A bit of an aside, but after someone introduced me to the notion of Reversible Decisions, it quickly became apparent to me that the solution to the bikeshed problem is to throw money at it before the roosters can start preening about which color the shed should be.
Decisions that are reversible should just go with the instinctive answer of whoever volunteers to work on it.
I've been in many meeting rooms where, because of the number and caliber of people in the room, we've blown $5000 worth of combined salary arguing about basically nothing. I've been in a few where that number was well over $10k.
If you're going to assign a relatively medium talent engineer to solve a problem, it's cheaper to let them solve it twice, maybe even three times, than it is to try to figure out what the right solution is before touching a keyboard. It helps them grow to give them that autonomy, and more importantly training your team out of reflexively reaching for optimization for every single feature saves gobs of money over time.
The interface for a piece of code matters to everyone. The internal implementation details mostly matter to the bus number on that code. If they're happy with it, that matters a lot. That can be overridden by the consequences of that design, but I've seen a couple cases where the bus number for a module wanted a solution with fewer consequences but the group wisdom wanted something flashier but also more brittle.
+1! I've fallen in love with many of Amazon's in-group concepts, and maybe I'm just drinking the koolaide, but they have the concept of a "two-way door", which is exactly this -- a decision that can be made, unmade, remade, etc relatively cheaply. If you can identify that a choice isn't very dangerous, you can focus on the things that really are instead.
This often massively discounts the cost of reversing decisions. People often work to build things without any thought given to those who have to maintain it afterwards. Especially when it's not them.
I worked at a large, publicly-traded multinational where decades prior and they were still just a 4 man startup they decided the database server and all timestamps should be in the local timezone.
They are still using EST today even when they have global sharding of their customers/databases between US, EU, LATAM, SEA...
--- you're also assuming that the product roadmap will afford your engineers any time to build it the second, third, fourth, etc. time.
There seems to be some general pattern here that you can find pretty often in "dev war stories" contexts:
(1) We're a small startup/new product team/etc, let's just build the MVP and keep everything simple!
(2) Now we're not small anymore and suddenly have all kinds of nonfunctional requirements we never imagined before! But our simple architecture from before is making everything a pain now!
The natural instinct is then to compromise on the "simpleness" of the first prototype and already try to anticipate all the scaling and nonfunctional requirements that might come later - but that rarely seems to work, as you can't really how (and if) the project will grow.
Seems to me, the real question here is why those teams are still using the "MVP" code even after being well inside the "scale up" phase. Shouldn't this be the point where you gradually migrate to a codebase that is more manageable at scale?
When you first introduce the idea you'll find a bunch of people think decisions are Reversible which are not, as you say. And the flip side of Reversible decisions is the Last Responsible Moment, which runs afoul of Hofstadter's Law, and people wait until halfway past the last responsible moment.
The key to reversing a decision is getting over Sunk Cost, to start thinking of some code as scaffolding. Scaffolding allows you to get on to other work and then remove it after, because it's either not needed or the 'real' solution has been installed. People get defensive when you propose to rip out their code. Hey that code made us $250k at a time when we were about to miss payroll. Yes. It did. Thank you for your service. But now it's costing us $30k a month and that shit needs to go.
Getting people to figure out that if a decision is important, making it later is actually the sane thing to do, is a challenge. Because many people's intuition is that we should put energy into this now while it's fresh and we have abundant energy. We can 'solve' it and not have it dangling over our heads. But we don't know the right answer yet. We don't know the strength of our tools or the expertise of our coworkers.
The product roadmap is now and has ever been complete bullshit. Refactoring teaches that you amortize rework across all new stories. That's just how it goes.
(And everything should be in GMT unless you can literally point me to a several hundred page treatise on why another time zone is the correct one. Yeah I've worked west coast places that got bought by NY or Chicago companies and it's a clusterfuck if you both didn't use GMT)
Don't get me wrong, I'm a fan of the idea. I pretty much follow a lot of what you're saying without giving it names. I'm just used to people giving lip service to certain ideas as an excuse to move with less friction in their org and end up doing long-term organizational damage.
Thank you for the added detail.
> The product roadmap is now and has ever been complete bullshit. Refactoring teaches that you amortize rework across all new stories. That's just how it goes.
Also agree, but teams use sprints and "the roadmap" as a way to say no to fixing bottlenecks they've created for other teams and don't want to take the time and effort to resolve.
For those unaware, PHK created (amongst other things) the MD5crypt password hashing algorithm ($1$…). It came before bcrypt (1999), scrypt (2009), SHA2crypt (2016), etc, and was committed in 1994:
To clarify: not MD5 itself. It was created in 1991 by Ron Rivest. (It is my experience that knowledge of these things isn't as widely distributed as one might hope.)
I first came across it in 1995/1996: Wow, what a magical tool for backend web stuff! I used it for everything.
I don't think age restriction will impact FOSS in the long term. If there are some regulations that threaten FOSS now, they are going to be adopted in the long term.
Regulations for age restriction are understandable. A lot of modern technology is harming kids (and I don't mean dirty videos, social media seems to be much more harmful).
