System76 on Age Verification Laws

I'm surprised zero-knowledge proofs have not been mentioned. This is a technique where (for example) the government signs your digital license, then you can present a proof that you are over 18 to a site without revealing anything else about yourself. ZKPassport exists, Privacy Pass is an implementation being standardized by the IETF, and Google is working on a similar implementation. Granted, these are not yet widely used, but I'd be very interested in hearing HN's thoughts on this.

Let's try to figure out what a good policy solution looks like:

- entities with harmful or adult content must require proof of the user being over 18

- entities cannot ask for, store, or process more detailed information without explicit business needs (this should be phrased in a way that disallows Instagram from asking for your birth year, for example)

- entities cannot share this data with other sites, to avoid privacy leaks, unless there is an explicit business need (this is tricky to get right; someone might try to set up a centralized non-anonymous age-verification service, erasing many benefits)

- entities must in general not store or process information about the user that is not strictly relevant to their function

- there ought to be different treatment for anonymous users (which ideally these protocols will allow, just submit proof of work plus a ZKP that you are a human and authorized to access the resource) compared to pseudonymous and non-anonymous users, who are more at risk of being censored or tracked.

There's some loopholes here, but if the government can enact good policy on this I personally think it's feasible. Please share your thoughts, if you have a minute to do so.

There's also an interesting political split to note among the opposition here. I see a lot of people vehemently against this, and as far as I can see this is largely for concerns regarding one of 1) privacy abuses, 2) censorship, or 3) restriction of general computing. Still, there is a problem with harmful content and platforms on the web. (Not just for minors, I don't think we should pretend it doesn't harm adults too.) The privacy crowd seems to be distinctly different from the computing-freedom crowd; the most obvious example is in attitudes towards iOS. As I personally generally align more towards what I perceive as the privacy-focused side, I'm very interested in what people more focused on software freedom think about zero-knowledge proofs as a politically workable solution here.

Using a dead human’s likeness in jest is wack. Encouraging and rewarding a young person to perform this twisted act should not be normalized.

—-system76 customer

Remember when it was the parents' responsibility to raise their children?

It's simple. Don't comply. Software engineers, despite not having the same requirement of mechanical engineers, should uphold the ethical obligations of their craft. This law is harmful. Given the requirement of compelled speech, given code has been _proven_ to be such, Do. Not. Comply.

California and Colorado do not get to govern out of state residence, thats interstate commerce and its federal domain, period.

The time is coming where we will unseat legislative traitors who use EU/Old World manipulations in the USA.

An unjust law is no law at all. That is the exception the rule of law requires to remain moral.

Don't see how anyone is gonna make me do anything. Just evade anything like this through various means and opt out of things that reduce your quality of life (by destroying your freedom and making you a slave)

So it’s neither "yes" nor "no", but some kind of philosophical note somewhere in-between a "Pop!_OS 24.04 LTS Released" and "CodeWeavers tests their ARM64 compatibility on System76" that isn’t even linked to noticeable on the main page.

I mean Wikipedia hung some huge banners to raise awareness, the German wiki even had a "blackout" because of "Directive 2019/790", there was something similar on Reddit etc. I don't expect them to leave the US market or anything like that, but also I don’t even know what to say, as if everyone has already resigned.

The "Age verification" is simply an excuse to add tracking on system software. Very soon they are going to do the same to hardware too, I guess, so it is going to be very hard to find hardware that is truly safe from tampering.

And modern hardware is so complex that it is impossible for individuals to build one by their own. We are no longer in the 8-bit/16-bit era. And considering the power of AI -- individuals pretty much mean nothing to the elites.

I have never thought the Dystopian future to be so close -- I always thought it would be X years away. But legislation, the lawyers, are definitely very efficient on this kind of things.

So this has recently also affected Ubuntu.

One developer began a discussion:

https://lists.ubuntu.com/archives/ubuntu-devel/2026-March/04...

