General of California would easily be able to argue that the OS Provider of a particular Linux instance is the sysadmin of that instance.

            • dev_null@lemmy.ml
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 month ago

              They only have access to the functions that Microsoft has provided.

              And a user of Ubuntu only has access to the functions that Canonical has provided.

              Unless they have root access and modify the OS. Or they have administrator access on Windows and modify the OS. Which is the case for both by default. I don’t really see the distinction. There is clearly a provider company behind both, and in both cases the user could add this age check functionality by themselves by installing an utility that provides it.

              • Rivalarrival@lemmy.today
                link
                fedilink
                English
                arrow-up
                1
                arrow-down
                1
                ·
                edit-2
                1 month ago

                And a user of Ubuntu only has access to the functions that Canonical has provided.

                That is not at all accurate.

                Administrator access to Windows is not at all comparable to root access on Linux. Windows “root” access is held solely by Microsoft, and granted only to Microsoft employees and contractors. They are the only ones with the capability of changing Microsoft’s binary blobs.

                Canonical doesn’t restrict root access. Everyone who installs Ubuntu has root access by default.

                Suppose Canonical adds this capability to Ubuntu. Suppose I take an Ubuntu install, and remove this capability. Who is the provider of the resulting OS, Canonical, or me? Obviously, I am responsible for the changes; I am obviously the OS Provider in this scenario.

                What I am saying is that I was the OS provider before I made the changes.

                Let’s remember that the law distinguishes between the OS and Applications running on that OS. They require that the signalling apparatus be included in the OS. Technologically, the distinction between OS and Application is somewhat arbitrary. For commercial OSes, it’s pretty simple: The OS is what Microsoft declares to be part of “Windows” is the OS; everything else is an application.

                Suppose Microsoft refuses to include this signaling apparatus. The end user cannot modify Windows, so does not become liable as the “OS Provider”. The user can bolt on the functionality as an application, but cannot make it part of the OS. Microsoft is the one facing the fines under this law.

                For FOSS software, the end user’s root access gives them the ability to add this signaling capability to the OS running on their machines, even if Canonical refuses to distribute a compliant OS. The user’s ability to make their own OS compliant with California law makes them the party liable for non-compliance.

                • dev_null@lemmy.ml
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  edit-2
                  1 month ago

                  What does the comparability of root/admin access change in this situation?

                  Suppose Microsoft adds this capability to Windows, and you edit the registry to disable it. How is that any different?

                  I can see the argument for something like iOS. But on Windows you would be able to add or remove such functionality. What is the difference that makes the user the OS Provider on Ubuntu but not on Windows, in your eyes?

                  Let’s say you own a computer store in California, you sell Windows laptops, and you setup your preinstalled Windows image with the registry edit made, because customers don’t like the silly age prompt. How are you not the OS Provider?

      • Digit@lemmy.wtf
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 month ago

        No addresses or entities tied to the distro respins I’ve made.

        That was not a requirement in the software license.

        • dev_null@lemmy.ml
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 month ago

          Great, but how does that help? 99.9% Linux users use a Linux distro that has, ay the very least, a website behind it, with a domain name, that has a registration info.

          That the 0.01% of people that use an OS only hosted by anonymous devs on a Russian website does not make this law any better for the rest of us.

      • BartyDeCanter@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 month ago

        Yes it fucking does. Go read the bill, particularly section 1798.501.b, 1798.502.a and b. Every developer of every application that can be downloaded from every package system MUST request your age bracket every time it is downloaded. And possibly every time it is launched. Basic utilities like ‘ls’ and ‘cat’, that pong example I pushed as a test, everything.

        • dev_null@lemmy.ml
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 month ago

          Me: It doesn’t require anything of users

          You: Yes it does require something of developers

          ??

          You are correct, but how does that disagree with my comment?

          • BartyDeCanter@lemmy.sdf.org
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 month ago

            Sorry, I see that I was unclear.