A sensible regulator would leave some responsibility to the parents, but require restrictions for consumer devices (smartphones, laptops). Maybe even enable age restrictions by default, block replacing the OS or the firmware, and only allow it once the age was confirmed.
I don't see a point of including all kind of OS or software into this regulation. Just the ones that are preinstalled on consumer devices, and commercially distributed to consumers. Once the age of the user was confirmed, the devices should be able to become as open as we know them now.
I strongly disagree. There are no kids in my household, and no one else ever uses my devices, so the idea that I need to prove that I'm not a kid for me to be able to pay bills or file taxes on a stock device is ridiculous.
"Age restriction" can be implemented where stock devices are completely unrestricted. For example, just with better parental controls and education: children don't have access to property, so the parent takes their device and enables the parental controls, but you own your device so leave them disabled.
And this wouldn't affect Linux or FOSS: on a child's device their parent installs either a proprietary OS or a FOSS with parental controls, but again, on your device you install whatever you want.
That's not what the comment I responded to was proposing:
> Maybe even enable age restrictions by default, block replacing the OS or the firmware, and only allow it once the age was confirmed.
Having an extra hurdle before installing Linux would be an awful secondary effect for this type of regulation independent of whether the check itself is already objectionable (which I always obviously think it is, although obviously plenty of people also don't)
Is anyone proposing age verification to file taxes? I'd hope you already have to provide some sort of stronger proof of identity to file a tax return anyway.
That's exactly my point; websites that already have absolutely no threat from having kids access them are literally unavailable due to the operating system put up a block that isn't necessary due to a hypothetical kid using the device to access an entirely different hypothetical website. The regulation is absurdly overbroad for what it's trying to actual protect against.
> A sensible regulator would leave some responsibility to the parents, but require restrictions for consumer devices (smartphones, laptops). Maybe even enable age restrictions by default, block replacing the OS or the firmware, and only allow it once the age was confirmed.
If you think that this statement is too broad for this thread, I don't understand why you only have issue with my direct response to it. It seems like your issue is with the parent comment I replied to for not being on-topic enough.
I don't understand what's hard to understand. Regulation that affects people and devices that have no risk of being used for the purported thing that's supposed to be protected against is not well-scoped.
Obviously if the government knew that you had no kids, they wouldn't need to check it. How do you propose they find out, without asking you to prove it?
> A sensible regulator would leave some responsibility to the parents
(Speaking as a parent of three) why can't we just leave all responsibility to the parents? In our experience in the offline world it seems this applies!
I speak as someone who's taken each of my three children - for two of them, multiple times - to the emergency room to be treated for broken bones incurred in the course of Real Life[tm].
Yes, they play contact sports.
Yes, we use Family Link with pretty restrictive settings.
Despite the series of broken bones, I'm still in favour of kids playing sports and still dubious about the effect of screen time on young minds...
> (Speaking as a parent of three) why can't we just leave all responsibility to the parents?
Then I'm sure that you appreciate that there are both legal and informal checks in place ensuring that you can take responsibility for your children in the offline world. For example: I would be surprised if your children were able to play organized sports without your permission. Failing to ask for permission would deny you the responsibility of protecting your child as you see fit.
You don't need to show your ID to go into the store and buy something else though, so why would this provide any sort of precedent for "you can't use the internet for literally anything on this device without proving your age"?
In many areas, this is left up to the parents - minors can't buy alcohol at stores, but parents are legally allowed to give alcohol to their children to drink.
I think the distinction the comment is drawing is about the legality of it not the practical feasibility .
It would be illegal under the currently proposed
/implemented laws and also open up social media to liability, which wouldn’t be true for other products like Alcohol or fire arms that require minimum age to buy but not give to children
An analogous good implementation of age restriction is that one must show their ID to buy an unrestricted device if they look too young.
They can't be tracked, as long as the devices are in randomly sorted identical boxes. Of course someone can buy a device and give it to a kid, but that's already possible with alcohol (and legal if it's their kid).
>why can't we just leave all responsibility to the parents?
because we don't live in a 15th century peasant village. The average adult reads at a 7th grade level, 20% of adults are considered functionally illiterate, most adults can't navigate digital spaces, privacy and social media themselves or take on trillion dollar companies.
This also hasn't applied in the offline world since idk, Kant and Hegel, every modern state recognizes that children are persons and citizens in development, not private possessions. If your children have broken bones you can't explain or your parenting is considered to threaten the welfare of your child you can be pretty sure you'll have the authorities at your door quickly, and countries like France have given children the right to sue their parents in case they breach their digital privacy. So called 'sharenting' laws exist because it's not guaranteed that parents are even respecting the privacy of their own children.
>1) do you have children and 2) if yes, how many times have you taken your child to hospital with a broken bone
yes one and never but it's not clear to me what our personal life has to do with the legal fact that the welfare of our children is in fact not solely in our hands and is subject to limits we can run foul of
> A lot of modern technology is harming kids (and I don't mean dirty videos, social media seems to be much more harmful).
