Age verification on Systemd and Flatpak • Hacker News Board

Re: Age verification on Systemd and Flatpak

#81

Post by packetlost » Sat, Apr 04, 2026, 3:38 AM UTC

txrx0000 wrote: post #69

uyzstvqs wrote: post #51

People need to understand the difference between age indication and age verification . Two very different things. Age indication is a completely private and realistically as-effective alternative to the invasive age verification . Age _indication_ means that when you set up your device or create a user account, you enter a date of birth for the user. The OS then provides a native API to return a user's age bracket (n…

There are two things very very wrong with the California law, which you call "age indication". 1) The parental responsibility is given to the wrong people. You're basically being forced by law to give all apps and websites your child's age on request, and then trusting those online platforms to serve the right content (lol). It should be the other way around. The apps and websites should broadcast the age rating of t…

1. I don’t see how that’s better in any real way. You can infer the exact same information as querying the range and it makes dynamic behavior based on age range (ex. access to age restricted chat rooms as an obvious example) completely impossible.

2. Is it meaningfully more identifying than User-Agent? There’s dozens of other datapoints for uniquely identifying a user. If we get a few high profile lawsuits because advertising companies knowingly showed harmful ads to children, I’d consider it a win. Age is not that interesting of a data point.

Re: Age verification on Systemd and Flatpak

#82

Post by mtndew4brkfst » Sat, Apr 04, 2026, 3:41 AM UTC

lschueller wrote: post #2

Quite spooky imaging that apple might create by that a fully verified pii database for half of gen z and every coming gen users

Why would it be more spooky if Apple in particular did this vs all the other hardware vendors that ship a pre-installed OS?

Re: Age verification on Systemd and Flatpak

#83

Post by kelnos » Sat, Apr 04, 2026, 3:48 AM UTC

packetlost wrote: post #81

txrx0000 wrote: post #69

Earlier quoted context omitted.

There are two things very very wrong with the California law, which you call "age indication". 1) The parental responsibility is given to the wrong people. You're basically being forced by law to give all apps and websites your child's age on request, and then trusting those online platforms to serve the right content (lol). It should be the other way around. The apps and websites should broadcast the age rating of t…

1. I don’t see how that’s better in any real way. You can infer the exact same information as querying the range and it makes dynamic behavior based on age range (ex. access to age restricted chat rooms as an obvious example) completely impossible. 2. Is it meaningfully more identifying than User-Agent? There’s dozens of other datapoints for uniquely identifying a user. If we get a few high profile lawsuits because a…

> I don’t see how that’s better in any real way.

It's so much better. In the one case, the OS is leaking age information (even if just an age range) to every service it talks to. In the other case, the OS isn't telling anyone anything, and is just responding to the age rating that the app/service advertises.

Re: Age verification on Systemd and Flatpak

#84

Post by throwaway173738 » Sat, Apr 04, 2026, 3:51 AM UTC

packetlost wrote: post #81

txrx0000 wrote: post #69

Earlier quoted context omitted.

There are two things very very wrong with the California law, which you call "age indication". 1) The parental responsibility is given to the wrong people. You're basically being forced by law to give all apps and websites your child's age on request, and then trusting those online platforms to serve the right content (lol). It should be the other way around. The apps and websites should broadcast the age rating of t…

1. I don’t see how that’s better in any real way. You can infer the exact same information as querying the range and it makes dynamic behavior based on age range (ex. access to age restricted chat rooms as an obvious example) completely impossible. 2. Is it meaningfully more identifying than User-Agent? There’s dozens of other datapoints for uniquely identifying a user. If we get a few high profile lawsuits because a…

I wouldn’t focus on whether it’s “identifying” but whether it’s revealing. Young teenagers are a very high-value target for advertisers. They are very impressionable, and they provide a proxy for advertisers for their parents’ money. So this law essentially makes it mandatory to share that information with advertisers. And also by proxy, predators.

Re: Age verification on Systemd and Flatpak

#85

Post by kelnos » Sat, Apr 04, 2026, 3:52 AM UTC

txrx0000 wrote: post #78

ekr____ wrote: post #75

Earlier quoted context omitted.

> 1) The parental responsibility is given to the wrong people. You're basically being forced by law to give all apps and websites your child's age on request, and then trusting those online platforms to serve the right content (lol). It should be the other way around. The apps and websites should broadcast the age rating of their content, and the OS fetches that age rating, and decides whether the content is appropri…

Thanks for the clarification. Regarding what to do with algorithmic feeds, instead of forcing platforms like Facebook to be less evil, we should give parents the ability to simply uninstall Facebook, and prevent it from being installed by the child. We could implement a password lock for app installation/updates at the OS-level that can be enabled in the phone's settings, that works like Linux's sudo. Every time you…

> instead of forcing platforms like Facebook to be less evil, we should give parents the ability to simply uninstall Facebook, and prevent it from being installed by the child.

Isn't that how parental controls already work?

There are problems, though:

1. The kids want to use Facebook. If parent A refuses to let their kid use Facebook, then kids B, C, D, E, F... all use Facebook and kid A becomes a social outcast. This actually happens. (Well, now it's other apps; kids don't use Facebook anymore.) This is similar to the mobile-phones-in-schools problem: if a parent doesn't let their kid bring a phone to school, and all the other parents do, that creates social isolation. When the school district bans the phones, it solves the problem for everyone. (So it's a collective action problem, really.)