            Yes it fucking does require sending the data somewhere, specifically to every “application store”, which by their definition includes such things as Github, PyPI, Crates.io, Debian mirrors, apt/rpm repos, and personal websites that have hobby projects from more than one person.

            • dev_null@lemmy.ml
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 month ago

              Can you quote the relevant part of the bill? I don’t see it. From what I’m reading:

              • The OS provider has to collect the age information from the user
              • The OS provider has to make the age information available to any app that asks for it
              • The developer of any app has to request the age information from either the OS or from an Application Store

              There is nothing about how the Application Store obtains the age information (presumably they mean something like Google Play or the App Store that already have the information about users and of course haven’t considered anything else), and there is nothing about the OS sending the age anywhere other than an app running on it that asks for it.

    • Digit@lemmy.wtf
      link
      fedilink
      English
      arrow-up
      10
      ·
      1 month ago

      Or they made a law to attempt to ban operating systems with free software licenses.

      • mechoman444@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 month ago

        But that’s the thing you can’t ban them.

        It’s just software that’s freely available. There’s no one corporate entity that controls Linux. Anybody can literally make a distro for it make notation for it illegal for California and be done with it.

        • BartyDeCanter@lemmy.sdf.org
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 month ago

          But they can fine every single developer of every single application. Sure, a lot of people won’t be in the jurisdiction of the state of California, but there are a hell of a lot of developers who are.

          • mechoman444@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            1 month ago

            Linux is not a company. There is no CEO of Linux sitting in Sacramento waiting for instructions. It is a decentralized, global, open source ecosystem. If one U.S.-based distro tried to bolt on age verification, someone would fork it almost immediately and strip it out. You cannot age gate software that people can freely download, modify, compile, and redistribute.

            From a technical standpoint, what would this even look like? Government ID verification at the kernel level? A biometric scan before you can run apt update? A centralized identity server for Arch users? That runs directly against how Linux is designed. The ecosystem prioritizes privacy, user control, and minimal centralized telemetry. Age verification requires centralized identity services, persistent user binding, and logging. Those models do not align. Even if someone tried, it would be trivial to bypass. VPN, foreign mirror, alternative distro. Done. You cannot meaningfully regulate something that is globally mirrored and open source.

            And this law is aimed at online services and platforms anyway. The harms legislators are worried about do not originate in your bootloader. They happen on social media platforms and content services. The operating system is simply the wrong choke point.

            The only places where age verification is realistically enforceable are platforms, app stores, and tightly controlled commercial device ecosystems. Not a globally distributed kernel maintained by volunteers across multiple jurisdictions. The idea that Linux is going to meaningfully comply in a way that changes outcomes is technologically naive. At best you get some compliance language from U.S. commercial vendors. At worst you get symbolic features that any moderately technical user can remove in minutes.

            That is not how open systems work. Pretending otherwise just advertises a lack of understanding of the architecture being regulated.

            • BartyDeCanter@lemmy.sdf.org
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 month ago

              I am fully aware of the open source ecosystem. I have contributed to dozens of projects, including the linux kernel, CPython, Perl, and others.

              It’s astonishingly obvious that you haven’t bothered to read the bill at all and are just spewing nonsense. Take ten minutes and then pull your head out of your ass.

              Sections 1798.501.b, 1798.502.a and b. Every developer of every application that can be downloaded from every website, platform and package system MUST request your age bracket every time it is downloaded. And every time it is launched.

              Thats every application, from ‘ls’ to World of Warcraft. Thats every place on the internet that hosts software packages. It doesn’t matter if you feel like it is only aimed at “online services and platforms “ or “social media platforms and content services”.

              It is written to cover everything that runs on a computer that can be downloaded and the places that host them. PyPI, crates.io, flathub, Debian mirrors, everything.

              And that’s every individual developer who lives in or visits CA.

              • mechoman444@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 month ago

                You’re invoking contributions to the Linux kernel, CPython, and Perl as if that settles the matter, but you have been conspicuously vague about what that actually means. Those projects accept everything from typo fixes to deep subsystem work. If you want that credential to carry argumentative weight, specify what you worked on. Kernel networking stack? Filesystems? A CPython PEP? Core interpreter changes? Because right now it reads like résumé seasoning, not authority.