If that's all we want then that's trivial -- just make certain phones that don't have access to social media, or have whatever limitations enforced. And kids only get those phones. I don't think anybody's addicted to desktop social media.
This gets us the privacy and the protection at once.
That's how the California act works, but we lumped it under "age verification" anyway. If you have to select whether the device is for someone over or under 18 in a drop-down menu, apparently that's "age verification"
I think legislation could quite sensibly require OSes and browsers to have easy to enable well-integrated parental controls (which mostly already exists). Browsers could voluntarily send "I'm a child" flag, if you want to make it every website's problem.
But the current legislation is stupid. Treating toddlers like hackers, and forcing every website to deanonymize users. It is so backwards, that it's hard to believe it's not done on purpose as the first step to ban anonymity and strictly control all online access. In the UK of course they're already talking about having a VPN ban, because the hacker toddlers are learning how to mask their IP addresses.
I think a reasonable way to divide up responsibilities would be identify child-locked devices, not people. It should be trivial for a website to identify a device with a child lock turned on. Then it's up to parents to make sure their kids get a child-locked device. Manufacturers can make it easy to turn on, and society can help by not selling devices to kids without a child lock turned on.
It won't work against a determined teen (too many unlocked devices out there), but it doesn't have to work perfectly to change the culture that most kids have to deal with.
This is part of the very sensible Digital Age Assurance Act that is currently the law in California. It prohibits facial recognition, but requires each device to have a child lock. FOSS can implement this no problem.
What disconnects this discussion from reality, and maybe causes questions like “why don’t they just do it this way”, is the assumption that this is really only or even mainly about age verification and “protecting the children”.
The reason it’s not done “this way” or “that way” even when those are objectively better ways to achieve the stated goal, but rather in an unexplainable way broader way is because the goal is broader that that and age verification is just the tip of the spear. The rest of it is laying the groundwork for a framework to control the freedom on the internet by linking identity to speech and action.
Look at what solution is implemented to decide what problem is it supposed to fix, otherwise you’re just looking at the smoke and mirrors.
Not that every state and country is on board with this, but it’s getting a lot harder to maintain the pressure to keep these initiatives down. Every time they get pushed one step forward it’s that much harder to regain that ground.
The sensible regulation would be aiming at socially harmful features of tech, not forcing people to provide proof of identity to a third party in order to continue harming themselves with the same exact features.
Imagine if such an approach was taken to, for example, food safety? Instead of closing down a restaurant that has poor hygiene, you'd be instead horce the restaurant to hire a private security contractor to check people's IDs to verify that they are old enough to consent to getting a foodborne illness. That's an absurd approach.
The stuff I've seen on this doesn't look terribly convincing. It seems to mostly be along the same lines as saying that since some people get bullied or hang out with a bad crowd, socializing in general is harmful.
It is already happening. E.g. soon F-Droid and any unattested open source Android app distribution will be gone, due in Sep 2026.
Same with GitHub and similar, we have CLAs for a while now for licensing. But I see project maintainers are frustrated with AI generated slop PRs and bad actor contributions. The ecosystem will be closing. You will be able to read code, but forget creating PR without some ID verification (because this is for kids or against terrorism).
Oh it's so nuanced and hard to parse that he's arguing for compromise.
The trouble is, compromise isn't really a tenable option with encryption. Either you make a draconian law that forces all electronic devices to run approved software only, or people will have access to easy encrypted messaging. There's really no middle ground, because where the smallest weakening of encryption affects everyone's privacy, only outlawing encryption completely will get it out of the hands of criminals. The cat's out of the bag.
Author here and in earlier writing seems to make the argument that a little compromise would make the courts less unhappy, but I think that's misattributing motivation.
These laws actually are originated by big tech, who think they will be shielded from liability and make more money off of selling your data. https://github.com/upper-up/meta-lobbying-and-other-findings
> make a draconian law that forces all electronic devices to run approved software only
That would outlaw programming. It's just not feasible at all, anyone with any kind of tech literacy understands that encryption is here to stay. It's also necessary for the web to function at all for the things we use it for, such as banking.
There is no way to prevent people from communicating in secret. Even if they did strictly control digital communication people would just communicate some other way.
I detest this writing style, where you assert arguments you don't actually believe in and know are in bad faith, in that sniveling "prove me wrong" tone, to provoke some kind of reaction.
Well, mission accomplished, reaction provoked. I'm not going to read this multiple times. I'm going to fire off this comment and remove it from my brain forever.
I struggle with this because the author is lumping FOSS and "tech bros" together as taking the blame for what a handful of large corporations have done, and thinks that our punishment is what those large corps are lobbying for. It seems like an argument that this is a necessary evil to protect the kids - despite admitting that this is not the real reason for the laws - and then says that those of us who care about privacy are either very rare or "mythical".
And please remember that Poul-Henning is an old-hat and well respected in the field, he's also not a product of American culture. Consider that he might have some useful insight that covers some blindspots your particular culture might not.