Their attempts of a "solution" are quite interesting. One other user suggested that GUI tools ask for the age of the user.

Well ... I have a very strong opinion here. I have been using Linux since over 20 years and I will not ever give any information about my personal data to the computer devices I own and control. So any GUI asking for this specifically would betray me - and I will remove it. (Granted, it is easier to patch out the offending betrayal code and recompile the thing; I do this with KDE where Nate added the pester-donation daemon. Don't complain about this on reddit #kde, he will ban you. KDE needs more money! That's the new KDE. I prefer oldschool KDE but I digress so back to the topic of age "verification").

The whole discussion about age "verification" appears to be to force everyone into giving data to the government. I don't buy for a moment that this is about "protecting children". And, even IF it were, I could not care any less about the government's strategy. Even more so as I am not in the country that decided this in the first place, so why would I be forced to comply with it when it ends up with GUI tools wanting to sniff my information and then give it to others? For similar reasons, one reason I use ublock origin is to give as few information to outside entities when I browse the web (I am not 100% consistent here, because I mostly use ublock origin to re-define the user interface, which includes blocking annoying popups and what not; that is the primary use case, but to lessen the information my browser gives to anyone else, is also a good thing. I fail to see why I would want to surrender my private data, unless there is really no alternative, e. g. online financial transactions.)

I also don't think we should call this age "verification" law. This is very clearly written by a lobbiyst or several lobbyists who want to sniff more data off of people. The very underlying idea here is wrong - I would not accept Linux to become a spy-tool for the government. I am not interested in how a government tries to reason about this betrayal - none of those attempts of "explanation" apply in my case. It is simply not the job of the government to sniff after all people at all times. This would normally require a warrant/reasonable suspicion of a crime. Why would people surrender their rights here? Why is a government sniffing after people suddenly? These are important questions. That law suddenly emerging but not in the last +25 years is super-suspicious.

this is how and adult sounds like in a room full of children.

I admire the attempt to make a logical argument against these laws taken at face value, but I can't help think that's giving them too much credit.

These laws have spread like wildfire around the world with many countries and regions rolling out similar legislation within months of each other, despite the stereotypical lethargy of any and every legislature. That's not the work of some popular uprising of parents clamouring for age verification.

I fear debating the merits of the argument is missing the point; they don't care. They don't care about children, they don't care about the argument, they just want the control.

> They know more than I could have ever dreamed at that age.

This is so true.

It’s simple you can’t go drinking under age, you can’t drive a car under age. And the harm that can come from the internet is well above this so it makes sense to also ask for id. I agree though that it needs a system to protect information. It’s not about the system being always fail safe it’s about the general rule that by default what is happening is not legal to protect and not put the burden on every parent or family.

„But Jonas parents allow him to do that“ in reality Jonas parents should not have a say in this.

I have been saying this all along. You can't prevent kids from getting around restrictions. All you can do is try to help them understand what they find on the other side and what some options are. Age-gating is just a way to push forward a surveillance agenda. The fact thats happening everywhere all at once proves my point.

We should collectively make sure that any PRs trying to land these changes are very well reviewed. We wouldn't want any security holes to slip by. I think a couple dozen rounds of reviews should suffice. I've heard great things about how productive AI can be at generating very thorough code quality assessments. After all, we should only ship it once it's perfect.

To be more direct - if you're in any editorial position where something that smells like this might require your approval, please give it the scrutiny it deserves. That is, the same scrutiny that a malicious actor submitting a PR that introduces a PII-leaking security hole would receive. As an industry we need to civil disobedience the fuck out of this.

So let’s do a little thought experiment. Which of the outcomes is more likely to happen:

1. People somehow, in big enough parts of the world to overcome the “Brussels Effect”, manage to avoid age verification laws getting passed.

2. Laws get passed, but because it was likely to be the case, the tech industry prepared and has an age verification system ready to go that’s “as good as possible” with regards to privacy.