                More importantly, your statutory interpretation is maximalist to the point of implausibility.

                You are asserting that Sections 1798.501(b) and 1798.502(a)-(b) require every application binary, including local utilities like ls, to request an age bracket at download and at launch. That is an extraordinary claim. If true, it would not just affect “platforms.” It would upend global software distribution infrastructure including mirrors, package repositories, container registries, and academic hosts.

                Where in the definitions does the statute eliminate business thresholds? Where does it explicitly define a standalone executable with no network component as a regulated “online service”?

                Where does it impose a per-launch runtime obligation on locally executed software?

                Statutory scope hinges on defined terms. If you are correct, quote the operative definitions that extend coverage to every distributed binary and every individual developer who merely visits California. Because that is not a narrow reading. That is a reading that would trigger immediate Commerce Clause litigation.

                You may very well have contributed to major opens source projects. That does not make your legal interpretation automatically sound. Right now you are asserting universal coverage without walking through the definitional cross-references that would be required to sustain that position.

                If the text truly says what you claim, show the definitional chain. Otherwise this looks less like careful statutory analysis and more like an overextended reading fueled by frustration.

                • BartyDeCanter@lemmy.sdf.org
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  edit-2
                  1 month ago

                  From TFB:

                  First, from the LEGISLATIVE COUNSEL’S DIGEST

                  The bill would require a developer to request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched. This bill would punish noncompliance with a civil penalty to be enforced by the Attorney General, as prescribed.

                  That’s not an encouraging start. Of course, that’s not the bill itself just the official summary, so we will need to dig in deeper.

                  At the beginning of the bill proper, there are some definitions, emphasis mine.

                  Section 1798.500

                  © “Application” means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device that can access a covered application store or download an application.

                  There are no business threshold or network capability requirements for the application (though there is one for the computer, sorta). It’s simply anything that may run on a computer. ‘ls’ definitely qualifies as an application per this definition. This is a pretty reasonable definition of ‘application’, even if it is a bit circular. We could also have quite a conversation about what counts as a “other general purpose computing device”, but it isn’t defined here.

                  (e) (1) “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing that can access a covered application store or can download an application. (2) “Covered application store” does not mean an online service or platform that distributes extensions, plug-ins, add-ons, or other software applications that run exclusively within a separate host application.

                  PyPI, a Debian mirror, crates.io and GitHub qualify as a “covered application store”. Pip and cargo are an “software application” that “distributes and facilitates the download of applications from third-party developers to users of a computer” so they are as well. Depending on case law curl, rsync and scp might also, though the ‘distributes’ qualifier may exempt them. Oddly, browser add-ons are probably exempt due to (e)(2). And there may be a grey area around things like VMs. A purely personal website that only has software developed by that person probably doesn’t qualify due to the ‘third-party’ qualifier. Again, there is no business threshold listed.

                  (f) “Developer” means a person that owns, maintains, or controls an application.

                  Again, a fairly straightforward definition, that would apply to anyone who maintains any “software application that may be run or directed by a user on a computer, a mobile device” per 1798.500.c.

                  So, we’ve got that developer is a simple definition that basically matches what one would expect, as does application. Covered application store is probably broader than one would expect, and has an odd carve out, but covers most modern software distribution channels. I guess it might not cover sending CDs in the mail.

                  Then we get to a single simple sentence:

                  Section 1798.501

                  (b) (1) A developer shall request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.

                  It’s a really simple sentence that can be really easy to gloss over. But read it again. Maybe you could argue that it only applies the first time an application is run. But it absolutely applies when it is downloaded. There are no exceptions listed, no threshold tests, no “social media applications only”. This applies to all applications, all developers, and all “covered application stores”. Now CA jurisdiction doesn’t cover downloads from outside of CA, but it does cover anyone downloading something inside of CA, or someone living in CA. So if a kid in CA downloads something from a outside of CA, the developer is in violation even if they are outside of CA. CA may not have the resources or desire to track down every developer outside of the state, but if they so choose they would be able to file a claim in the same way that CA can file claims on foreign people who violate other laws that involve CA victims, such as fraud.