"LLM-assisted code review won't be a huge disruptor" is quite the prediction. Because it already is in a very big way. The take on LLMs seems incredibly out of date and out of touch with reality. (Which of course, has moved/advanced very fast the past months/year)
Which is such a crazy assertion, given that not even Mythos was trained explicitly as an exploit finder. Even if the US's profit-driven capital for AI dev dries up, China's state funding for results-driven AI isn't drying up, and they're going to keep building better models as long as the results are there (which they are), for better or worse.
I’m not exactly sure but I think he’s implying the AI labs aren’t profitable on inference? And that once the bubble pops those models won’t be available anymore? Just my assumptions
Did you continue reading? His argument is exactly that, like all the previous model checkers, LLM's are going to give us some bugs for a while. Then that is going to stop.
His argument is not that they aren't going to find any bugs, but rather that at some point those bugs will be fixed. At which point we will continue on as usual.
How would they stop? Are you insinuating they're going to have reviewed all code at some point, and that new code for them to review will just cease to exist? Or that they'll just decide to stop finding bugs they're finding now in new code when they review it? All the previous model checkers didn't stop giving us bugs to fix, which is why his premise is wrong; every big company is still running SonarQube because it still gives you bug findings. So will AI.
If the argument were instead that it will cease to find new classes of vulnerabilities and bugs, that may very well be true, because that is a question of the limitations of programming and at a lower level computer architecture, but that's not the argument the author made.
The question is whether the balance of white-hat and black-hat LLM bug findings gives us a different enough result from the previous balance of white-hat and black-hat human bug findings to constitute a major disruption.
That wasn’t the question. The question is how LLM code review is a huge disruptor. What is it disrupting? At best, with regard to code review LLMs just solve the problems that LLMs create.
I did, his argument is that we've already discovered ~50% of all bugs discoverable by LLMs.
I'm treading lightly after you said "did you read it" to OP, I do believe we both understand that argument isn't nearly air-tight. (i.e. it implies either humans get so good at code that bug-introduction-rate falls percipitously, or, LLMs are so awesome they write all of our code bug-free. Neither of which jives with the thesis, that LLM code review is a nothingburger long term)
The best steelman we could say is "he meant 50% of all existing bugs in all currently existing code", which is still incompatible with a time-bound on their usefulness, unless we expect the rate of new code to fall percipitously.
The steelman I'm using, is they're speaking both loosely and strongly and intend us to understand these are strong opinions, held loosely, and they care for us enough to share.
> my personal guess is that the opportunities for anonymity on the Internet will shrink until mothers no longer are forced to have “the talk” when their daughters get their first mobile phone. As the parent of a daughter, I am totally on board with that.
depends on the age but.. they've probably discovered all kinds of shit already or heard about it from others
I don't think he was talking about "the birds and the bees"-talk, but about the "some random men will send you unsollicited dick pics just because you're a girl"-talk.
The attitute expressed in the quote, "until mothers no longer are forced to have 'the talk' when their daughters get their first mobile phone," is both wrong in its assumptions and dangerous for its well-known consequence: the enabling of petty tyranny. Forced, indeed.
There will never be a world populated by humans in which you do not need to have numerous talks with your children about the nature of humans, especially humans they do not know and cannot trust, and about the technology those other humans know how to use. Saying you are forced to do so on account of some particular new technology is like saying you are forced to provision food for yourself on account of this newfangled capitalist system... As if needing to provision food for oneself were not a state of affairs dating back to the dawn of cellular life. And as if the uglier parts of human nature emerge from the smartphone and do not in fact date back to the dawn of humanity as a species.
Demanding everyone on the Internet show their papers to the government so that the author can hand their teenage daughter a free, always-networked pocket computer plus microphone and video camera without having to think about any related risks is an attitude repugnant for its laziness, its entitlement, its delusion, and most of all its contempt for the freedoms of others.
But the problem is, those same forces you're describing are employed to fool people into believing the fictions that support these regressive movements. The real danger we should be focusing on is "won't someone think of the impressionable adults".
Long term, I think we need computer age fables. As in: stories children can listen to and read growing up to acquire effective instincts about computers and the digital, networked world, rather than trying to apply instincts about the analog world to computers. Inter-human societal complexity has long outstripped our genetically developed instincts, but we've already solved that problem with storytelling and cultural transmission/cultivation of instincts. That solution is as ancient as spoken language.
When humans come to these deeply flawed conclusions about computers, networks, and governments, it's a new case of an old problem. Maybe the old problem is screaming toward us at a new velocity and intensity. But I think we can improve the existing humane cultural solution with new stories for our children, rather than surrendering to the supposed inevitability of government mandates to lock down and restrict general purpose computing to only well identified citizens in good standing. The restriction to "in good standing" almost inevitablty follows from the "well identified."
> the weights of the model—which you have to sell many million times over before you turn a profit—easily fits on contemporary pocket-sized storage devices.
Which model is this author talking about? Which pocket-sized devices? Where can I get them? No one is using Gemma 4 to find cybersecurity issues.
Edit: there are a lot of sentences that I can't distinguish from sarcasm in this article. I guess I read it too seriously.