3. Laws get passed, and because the tech industry spent more time fighting it than preparing for it, they’re now forced to implement something suboptimal.

4. Laws get passed, and the tech industry refuses to comply, then more laws get implemented stipulating exactly how the age verification system has to work, and it’s much worse than anything they could’ve come up with had they not been stubborn.

Right now, I think option 1 is so unlikely as to be safe to ignore as an option. And from what dialogue I’m reading, 2 is unlikely as well because some tech bros still think that code can win over laws. I just hope that the stick gets extracted from some of the relevant asses before option 3 turns into option 4.

None of the facts he states are unknown or new to the authors of the mentioned bills.

> The only solution is to educate our children about life with digital abundance.

I stopped reading at this point, as this is utter non-sense. I mean, it's a beautiful idea, but any person with more than two neurones knows that real-life doesn't work like that. We have law enforcement and prisons because, despite our best efforts in education, some people do go off to become criminals due to a number of factors.

I'm not saying that the present number of laws is adequate, but the solution is a different set of laws, not the complete lack of them. The idea of "simply educate children and we'll all be fine" is utterly moronic.

Definitely started exploring at 8/9 writing Perl and CGI

I love Pop!_OS (and Cosmic) but if they start with this bullshit I need to switch to other Linux distributions. Worst case, will build my own...

Aaaaand to throw it all away at the end with "well when the rubber meets the road we'll comply anyway, thanks for inhaling my hot air." Take a damn stand and dare them to sue the hacker known as Linux or whatever.

This just seems like virtue signaling. It's not a plan or proposed actions. Just a puff piece about how great things used to be. Not sure who is making their opinions based on what System76 has to say, but I guess they can now.

remember El Mencho, it should have been a title!

I mean, genuine question, is Linux Mint or MX Linux endangered by this?

Unless I'm missing something, I have zero concern for companies who sell out by complying.

The code was "free as in freedom" when you decided to build your company on it; and while you're not legally obligated to defend that freedom, and I, and hopefully other consumers, find that you are morally obligated to.

I'm in two minds about this. I think that by and large We Have A Problem. And i don't mean a problem with children on the internet. We have a problem with people on the internet. There are so many examples of grown adults who have clearly become addled.

I live in the UK, I work in London. I can go on X and look at what Elon Musk is posting about the UK and as a reasonable person I can quite reasonably say he's gone mental. The algorithm has broken that mans brain. And it's not just him, a whole slew of establishment women lost their absolute minds about the trans issue (and Graham Linehan). Mumsnet became a centre for radicalization. You know and some one who grew up on the internet at quite a sweet spot I'm very comfortable looking at that stuff and going "Oh yeah, you guys are being groomed by these algorithms and you're defenceless to it".

There's a whole load of "How do we protect the children from this", but I don't think there's actually been much a reckoning with how grown adults are getting sucked into this vortex. The algorithms on the internet clearly have some trap doors that just absolutely funnel people into crazy places.

All of which is to say: We have a serious problem that's effecting everyone not just kids, and I think we've got almost no answers for how to tackle it.

The result is this- poorly thought through sweeping laws that aren't solving the problem, and have massive negative side effects. I think Jonathon Haidt has a lot to answer for in funnelling this complex issue affecting everyone into this reactionary "won't someone think of the children!" campaign for banning technology for kids.

Two meta observations about the comments:

1) The issue doesn't matter much. Corporate takeover of the internet caused severe damage, but overrunning social media with LLM generated content is a mortal wound. Roughly the same number of humans will be using social media in 2030 as currently use CB radio. Remember near a fifth of the population was using CB radio at the peak in the late 70s. Its too little, too late, closing the barn door after the horses have left is pointless. Like re-arranging deck chairs on the titanic after it hit the iceberg. Once the advertisers get wise to the scam that nobody is seeing their ads except bots, the problem will kind of fix itself. I think TPTB want to use "protecting kids from social media" as the public face of why social media will crash and burn soon to avoid discussion of how LLMs actually killed it, because authoritarians love LLMs and they're in charge (although seemingly everyone else hates LLMs, so I'm sure this will end well).

