• 8 Posts
  • 2.91K Comments
Joined 3 年前
cake
Cake day: 2023年7月31日

help-circle
  • No, it is bad.

    Suppose it’s used to verify your age when visiting Pornhub. How is Pornhub going to trust the user’s computer didn’t lie about the user’s age? A “just trust me bro” sent by the browser isn’t going to suffice; teenagers would find a way around that.

    Thr attestation will have to be cryptographically signed by some trusted party—and that’s either going to be the government, or the operating system vendor.

    If it’s the government holding the signing keys: the website can now verify that you’re a resident of $state in $country and use that for fingerprinting and targeted advertising. And what if your country doesn’t participate, or if Pornhub doesn’t trust the signing keys used by the government of Estonia? Tough shit, no porn for you! It would be impractical to manage all those keys, though, so why not instead leave it up to the operating system vendor?

    If it is left the operating system vendor, it’s going to end up being exactly the same as Google Play Service’s SafetyNet “feature”. If you’re not using an approved operating system (a.k.a. Windows, MacOS, stock Android, iOS) you’re not visiting Pornhub. Or a banking app. Or applying for jobs. Etc.

    This bill is a poison pill for device ownership and FOSS operating systems being handed to corporations on a silver platter.


  • I disagree. This is a first step towards something far worse.

    It sets up the infrastructure for getting user ages and allowing services and websites to get an attestation from the operating system. Once that system is widely used and becomes ingrained, they can create a follow-up bill that demands the attestation be cryptographically verifiable by a trusted party.

    In that scenario, the only way the operating system’s promise that you’re not a minor would be trusted is if it was signed by whoever holds the private keys—and that’s definitely not going to be you, the device owner.

    It would either be the government, or more likely, the operating system vendor. In the former case, now services can cryptographically prove that you’re a resident of $state in $country, which is amazing for fingerprinting and terrible for anonymity. In the latter case, you can guarantee that only the corporations will be holding the key (like with Microsoft and secure boot), and you can kiss goodbye to your ability to access services on FOSS operating systems like Linux or custom Android ROMs.

    This proposal is just a way to get their foot in the door with something palatable. If you’ve ever come across banking apps on Android using Google Play Services’ SafetyNet feature to restrict access to only “secure” devices, you’ll know exactly how this turns out: either you use the phone you own the “approved” way with a stock ROM where Google has more permissions than you do, or you’re not doing your banking on your phone.




  • Translation:

    We’re getting rid of r/all. We’re not sorry. Reddit is leaning towards changing your experience to make it more algorithmic and beneficial to advertisers targeting your interests. I know some of you have pretty strong feelings about this and I don’t care! Feel free to leave comments on this post. I will continue to laugh at them with the rest of the team.




  • “Conservatism has exactly one proposition, to wit: there is an in-group group in which the law protects but does not bind, and there is an out-group in which the law binds but does not protect.”

    I’m sure I didn’t quote that properly, but you get the point.

    When viewing reality through the lens of life being zero-sum, if one is not policing others, they are being policed. Add xenophobia and fear of others who are noncomforming and you end up with someone who feels the need to judge everyone around them.





  • If Valve fails, we’ll have so many great alternatives, though!

    • Epic Games Store, with it’s… uh… better fee structure that benefits the publishers.
    • EA’s Origin, with direct access to the exact same Origin website but instead presented through an Electron app.
    • Ubisoft Connect, with the latest access to Ubisoft’s Assassin’s Creed games and related reskins sold under different IP.
    • Battle.net, with the feature to run partially-downloaded games and stream missing assets in on demand.
    • GOG, with real installers for its games that you can hoard to a hard drive sitting in your closet. (No sarcism. This one isn’t terrible)
    • The Microsoft Store, with its incredible ability to revoke your license for the Notepad.exe program that comes installed with Windows.

    Who needs a forum, mod portal, user reviews, or Linux support anyways?