> — Day 1-2. Tried $tool out. Oh boy! We have some work to do.
> — Day 3-5. OK, there were a couple of solid bugs there, and a fair number of what were technically bugs, but not actually all that bad.
> — Week 2. I guess that was it?
There are a bunch of tools in the developer toolbox that some people never use, and the opposition use religiously. We are especially bad in this industry at turning things into a boolean where they should be a dial or a continuum. Something about that intro to Logic class either rots our brains or works as a filter to keep most of the philosophers out.
In sports there are drills one does a couple times a month instead of every day. You're trying to harden pathways in the brain to make certain reactions be more automatic, to correct subtle errors and suboptimal answers to problems. You don't do them all the time because they're expensive in some way, like time or danger.
I think this is an area where we miss a lot. I don't do TDD all the time. Maybe a week every couple of months. And it's a split between very hard tasks and very simple ones where I practice it. It's easier to work on first principles on a simple problem, but sometimes when you're stuck on a very difficult one, you have to go back to first principles anyway.
"Difficult" can be further broken down into several categories. 1) I don't know how to solve this, 2) the problem is straightforward but arduous and I don't know if I have the stamina for it, 3) I thought I solved it but it's not working.
TDD is a good way to get yourself into bottom up thinking and 'work the problem' by testing your assumptions one at a time. At the very least you have something to show for your work at the next standup even if the answer still eludes.
Similarly, a linter can be good while you're building up muscle memory for writing code the way the current team thinks it should be written. However, it can be a nightmare when you're trying to do exploratory development to fix a bug. I've landed PRs on two different FOSS projects to run the linter after the unit tests for this very reason. I don't fucking care if the code is Clean right now I only care if I've fixed the NPE that is crashing production. The PR is a problem for an hour from now. I need to make it work and then I can make it right.
I feel like “tech bro” is the scapegoat for all bad things in tech these days. It’s fairly dismissive of the ongoing debate and advancement of technology overall IMO
> In comparison, tech sisters advocating for an absolute right to privacy seem to be a very rare, and maybe mythical, species.
Ever heard of Meredith Whittaker?
> We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary.
This has to be a joke. There's private, and there's not private. There is nothing in between. This is not about tech bros. This is about guiding principles, about personal liberty, and about freedom from tyranny.
> It may not quite be a law of nature, but my personal guess is that the opportunities for anonymity on the Internet will shrink until mothers no longer are forced to have “the talk” when their daughters get their first mobile phone.
In addition to "the talk" guess what else they won't be forced (or allowed) to talk about? Political dissent.
This chunk of the article is both sexist and defeatist. Now to read the rest.
> This is about guiding principles, about personal liberty, and about freedom from tyranny.
The point he’s trying to make, as I understand it, is that states adapt. They don’t just throw up their hands and say “guess we can’t do anything about that encrypted traffic.”
The response to distributed kinetic kill capability in the US, for example, is for police to become more militarized and treat every encounter as a potentially lethal one.
> There's private, and there's not private. There is nothing in between
It’s not an argument about privacy per se, it’s highlighting that the stronger the protections against state surveillance and intervention, the stronger the state becomes. By taking an absolutionist stance, we push our institutions to towards the same in response.
I’m not making an argument or against encryption or privacy, just pointing out the systemic effects.
I finished the article. My own bad prediction: If FOSS "dies" it will continue to thrive in 3rd world countries, where no one bothers to administer punishment for the heinous crime of not letting your government's LLM read every word you type. The 1st world will ignore all this until it becomes apparent that the (former) 3rd world countries are suddenly in a position to economically surpass everyone else, and at that point the wise will see that their desire to keep a stranglehold on online activity was actually a bad idea that allowed their dominance to wane and wither.
- Eva Galperin, Director of Cybersecurity at the EFF
- Runa Sandvik, formerly of Tor Project
- Yan Zhu, EFF Fellow and CISO at Brave
And many, many more.
It rankled me more than a bit that the author apparently looked around his bubble in Denmark and the FOSS community, saw no "tech sister" privacy advocates, and decided to paint with the widest brush possible and assume there are none anywhere.
Like half this list + Meredith are lawyers/policy people. Add in computer security specialists/operators. They use software as a tool to achieve political ends.
"tech bros" in context of the article is pretty much referring to builders of software. The tech sisters who have built significant projects are indeed mythically rare.
Names like Radia Perlman might be a better choice.
I mean I can point to a half dozen that I know personally but they’re not famous shrug. This seems like a weird argument to make to me, and besides the overall point the author was attempting to make anyway
I make this point pretty much every time I comment on this subject and it's generally downvoted. It's more than one, but one may be the most obvious. The social media and big tech companies made their bed here. They want to operate as if they have no social responsibility and just blame all the bad stuff on users and parents. This was never going to fly over the long term.
This is a very strange read. If that was posted on a random blog, I would have dismissed it. I didn’t know that that cell (anti tech bro, anti big tech, pro age verification laws) in the alignment chart is populated by actual people. And by intelligent people even.
Also the fact they call it “age verification” when they clearly build an identity verification and we just accept their language is crazy.
