Porn restrictions are leading to a VPN boom

Pornography is one of the most powerful forms of control, because you cooperate in your own enslavement. Because of the deranging and darkening effect it has on the mind, you become increasingly less aware of what's actually happening to you, less conscious of the self-destruction you are employing against yourself.

And because it functions this way, it has also been instrumentalized. Sexual "liberation" is political control. Wilhelm Reich essentially wrote the playbook here, though we see plenty of precursors, and in the Enlightenment tradition, Marquis de Sade stands out (though he did not have access to mass media like we do).

As Chesterton observed, such "freedom" is the most transparent of all bribes that slavery can make to rob us of our freedom. Pleasure is far more effective than pain because it conceals the coercive nature of the act. Marcuse saw such things as a conservative force masquerading as "liberation", one intended as a distraction (like bread and circuses) and a way of sapping the attention and energies (and I would add intelligence) of those who partake that could otherwise be used toward criticism. The deranging effect is the worst effect of all, as such, but also because its effects can far outlast the period of consumption.

That people can use VPNs is not a substantive argument against bans or restrictions on pornography.

> Don’t all ISPs have retention notices? Probably not (for the reasons above), but this is not public information, and ISPs and others subject to retention notices face statutory prohibitions on disclosure.

> If all Internet access providers were subject to retention notices, wouldn’t it be easier to say that? There would be no need to dance around issues of secrecy, or explain why the list of notice recipients cannot be published. The fact that the Home Office chooses to take this approach undermines the claim that all providers have notices.

This source appears to be engaging in wishful thinking.

> Good thing these laws specifically ban them from storing that information that they don't want to store.

Well... companies. They don't ban government agencies from retaining that data if they get access to it. But ignore that and assume for a second that they do.

The problem is that the laws kind of contradict themselves: "don't collect information that compromises privacy" and also "do this in a way that basically could only work if you collect information that compromises privacy."

Most of the bills I've read ban companies from saving this data, but require them to collect it presumably in some way that's auditable? They also provide no real mechanisms for guaranteeing that data won't be stored or will be transmitted securely between services. In Louisiana's bill (https://legis.la.gov/legis/ViewDocument.aspx?d=1289498) there is no penalty for retaining data other than that users can sue for "damages". But historically, proving damages from retained data tends to be difficult to do.

Of course the laws do not clarify how age verification is supposed to work under these restrictions, just that documents will be verified somehow: Texas's "example" of age verification explicitly refers to digital identification as information "stored on a digital network" (https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB01181F....). But sure, also make sure you don't store anything! /s

Presumably this all means that the information should be stored and transmitted until identification is done and then immediately deleted leaving no record of that identification other than that it happened (which hopefully will be sufficient evidence if the government ever accuses you of using a faulty verification method). But eventual deletion doesn't mean the information isn't still getting temporarily stored or that it's not passing between multiple hands, any of which could have rogue employees or leaks, or which could be storing "anonymized" data that turns out to later-on be identifiable.

----

One might argue that since the majority of these laws are proposed and backed by anti-porn organizations, the contradictions might kind of be advantageous to the goals of the backers -- if the law is functionally impossible to comply with and companies are forced to leave the state, well... that's exactly what these groups want anyway. Texas's AG is up-front about being pleased that porn companies are blocking the state. And despite the regular claim that this isn't about restricting porn generally, the vast majority of these bills have ties to religiously conservative groups that have public positions that porn should be banned for everyone.

But that's all besides the point: the point is it's just outright false to say that these laws don't require at least the transmission and collection of this data -- they just tack on "don't store it for too long, delete it afterwards." But that doesn't really mean anything: regular identity transmission over the web carries security and privacy risks even if companies could be trusted to reliably delete this data -- which in many cases, they can't. Advocates of these bills ignore that security researchers have an issue with collection and transmission of sensitive data in addition to storage, and so advocates point to narrow, non-specific language about long-term retention as if that solves all of the issues. It doesn't.

And to the extent that these laws include any real teeth like actual fines for data leakage, they don't really explain how companies can safely avoid those fines while still proving that their users aren't minors. It's a no-win situation.