                  Finally, there is this bit: 1798.504

                  (f) This title does not apply to any of the following: (3) The delivery or use of a physical product.

                  So, it looks like it doesn’t apply to CDs in the mail.

                  Edit:

                  Of course, I forgot to talk about the penalty. Maybe there is something in there?

                  1798.503

                  (a) A person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) per affected child for each negligent violation or not more than seven thousand five hundred dollars ($7,500) per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought in the name of the people of the State of California by the Attorney General.

                  Nope, no exceptions or commercial clauses. It just applies to anyone. And paragraph b?

                  (b) An operating system provider or a covered application store that makes a good faith effort to comply with this title, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal indicating a user’s age range or any conduct by a developer that receives a signal indicating a user’s age range.

                  Well, an OS provider or covered application store isn’t responsible for someone lying to them, tech failures, or the actions of a rogue developer. But developers have no such waiver.

    • Spesknight@lemmy.world
      link
      fedilink
      English
      arrow-up
      11
      arrow-down
      2
      ·
      1 month ago

      What if banning Linux is part of the Agenda? And what will they do for the servers? I am declaring my pc a server as of right now…

      • yabbadabaddon@lemmy.zip
        link
        fedilink
        English
        arrow-up
        12
        ·
        1 month ago

        How do you want to do this? Linux is a kernel the world relies on. It powers your car, your fridge, your satellite, your phone, the entire Internet, the army, etc. Nothing comes close to Linux in market share. The distros are built upon the kernel. System76 may have to comply, but the other maintainers don’t give a flying fuck. They could even write a small line somewhere on their repo that says “this distro is not allowed in California” and call it a day.

        • Digit@lemmy.wtf
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 month ago

          I wonder if that “this distro is not allowed in California” approach is even compatible with the various free software licenses.

          • lambalicious@lemmy.sdf.org
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            1 month ago

            Terms of Use / Terms of Service are different from Licenses. That said, even if it was compatible that would be a good thing, as the impression I’ve got is that the “hard-liner” Free Software licenses are becoming a thing of the past now that what is needed is “Ethical Source” licenses, that eg.: restrict usage in AI.

    • Liketearsinrain@lemmy.ml
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 month ago

      From what I understood, it’s a requirement for a local API (for apps to use) and could be implemented during user creation.

      It will be a slippery slope and IANAL, just my interpretation.

  • StrawberryPigtails@lemmy.sdf.org
    link
    fedilink
    English
    arrow-up
    60
    ·
    1 month ago

    Enforcement against Linux distributions, however, is likely to be problematic. Distros like Arch, Ubuntu, Debian, and Gentoo have no centralized account infrastructure, with users downloading ISOs from mirrors worldwide, and can modify source code freely. These small distros lack legal teams or resources to implement the required API, so a more realistic outcome for non-compliant distros is a disclaimer that the software is not intended for use in California.

    • cmnybo@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      36
      ·
      1 month ago

      That’s what MidnightBSD did.

      California residents are not authorized to use MidnightBSD for desktop use in the state of California effective January 1, 2027. California law CA AB1043 requires a complex age verification system implemented for operating systems with no exceptions for small open source projects. At this time, we don’t have development time or a plan in place for this.

    • vacuumflower@lemmy.sdf.org
      link
      fedilink
      English
      arrow-up
      14
      ·
      1 month ago

      They, eh, want for every local user account to be tied to some central database?

      In general this is going out of hand, age verification is parents’ responsibility.