I am anti big tech, that's why I support the California digital age assurance act, it pre-empts things like persona by saying that a simple checkbox is age verification.
I think the mechanism is that ACM has a certain archetype of "bro" self selected into the group. They all have similar views like hating big tech, loving FOSS, pro government regulation and so on. The author probably fills a gap of a priest. This publication itself needed a priest to do the sermon and who better than the author. He touches on all the points of interest here and there and keeps everyone satisfied.
At least, this is what I have come up with because this blog is mostly incoherent blabbering.
It’s interesting to claim that the ‘tech bros’ oppose hardware attenuation and age verification when this will massively benefit them; everyone will be forced to use their operating system and the government will have exercised its power to protect Microsoft’s god-given right to make money, Peter Thiel’s age verification startup’s ability to collect people’s data and their ability to trace the identity of any critics through identity-based age verification.
That’s why large tech companies are lobbying in favour of this!
Lol this feels trite to say, but tech bros are not ideologically homogenous. You and the author are mixing up different people commonly identified as tech bros.
> When Edward Snowden revealed that Somebody Important had been taking an interest after all, the tech bros, who had grown up free of adult supervision, felt betrayed and started a campaign to encrypt everything and anything so that prying eyes could never again look them in the cards.
TIL: Phil Zimmermann was a "tech bro" and had a time machine.
This whole thing can be reduced to "think of the children", see the literal example around paragraph ~30. I'm not sure I've ever seen anyone try so hard to equate being pro-privacy with being pro-crime.
He really seems to think he made some deep insight on the "bubble" that he seems so confident about.
> So, it is not obvious to me who will be training new iterations of these models once the current bubble explodes, in particular if the returns are diminishing the way I have experienced.
It looks like he has no clue on how market equilibriums work. He really seems to think LLM's will just like.. stop existing.
So in their world, people would suddenly realise that AI is actually not that economic and we can't have Opus 4.8 quality models just with updated knowledge cutoff perpetually. So in his future, things won't just stall, they will literally go back.
He's really putting his emotional weight on this particular kind of future.
Either that or he's making nebulous emotional claims - its his blog so he can do it.
"We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary"
Unfortunately, no, you can't have a prophilactic that just makes you a little bit pregnant. We used to know this.
> And before you ask: Yes, I’m laying this one squarely down before (and partly on the toes of) the tech bros: We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary.
Ah, the famous “maybe if I take a step back they’ll appreciate it and not push harder”. Or maybe it’s “if I give the leopard my face maybe it spares my body”.
I’ll let reality speak for itself: look no further than Stingrays and every bit of legal abuse they enabled, where innocent people are spied on in bulk with flimsy excuses. How well did it work out when the protocol was already maximally compatible with laws?
There’s no “minimally compatible”, you either have the privacy technically guaranteed or you don’t. If it’s technically allowed to breach it, it will soon be done as a matter of routine under the guise of “protecting”, “preventing”, and so on.
So in the end we didn’t lose anything, what we did was we gained a short period in which we could all taste that freedom. If we used your proposal nobody would have had even that to begin with.
This logic would have been easier to forgive if it came from youth and inexperience, from someone who never got to know about the endless abuse of surveillance that was inflicted indiscriminately on everyone.
> I promised myself I would never join their ranks.
A wasted opportunity, missed by at least 1 article :).
A working solution can forestall a worse one. Because of the age verification law in California, which is very explicit that you only need a device-wide checkbox, nobody can use the argument that they need a passport scan to comply with the law.
We’ve had the “compromise” solutions forever before the harder stance tech took on privacy in the last few years, and governments abused them into oblivion. Every time the tech allowed it, it was legally abused and applied much wider than initially promised. This isn’t just about age verification but also encryption.
Every time you step back, the opposing force advances one step and soon you’ll have the same discussion again except from an even weaker position. Do you really think that once the framework is in place everyone will forever be content and not push for the next step?
Like the author, you are advocating for the “small backdoor”. Or like another commenter put it, the prophylactic that only gets you a little pregnant. There’s no such thing.
I also found the compromise bit of the article strange
The minimally compatible is what existed before. The Snowden leaks showed that the Government, and not just the US government, would abuse the shit out of that for mass surveillance.
So now privacy advocates no longer trust that such a compromise can exist
It’s strange that the author both recognizes that the Government broke the social contract and then says privacy advocates should just keep trusting them in the same article
This. Author does talk about a lot of facts but seems very defeatist wrt whether an anonymous, encrypted internet can be preserved.
I do recognize their point that it's been made very hard to catch and prosecute cyber criminals. I think there are ways to improve that that don't destroy the privacy of everyone. But if that's the real goal, why isn't it the big pitch line of the Parent's Decide Act?
I don’t even know which party he champions. There is no pro-privacy party in America. That quote can come from either side of the establishment. Both increased surveillance.
None of the ones you're thinking of. PHK is Danish. Danish politics and society at large leans pretty left. Even what you might call the rightwing party there consider themselves as bourgeois-liberal, or "not-socialist". The farthest they'd generally position themselves is center-right.
