Re: Minimal Implementation AB 1043 (California's Age Verification Bill)

This is a multi-part message in MIME format.
--------------TJJWK2m0FTtvw9XTeoJ6kNhl
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 3/3/26 3:45 PM, Vanida Plamondon wrote:
> You seem to think these kinds of laws are an authoritarianism and/or 
> fascism attack/problem against free software. It is not. It is a 
> capitalism attack/problem against free software.

Definition of capitalism is such that you can privately own resources 
(e.g. a workshop), use those resources to produce something (e.g. a 
chair) and then sell it on a market.

You seem to be confusing the fact that very large corporations sometimes 
tend to abuse their power by kicking off the ladder they themselves used 
to reach the top and work with lawmakers to introduce regulations that 
destroy their potential competition in an attempt to secure their 
position. But that's not capitalism, in fact, I'd argue it's closer to 
feudalism, which preceded capitalism.

> I am proposing that the existing frameworks in free software, 
> specifically *DAC* (Discretionary Access Control), *MAC* (Mandatory 
> Access Control), and *LSM* (Linux Security Modules) be extended so 
> that parents can actually implement security policies to restrict and 
> control what their children can do on their computers. 
Supporting voluntary parental controls is a reasonable approach. 
However, let's first discuss the options that already exist to better 
understand what problems parents would actually face before we start 
designing a technical solution.

This is what a parent may do:

1. Take ownership of the root account.

2. Impose various limits on the child's user account. Purely from the 
system perspective, options are virtually unlimited and the actual 
challenge lies elsewhere (see below).

3. Disable boot from any other media than the internal hard drive and 
set password for the BIOS/UEFI setup.

While not having access to a root account can create various practical 
challenges on most standard distributions, most of these problems could 
actually be solved in various ways. For example, if being able to 
install software from distribution repositories was desirable, a script 
could be provided that would "message" the root user with a request, and 
upon validating that request (e.g. against a blacklist), root could 
install the desired package automatically. And then there are of course 
things such as AppImage, Incus, KVM, qemu, ...

Yes, the user-experience of setting all of this up isn't great. But it's 
not a deeply technical question and certainly not a question of 
standardization. Any distribution could choose to provide pleasant user 
interface for all of this (namely configuring what can/cannot be done). 
And it'd be absurd to expect all distributions to support this: each 
distribution has a different target audience, different philosophy, 
different approach.

I'd argue that the actual real problem is the web browser. You either 
allow web access or you don't, but fine-tuning which websites will or 
will not be accessible is ridiculously difficult. Ratings such as WCR 
are self-imposed, voluntary and I don't imagine very widely adopted (not 
to mention it doesn't provide that fine of a granularity anyway).

However, there's an easy solution: Any parent that thinks this is the 
way to go could start a project, where other parents could contribute, 
and together they could curate a list of websites with whatever ratings 
they please. Then it's simply a matter of doing roughly what I outlined 
above, in combination with blocking access to websites that are deemed 
inappropriate, and it's all solved and done.

Practically speaking, that solves almost everything, of course with the 
exception of proprietary stores such as Steam, but that's not at all for 
FOSS community to discuss. But even such stores could simply add option 
to read some configuration file and apply the restrictions from there 
(e.g. only display selected games, limit interactions with other users, 
and so forth). The file would be read-only and owned by root, so it 
again doesn't require any deeper changes.

In short, I don't think there's anything sensible to do as far as any 
standardization efforts across operating systems go. All the tools are 
already there.

--------------TJJWK2m0FTtvw9XTeoJ6kNhl
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">On 3/3/26 3:45 PM, Vanida Plamondon
      wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAMm9xBz2on3JF7dYs2TxJX1sn9GwZqmvc3j-kWNLxXt9AZzdMQ@mail.gmail.com">You
      seem to think these kinds of laws are an authoritarianism and/or
      fascism attack/problem against free software. It is not. It is a
      capitalism attack/problem against free software.</blockquote>
    <p>Definition of capitalism is such that you can privately own
      resources (e.g. a workshop), use those resources to produce
      something (e.g. a chair) and then sell it on a market.</p>
    <p>You seem to be confusing the fact that very large corporations
      sometimes tend to abuse their power by kicking off the ladder they
      themselves used to reach the top and work with lawmakers to
      introduce regulations that destroy their potential competition in
      an attempt to secure their position. But that's not capitalism, in
      fact, I'd argue it's closer to feudalism, which preceded
      capitalism.</p>
    <p>
      <blockquote type="cite">I am proposing that the existing
        frameworks in free software, specifically <b>DAC</b>
        (Discretionary Access Control), <b>MAC</b> (Mandatory Access
        Control), and <b>LSM</b> (Linux Security Modules) be extended so
        that parents can actually implement security policies to
        restrict and control what their children can do on their
        computers. </blockquote>
      Supporting voluntary parental controls is a reasonable approach.
      However, let's first discuss the options that already exist to
      better understand what problems parents would actually face before
      we start designing a technical solution.</p>
    <p>This is what a parent may do:</p>
    <p>1. Take ownership of the root account.</p>
    <p>2. Impose various limits on the child's user account. Purely from
      the system perspective, options are virtually unlimited and the
      actual challenge lies elsewhere (see below).</p>
    <p>3. Disable boot from any other media than the internal hard drive
      and set password for the BIOS/UEFI setup.</p>
    <p>While not having access to a root account can create various
      practical challenges on most standard distributions, most of these
      problems could actually be solved in various ways. For example, if
      being able to install software from distribution repositories was
      desirable, a script could be provided that would "message" the
      root user with a request, and upon validating that request (e.g.
      against a blacklist), root could install the desired package
      automatically. And then there are of course things such as
      AppImage, Incus, KVM, qemu, ...</p>
    <p>Yes, the user-experience of setting all of this up isn't great.
      But it's not a deeply technical question and certainly not a
      question of standardization. Any distribution could choose to
      provide pleasant user interface for all of this (namely
      configuring what can/cannot be done). And it'd be absurd to expect
      all distributions to support this: each distribution has a
      different target audience, different philosophy, different
      approach.</p>
    <p>I'd argue that the actual real problem is the web browser. You
      either allow web access or you don't, but fine-tuning which
      websites will or will not be accessible is ridiculously difficult.
      Ratings such as WCR are self-imposed, voluntary and I don't
      imagine very widely adopted (not to mention it doesn't provide
      that fine of a granularity anyway).</p>
    <p>However, there's an easy solution: Any parent that thinks this is
      the way to go could start a project, where other parents could
      contribute, and together they could curate a list of websites with
      whatever ratings they please. Then it's simply a matter of doing
      roughly what I outlined above, in combination with blocking access
      to websites that are deemed inappropriate, and it's all solved and
      done.</p>
    <p>Practically speaking, that solves almost everything, of course
      with the exception of proprietary stores such as Steam, but that's
      not at all for FOSS community to discuss. But even such stores
      could simply add option to read some configuration file and apply
      the restrictions from there (e.g. only display selected games,
      limit interactions with other users, and so forth). The file would
      be read-only and owned by root, so it again doesn't require any
      deeper changes.</p>
    <p>In short, I don't think there's anything sensible to do as far as
      any standardization efforts across operating systems go. All the
      tools are already there.</p>
  </body>
</html>

--------------TJJWK2m0FTtvw9XTeoJ6kNhl--