2) Most of the anti commentary reads a lot like addict speak IRL. Talk to a drunk about how it would be a great idea not to drink or a carb addict about how they should not eat donuts and you'll get absolutely rage blasted in return for threatening their addiction, which in the case of an addict, is their identity. "Well it would be the end of the world if people (me) were not drunk and other people (projection of me) will do anything to feed their addiction so obviously no effort should be made to limit addictions and it won't work anyway because other people (me) will even drink mouthwash or homebrew their own moonshine to get drunk" etc. Note I'm not completely against the anti's and they make some very good points that should be considered, but raging like an addict after their drug of choice is threatened is a VERY bad look and is not helping their case at all, if anything it strengthens the case against the anti's. What the pro's don't understand is you can't fix an addiction externally, addicts gotta addict and punishing them and making them miserable might help the pro's feel superior or at least thankful they're not addicted, but it never helped no one. Social media is "an ill of society" and should be treated as such including sensible regulation, protection of threatened groups, treatment for the addicts, and some compassion and acceptance of the addicts either returning to the real world or dying in the addicted world.

I think all this shit is silly. If I could manage to figure out how the internet worked at 12, then so can my son. Or well, a bit younger, but it’s fine. He has at least one parent to guide him.

I remember idiot lab staff telling me in early 1990s that I could not install the free version of Mozilla browser on university lab computers....my go to reply was can you effing read the damn TOS.....free was in the very first sentence....

If this stupid bullshit existed in 1982, He is 100% correct, I would have lied to use my Commodore 64 or Sinclair 1000.

As a resident of New York, I am disturbed to see Democrat representatives introduce such horrific bills. I guess I will not be voting Democrat again!

Good words, glad to see more companies taking a principled stance on these important matters. That leading quote is great for sharing with non-technical friends. We have 365d 23h of non-voting time to take direct action to make our world better.

This is the one thing that truly scares me. I've decided I'm not going to verify my age anywhere or use facial recognition apps to login anywhere. And this is a much bigger fear for my job than AI.

At the moment only some countries banning porn, social media and gambling. But how soon will I have to do it for a work app? And will I lose my job then if I refuse?

I don't think the argument that children might bypass parental controls therefore devices should not have parental controls.

>Limiting a child’s ability to explore what they can do with a computer limits their future.

Parents don't want to limit their children from writing software. Saying that limiting minors from accessing porn will limit their future is another argument I doing think many will agree with.

I was enrolled in the united states navy nuclear program at 17. we are just making kids dumb with this bullshit

The prostitutes pushing for this do not deserve words. They deserve ridicule, public humiliation, and worse. The computer is a tool. Whoever would encumber it is an obvious shill for the corporations (google/apple/microsoft) who would like to attach an identity (i.e. tolls and controls) to actions prior generations could do freely and without surcharge. It is a modern-day enclosure movement. Its proponents should be juicily spat upon.

Parents keep saying this is untenable and you guys keep telling them to just parent harder. I think that dismissing their concerns will lead to the most egregious worst of all worlds age verification. Never tell people that their problems aren't real.

The age verification laws are awesome!

I mean... How else would you educate children about computers and evading stupid restrictions?

[dead]

[dead]

tl;dr they don't like them and don't want them in place but will comply

[dead]

I don't really see a problem where there is a standard api (or even syscall!) to rethrieve a persons age bracket and for various apps being able to easily implement it. But please make it fucking optional.

Make it optional and assume an adult otherwise, it's a good idea if it's optional and doesn't have dumb fines, you could have fines for not enforcing it / not using the api [porn sites] that already exists [and it doesn't work since 1 button is not age verification].

I see this as a good way for parents and institutions to set up their phones, school laptops etc and would pretty much solve the large majority of these issues while having a fraction of the invasiveness.