Except for shit like Stram Kurs, which nobody really supports or tolerates.
> During the past couple of decades, rampant neoliberalism and “globalism” allowed the U.S. tech industry to capture almost the entire European IT market, including all “social media.” This has recently proved to be a ghastly mistake, and now the EU, along with its member states and companies, are scrambling to claw back their digital sovereignty.
This is not a partisan political statement, it's a factual one. It is simply a statement of fact that neoliberal world markets have permitted hyperscalers to cross national boundaries and provide the same services at scale to governments worldwide, and like, without even going into any U.S. politics at the moment, isn't that... really weird? Like many EU governments had essentially put their ability to function as states in the hands of a foreign actor. That's WILD.
> Right now, there is a LOT of shrill propaganda from the tech bros, who call themselves “privacy advocates,” about how mandatory age checking is the gateway drug to comprehensive identity checks on the entire Internet, and ridiculing the valid civic concerns governments are trying to address as merely “think of the children” strawman arguments.
Oh, it’s not a slippery slope. It’s a single step: age verification IS identity verification, and it abolishes anonymous publishing on the internet, allowing on day one for violent retaliation against political speech.
If you think that authoritarian governments won’t be abusing this instantly, you are sorely ignorant of history.
There are some incredibly strange equivalences going on in here that make me think the person in question is indeed quite out of date.
The people pushing for the destruction of privacy and attested software integrity ARE the tech bros. I'm sure there are people here that will vehemently disagree with me, but we see the biggest tech companies pushing for age verification and we see founders and rich folk gleefully giving up their earlier pro-privacy stances in favor of supporting locking down identity. They're building up their moat in real time because not only does it let them kill that pesky FOSS, but also it means they can legally gather even more data from individuals in question.
It also goes hand-in-hand with the increasingly authoritarian bent a lot of those same people have taken and these resources will absolutely be used to crack down on minorities and things they don't like.
I think your head would have to be firmly planted deep underground to somehow not connect the two dots. As another poster here said, they're literally lobbying for these age verification laws because it benefits them.
I guess tech has grown too large and fractured and maybe most working software engineers are too young to be familiar with phk and his points of view.
He's been a strong privacy and FOSS advocate for decades and has more credibility on both of these topics than nearly anyone on this board.
He also has an account and comments frequently. phkamp. I suggest reading some of his comments before making judgment.
So many kneejerk and nuance-less opinions. Absolutely hilarious that people are thinking the guy who wrote MD5crypt and BSD Jails is anti-privacy.
Also eye opening watching how many people are getting frothing-at-the-mouth mad seeing somebody with that pedigree coming to different conclusions than they do.
Sadly, after the 2024 anti-E2E-messaging piece[1] I do in fact think he’s pretty anti-privacy overall. Perhaps calling that pro-regulation is more correct, but my (non-American) experience over the last, say, twenty years does not include literally a single piece of regulation that traded privacy for more government control (however reasonable) and went well, so, same difference. Accomlished hacker holds some wrong-to-downright-harmful political opinions; wouldn’t be the first time.
It's extraordinary to me how highly intelligent people can't tell the difference between saying "don't this because people don't have the right to do it" and "don't do this because even if you're correct you'll go to prison for it".
That's the difference he's pointing out in your linked article. There's nothing "anti-E2E" about that piece that he wrote. He says explicitly that people can have whatever standard of encryption they're comfortable with in the post. His piece is entirely about letting all parties to communication decide their limits on privacy. It's a solution that lets people maintain their rights, lets businesses stay compliant with the law and also meets with political reality.
The staunch privacy advocates acting like privacy has to be all or none are right but not in the way they believe. If you continue to build privacy technology where the only option is total privacy then don't be surprised when nation states take all of your privacy away. There's no privacy in prison.
Also you can be totally justified in working on such tools, but western liberal governments will still imprison you for it. Hell, a guy sat in jail for four years just for ignoring a court order to unlock his phone (United States v. Rawls). He won the appeal but still sat in prison and judges can do that. That's kinda the point of the article.
phk is doing nothing more than telling people the temperature of the room outside of their bubble.
Really? I'm overwhelmingly seeing people just complain and call him a crank without really making any arguments. There are some arguments but it isn't the majority of the comments, or even what I was responding to.
Regarding the article title, is the editor trying to make a witty reference to Douglas Adams? Because that is not the phrasing that Adams used -- it was So Long, and Thanks for All the Fish (rather than "Goodbye") so unfortunately, any intended humour sort of falls flat for me. Sadly, the nerds at ACM should know better.
He acknowledged the LLM tools are useful, and ponder on the economic viability. I don’t see something that seems to say he doesn’t like AI? he seems to be mostly a critic of AI boosters
Wow, re-read the fine article. He was NOT stating that he wants the outcome you think. He is afraid it is going to happen because the younger generation has no clue or ability to maintain FOSS.
It's not anti-privacy to point out the obvious that privacy-advocacy is sometimes at odds with governments and the will of voters at large.