2. Web browsers. Unless the parent is going to uninstall and disallow web browser use, the kid can still sign into whatever service they want using the web browser. I don't think parental controls block specific sites, and even if they do, there are ways around that, certainly.

I am very often the person who says that parents should actually parent their kids and not rely on the government to nanny them. But in this case I think there actually is value to the government making laws that make Facebook (etc.) less evil. And as a bonus, maybe they'll be forced to be less evil to adults too!

Re: Age verification on Systemd and Flatpak

#86

Post by kelnos » Sat, Apr 04, 2026, 3:56 AM UTC

Ferret7446 wrote: post #72

txrx0000 wrote: post #69

Earlier quoted context omitted.

There are two things very very wrong with the California law, which you call "age indication". 1) The parental responsibility is given to the wrong people. You're basically being forced by law to give all apps and websites your child's age on request, and then trusting those online platforms to serve the right content (lol). It should be the other way around. The apps and websites should broadcast the age rating of t…

> The apps and websites should broadcast the age rating of their content, and the OS fetches that age rating, and decides whether the content is appropriate by comparing the age rating to the user's age. How would you make that happen? Many websites would not be subject to your jurisdiction.

So? The same problem exists for having the OS broadcast the user's age range to all apps/services/websites: the service outside your jurisdiction doesn't have to actually restrict content based on age.

At least with the reverse system (services broadcast an age rating), you have some nice properties:

1. You can set it up so that if the service doesn't broadcast an age rating, access is denied.

2. You aren't leaking age information (even if it's just a range) to random websites outside your jurisdiction.

Re: Age verification on Systemd and Flatpak

#87

Post by petre » Sat, Apr 04, 2026, 4:00 AM UTC

This is stupid. The age should be in the passwd gecos field or somewhere else in the user's config directory. Not in systemd. Unix-ike systems are multiuser. Now I wonder what age to put in the root, adm or games accounts.

Re: Age verification on Systemd and Flatpak

#88

Post by packetlost » Sat, Apr 04, 2026, 4:01 AM UTC

kelnos wrote: post #83

packetlost wrote: post #81

Earlier quoted context omitted.

1. I don’t see how that’s better in any real way. You can infer the exact same information as querying the range and it makes dynamic behavior based on age range (ex. access to age restricted chat rooms as an obvious example) completely impossible. 2. Is it meaningfully more identifying than User-Agent? There’s dozens of other datapoints for uniquely identifying a user. If we get a few high profile lawsuits because a…

> I don’t see how that’s better in any real way. It's so much better. In the one case, the OS is leaking age information (even if just an age range) to every service it talks to. In the other case, the OS isn't telling anyone anything, and is just responding to the age rating that the app/service advertises.

That response reveals exactly the same information.

Re: Age verification on Systemd and Flatpak

#89

Post by packetlost » Sat, Apr 04, 2026, 4:06 AM UTC

throwaway173738 wrote: post #84

packetlost wrote: post #81

Earlier quoted context omitted.

1. I don’t see how that’s better in any real way. You can infer the exact same information as querying the range and it makes dynamic behavior based on age range (ex. access to age restricted chat rooms as an obvious example) completely impossible. 2. Is it meaningfully more identifying than User-Agent? There’s dozens of other datapoints for uniquely identifying a user. If we get a few high profile lawsuits because a…

I wouldn’t focus on whether it’s “identifying” but whether it’s revealing. Young teenagers are a very high-value target for advertisers. They are very impressionable, and they provide a proxy for advertisers for their parents’ money. So this law essentially makes it mandatory to share that information with advertisers. And also by proxy, predators.

It also makes it explicitly illegal to do use it for such purposes. While I agree on the point, I think in practice it changes little. I also think it could be a net positive, because now there’s no plausible deniability about the targets age, opening up a decent amount of liability for exploitative practices targeting children specifically.

Re: Age verification on Systemd and Flatpak

#90

Post by txrx0000 » Sat, Apr 04, 2026, 4:16 AM UTC

packetlost wrote: post #81

txrx0000 wrote: post #69

Earlier quoted context omitted.

There are two things very very wrong with the California law, which you call "age indication". 1) The parental responsibility is given to the wrong people. You're basically being forced by law to give all apps and websites your child's age on request, and then trusting those online platforms to serve the right content (lol). It should be the other way around. The apps and websites should broadcast the age rating of t…

1. I don’t see how that’s better in any real way. You can infer the exact same information as querying the range and it makes dynamic behavior based on age range (ex. access to age restricted chat rooms as an obvious example) completely impossible. 2. Is it meaningfully more identifying than User-Agent? There’s dozens of other datapoints for uniquely identifying a user. If we get a few high profile lawsuits because a…

1. Depends on how it's implemented. It won't identify you to individual platforms if the OS filters on a per-app or per-website basis. And yeah, there would be no dynamic behavior based on age, as that would enable tracking based on age. I don't think any kind of API is the ideal solution though, it's just better than the malicious one being mandated in the Cali bill. Instead of an API, it's simpler and more effective to just have an app installation lock (like sudo on Linux) and a firewall for website blocking with a nice UI in the phone's settings, locked behind a password/pin.

2. Other data points like User-Agent are not required by law, and browsers already spoof user agent by default. I agree that there are other data points we need to address, but the problem in this specific case is the slippery slope of legally-mandated data points. And I don't think winning high profile lawsuits is a real "win", it just exposes problem which we already know in this case. Keep in mind those people can get away with the Epstein files.