  • GreenShimada@lemmy.world
    link
    fedilink
    English
    arrow-up
    58
    arrow-down
    1
    ·
    1 month ago

    For everyone trying to figure out how this would be enforced, it’s not about being proactively enforced. (and data collection is 99% of it)

    It’s about adding a double-tap “Well, these people also violated our age verification law, so they have to pay a fine,” added to any incident where it’s convenient to add this in. If a minor sends another minor a snap that would trigger CP laws, and one of the phones isn’t age verified correctly, fine to the parents and hands up in the air “We tried!” A minor is involved in torrenting movies? “Look, kids using illegal OS! Fine to the parents!”

    This is how laws work across a lot of corrupt developing countries. There’s laws for everything, but they only get applied selectively as authorities find they fit the situation. It’s hard to actually be 100% above board and do everything legally because of a few little things meant to be impossible to actually do bureaucratically. So in every situation, any set of authorities start in with the endemic leverage of “Well, we have suspicion of you selling ketamine out of your apartment. Did you do age verification on your laptop? No? Then we can seize that as a crime and see what’s on there. OR you can give up your supplier.”

  • Noxy@pawb.social
    link
    fedilink
    English
    arrow-up
    54
    ·
    1 month ago

    Despite signing it, Newsom issued a statement urging the legislature to amend the law before its effective date, citing concerns from streaming services and game developers about “complexities such as multi-user accounts shared by a family member and user profiles utilized across multiple devices.”

    then why did you fucking sign it in the first place??

    words cannot describe the depths of my seething hatred for the complete, museum grade, massive piece of shit that is Gavin Newsom

    • BranBucket@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      1
      ·
      1 month ago

      Because it’s a metric, a bullet point, and campaign speech fodder. Newsome thinks of his position in terms of a career rather than an office, his job isn’t to lead a nation towards what’s right or wrong, it’s to pander so that he can be re-elected or elected to higher office.

      The bullshit way that lobbying groups conduct polling and market research means they he’s chronically out of touch and that his focus is on perpetuating his time in office so he can continue to “represent the people”, making a calling out of bowing to the desires of the mis-informed, outraged, panicked mob he believes his electorate to be instead of actually having a spine and exercising good judgement.

      The consequences of shoddy legislation take second place to being able to declare he did something to “keep kids safe”. It doesn’t even have to work, all that matters is having something to wave around and back up that claim. Something to placate the plebeians and let him continue to do what he does best… listen to lobbyists who are lying about what people think.

      Why? Because that’s what gets people elected these days. Despite being on a foundation of pure bullshit, somehow it works. So he goes along with it, encourages it, and remains in office as a result.

    • zarkanian@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 month ago

      People already hate him this much, and he wants to run for president. Because Democrats didn’t lose badly enough last time.

  • wuffah@lemmy.world
    link
    fedilink
    English
    arrow-up
    43
    ·
    1 month ago

    The law does not require photo ID uploads or facial recognition, with users instead simply self-reporting their age, setting AB 1043 apart from similar laws passed in Texas and Utah that require “commercially reasonable” verification methods, such as government-issued ID checks.

    What even is the point of this then? To make shitty parents feel better?

      • bridgeenjoyer@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 month ago

        IRL Community is dead in america, They know the only thing we have left to band together on against their Nazi regime is the internet. This is why they are trying to destroy anonymity.

        Soon it will be “Linux is for criminals” (like they said with graphene).

    • Archr@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 month ago

      The point of it is actually the exact opposite. With this law the parent would set the age of their child. And if they decide to lie and their child is affected then they could be fined.

      The other thing it does is if a platform decides to ignore the age range of a user and it affects a child then they could be fined. But as long as they do best effort then it really only affects the parents.

      It also prevent platforms from requesting additional ID verification unless they have confidence that the age bracket of that user is incorrect.

      • Virtvirt588@lemmy.world
        link
        fedilink
        English
        arrow-up
        8
        ·
        1 month ago

        There is absolutely no reason for an OS to know a users age. At this point it is certain that they can escalate this into including gender or even race.

        The children or even the teens have no meaning in this law - they are simply used as sugarcoating for the cyanide pill that’s aimed at the populace.

        • Archr@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          2
          ·
          1 month ago

          I agree until this law there was no reason for my os to know my age. This law creates that reason.