Note as well, I'm leaving off the accusation I've seen online that this identification would need to be provided per-login/access, because I don't see any language in the bills that would suggest that to me. But of course if that were true, there would be obvious security risks from users providing that information repeatedly as part of regular access.

----

> That's a social media law, not a porn law

The law in question explicitly exempts art sharing sites unless they allow specifically porn (https://le.utah.gov/xcode/Title13/Chapter63/C13-63_202305032...):

> (H) a professional creative network for showcasing and discovering artistic content, if the content is required to be non-pornographic;

Notably, general content harmful to minors like gore, hate-speech, etc is included in that exemption. So your creative gallery site doesn't count as social media and isn't subject to these child-restrictions if you allow nazi emblems or violent imagery, it's only a problem if you allow porn.

I will concede on this that conflating the exact language of "change or bypass restrictions on access" is a straightforward misreading of the bill, bad on the article for that. But I think it's being a little coy to act like there's no overlap between Chapter 63 and SB 287. Chapter 63 clearly views pornographic content differently than it views other content that is similarly harmful to minors.

SB 287 includes language that seems (to me) to explicitly protect VPN and network providers from liability, but it is not clear whether that kind of language will continue to appear in future bills: the majority of these bills so far have been largely copy-paste templates of each other, and in other Internet restriction debates states have expressed interest in going after actors that they deem to be "enabling" illegal actions. Notably, the copy-paste template that most states have been using doesn't protect sites that allow VPN access, they just protect the VPNs themselves. It's not clear to me from the text of the bills that states wouldn't view a porn site refusing to block all VPN connections as a violation of the law if they were ever interested in pushing enforcement past state lines (which again, in other Internet speech debates states have expressed interest in pushing enforcement across state lines).

The article's example of VPN restrictions is misleading and misrepresents the bills it's talking about -- but the general concern that VPN restrictions might come in the future (most likely through targeting companies that do not block VPNs from accessing their services) is a real concern, just poorly presented in this article.

> how to set up 1.1.1.1

I just want to mention a few things: Fallback, other DNSs like 1.* and Mullvad's free DNS with more options

    # Standard
    1.1.1.1
    1.0.0.1
    2606:4700:4700::1111
    2606:4700:4700::1001

    # Block Malware 
    1.1.1.2
    1.0.0.2
    2606:4700:4700::1112
    2606:4700:4700::1002
    
    # Block Malware & Adult Content (not useful for this case)
    1.1.1.3
    1.0.0.3
    2606:4700:4700::1113
    2606:4700:4700::1003

You can find cloudflare information here[0], and remember to make sure you setup DNS over DoT (TLS) or DoH (HTTPS). Especially for them they will want to have encrypted DNS.

Mullvad also offers *free* DNS[1], which also supports encrypted DNS

    # DoH is port 443 and DoT is port 853
    # Standard
    dns.mullvad.net
    194.242.2.2
    2a07:e340::2

    # Block Trackers
    adblock.dns.mullvad.net
    194.242.2.3
    2a07:e340::3

    # Block Trackers + Malware
    base.dns.mullvad.net
    194.242.2.4
    2a07:e340::4

Mullvad also has block for Adult + gambling and social media (so there are 6 total configurations). You don't need the Mullvad VPN to use these.

I should also mention, as this frustrated me a bit, that your browser may implement its own DNS and so just setting these in your router (or pihole) may not completely resolve the issue. In Firefox, go to Settings > Privacy & Security > (scroll all the way down) Enable DNS over HTTPS using > then under either "Increased Protection" or "Max Protection" you can set a DNS resolver (or turn it off). They have defaults for Cloudflare (default!) and NextDNS. While you're there, also check your settings at the top of that page about "Enhanced Tracking Protection"

I am *NOT* a network/security person and would greatly appreciate replies to this comment with additional information. Especially about setting up things like piholes, TVs, browsers, encrypted DNS (especially this!), host files, and so on. Technical forum, so let's get technical and learn ^__^

[0] - https://developers.cloudflare.com/1.1.1.1/ip-addresses/ - https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-ht...

[1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls