Re: A less-circumventable age verification protocol: good ol' files

On Wednesday, 11 March 2026 at 23:40, Thiago Macieira <[email protected]> wrot=
e:

> On Tuesday, 10 March 2026 19:41:27 Pacific Daylight Time Daniel Tang wrot=
e:
> > Both use D-BUS. I assert that the age verification must not use D-BUS.
> > While the first circumvention might require root, a child could wrap it
> > to not require root. They could just set the DBUS_SYSTEM_BUS_ADDRESS
> > environment variable. Then a Python server could start listening on
> > that file to falsely respond to requests.
>=20
> Opening files isn't proof either, as one can LD_PRELOAD a stub library th=
at
> intercepts opening of certain files and redirects to opening something el=
se.
> And if the whole issue is to provide information to websites, one can pat=
ch
> the browser and recompile, to provide whatever information is desired.
>=20
> To solve all of this, one needs a cryptographically-signed blurb to be
> provided to said websites, which they can then verify authenticity of.
> Moreover, it needs to be resistant to replay attacks, so in turn it must =
be an
> API that signs with a challenge provided by the website in the first plac=
e.
>=20
> This gets technically difficult very quickly. I'd argue it's well past
> reasonableness.
>=20
To take this to the limit of logical reasoning, the only way to comply woul=
d be if the software had been validated by the state to be compliant with t=
heir laws, this could then be signed using a master key, which is then requ=
ired to launch all software in this validated stack of components.
Thus we can attest that no tampering has been done and we can reliably enfo=
rce age limits since no one is capable of tampering with the system.
Since we can't use unreasonable means to assess the age in all jurisdiction=
 like asking for government issued identification, we can instead develop h=
euristics for assessing their likely age demographic off their behaviour an=
d likely location.
Now that we have all this information, we can now 100% ensure that short of=
 hardware tampering, so we should also make that all our hardware devices c=
annot be accessed without permanently bricking them.
At this point I think we've manage to collect more or less every freedom an=
d remove it, and I think it might just be good enough to stop anyone circum=
venting it.
This all happens to sound a lot like a proprietary walled garden with some =
good advertising data to sell at which point we might as well all move to a=
 proprietary platform of your own choice, so you can at least pick who sell=
s your data...

P.S. This is as much satire as it is what is slowly happening in the mobile=
 phone world, the world's most commonly used consumer computer platform.
Gabe
Corporate Code Monkey