          Any law can be bad if we take into account the imagined future possibilities. Should we outlaw electricity because it might be used in some way to make nukes?

          If lawmakers try to issue further requirements for ID or facial scans then we can fight that. But until then there is nothing in this law that affects me outside of needing to enter a number less than 2005 when I setup my OS.

          If you don’t have any kids then you literally can’t be fined under this law.

          • Rivalarrival@lemmy.today
            link
            fedilink
            English
            arrow-up
            4
            ·
            1 month ago

            If your code is installed on a general purpose computing device that is provided to a child, you can be fined.

            If you provide code to the general public without requesting an age signal from the receiver’s OS, you can be fined.

            The attorney general of California might consider the JavaScript in your web page to be “content”. They might consider it to be an “application”. There is no clear distinction. If you request an age signal before providing content, you can be fined. If you fail to request an age signal before providing an application, you can be fined.

            The more I read about this law, the less I think it will actually go into effect. It’s going to face a whole series of injunctions. The lawyers are going to bill thousands of hours, but the whole thing is going to be scrapped.

          • zarkanian@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 month ago

            Should we outlaw electricity because it might be used in some way to make nukes?

            No, because there are lots of good uses for electricity. What is the good use of this bill?

            • Archr@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 month ago

              It prevents apps from asking for additional ID verification. I’d rather my os ask me for a number I am able to lie about than to have to send my ID to 30 different apps and data aggregators.

              Many people say that we should put more responsibility on the parents for what their kids are allowed to do online. This law does that.

              • BartyDeCanter@lemmy.sdf.org
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 month ago

                But it actually does require that. Read section 1798.502.b. Every developer of every application has to ask for your age bracket through this mechanism. The open source developers behind ‘ls’, ‘cp’, ‘rsync’ are all suddenly required to ask my age category of face a $2500-$7500 fine per time my kids run apt upgrade. That is utterly absurd.

                Hell, I’m suddenly liable if a kid downloads my pong example project that I put up on crates.io or PyPI?!?

                • Archr@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  1 month ago

                  Yea they have to ask for your age bracket. That’s not the same as an ID.

                  I agree, the definition of an application is much too broad. And should be revised. But the difficulty is how do you restrict it without also creating a multitude of loopholes for businesses to exploit. At the very least we should restrict it to applications whose primary purpose is to interact with the internet.

                  And before you say it, yes I am aware that that still leaves many apps like curl, wget, ssh being covered. But it could be a start.

                  Or maybe just restrict it to social media applications. I am not a lawyer, I definitely don’t have a great grasp of how to create the type of language that is appropriate for laws.

      • Adalast@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 month ago

        The ONLY way this is even remotely OK is if the OS is set to 18+ all other age verification laws are satisfied and I don’t have to provide even more intrusive information to random companies.

  • baller_w@lemmy.zip
    link
    fedilink
    English
    arrow-up
    41
    arrow-down
    1
    ·
    1 month ago

    The law does not require photo ID uploadsor facial recognition, with users instead simply self-reporting their age, setting AB 1043 apart from similar laws passed in Texas and Utah that require “commercially reasonable” verification methods, such as government-issued ID checks.

    Seems toothless. Good.

      • scbasteve@lemmy.world
        link
        fedilink
        English
        arrow-up
        11
        ·
        1 month ago

        Feels more like they see the direction tides are turning and they want to get ahead of it. They implement the laziest and easiest to work around age verification, and then if down the line age verification is required on a federal level, California can say they already did it.

    • Lucidlethargy@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      11
      arrow-down
      1
      ·
      1 month ago

      I had to scroll way, way too far for this sensible comment.

      I like Lemmy, but people panic and jump to conclusions often.

      • themurphy@lemmy.ml
        link
        fedilink
        English
        arrow-up
        10
        arrow-down
        2
        ·
        1 month ago

        Which proves we are no better than reddit users. We are just more privacy minded, but still dumb fucks with a keyboard.