Privacy is being abused by criminals to victimize people at scale. Just because privacy is a moral good doesn't mean you are morally off the hook for enabling criminals.
Governments are so aware of this they're passing sweeping laws against it. This is your new reality -- you can't just bury your head in the sand. The whole point was saying that there could have been a middle ground that protected more of your rights than where you're at now if it weren't for the absolutism.
Age verification is not the will of the voters. It is the will of large political donors (specifically tech companies and religious censorship groups). It is certainly not the will of adult citizens who use adult websites, who have overwhelming shown in their usage patterns they will abandon any website that tries to do age verification.
Parental controls remains the right way to do age gating. It works today and has no privacy impacts.
Just for those who aren't aware, most of the recent push for these laws has been bankrolled by Meta. They wish to avoid legal responsibility for their attacks on democracy and human health by convincing governments that people don't need any right to anonymous speech, and thusly free speech, as much as Meta needs to not have to pay moderators.
Nobody wants age verification (except Zuck), but most people want children kept away from social media, and nobody's suggested a better option. Why haven't we suggested a better option? Well it's because we called the whole thing authoritarianism and refused to get involved.
You know who didn't refuse to get involved? Larry Ellison, Peter Thiel, Mark Zuckerberg. They made suggestions to governments about how to solve this problem, and the best proposed solution was adopted and made the law.
> This is literally what California did with the Digital Age Assurance Act, AB1043.
There's apparently information that you didn't read contained in the footnote of the comment you replied to.
Based on this layman's reading of the law, [0] California did literally the opposite. They require major OS vendors to require users to enter their birthdate or indicate in some other way their current age, and then require programs and websites to act on that age information. This is entirely different from requiring major OS vendors to allow a "guardian account" to set fairly-fine-grained restrictions on one or more -er- "ward accounts", and then requiring programs and websites to refuse let the "ward account" do the things that those restrictions say that it isn't permitted to do.
"Restrict by age" neither accounts for precocious under-eighteens, nor does it account for vulnerable elderly or otherwise brain/developmentally-damaged adults who need protected. And because "restrict by age" cares very much about your age, and because it's not going to work nearly as well as promised by those pushing it, it will inevitably require scans of both a photo ID and one's face and/or other biometrics.
A "you don't need to know anything about this account other than that these are the things it's not supposed to be able to do" system gives zero shits about the identity of a person, so there's no plausible path for it to gate access behind submission of any identifying documents to any third party.
It requires you to enter a birth date which is not required to be your birth date. In case of a conflict between the age verification birth date and any other birth date, only the age verification birth date may be used for age appropriateness checks.
[L]egally require[d] ... to be effective and easy-to-use-if-you-take-a-few-minutes-to-read-the-instructions.
Additionally, I expect that -due to kids lying about their ages- within five or ten years, the regs will have "graduated" from self-attestation to ID and biometrics collection. It's likely that other states will require that sort of collection much sooner, causing every US-based company to do that regardless of the existence of less-invasive regs.
Like, seriously... if "the kids can lie about their age and there are no consequences for lying" is the bar you want to set, just do the 1990's thing where sites and programs have a "Warning! This might not be suitable for kids!" page/screen that has a checkbox that the kids can check or button that they can press that lets them lie that they're over-seventeen and grants them access.
Please provide citations regarding public support for age verification. Surveys show majority support, for dating sites, social media, adult content, and sports betting.
> Parental controls remains the right way to do age gating. It works today and has no privacy impacts.
This opinion is not grounded in data and facts. If this was true, we would not be here. But we’re here because parental controls are insufficient, the vast majority of parents are just hanging in there getting their kids to adulthood.
The real single-parent capital of America - https://news.ycombinator.com/item?id=42867716 - January 2025 ("The places with the most single parents tend to be, to put it bluntly, struggling. The strongest predictors of single parenthood are high poverty rates and high shares of the population receiving government assistance." [There are ~13.6M single parents in the U.S. raising over 21M children. This means single parents head roughly one in three households and approximately 34% of all U.S. children live in a single-parent family.])
> When stress is severe or prolonged, it can have a deleterious effect; 41% of parents say that most days they are so stressed they cannot function and
48% say that most days their stress is completely overwhelming compared to other adults (20% and
26%, respectively).
> Nearly 70% of parents say parenting is now more difficult than it was 20 years ago, with children’s use of technology and social media as the top two
cited reasons.
> Recent data from 2021-2022 indicate that among parents, 23.9% (or 20.3 million) had any mental illness and 5.7% (or 4.8 million) of parents had a serious mental illness.
> Lastly, many other caregivers assume primary
caregiving responsibility when parents cannot, thus
acting as a critical safety net for children. In recent
years, there has been a notable increase in such
individuals taking on caregiving responsibilities
for children, with approximately 2.4 million
children being raised by grandparents, other
relatives, or family friends, without their biological
parent(s) in the household.
(fertility rates continue to collapse though, so hopefully this problem continues to decline over time, only time will tell; 40% of annual pregnancies in the US and internationally are unintended, per the Guttmacher Institute and the UN, respectively)
Charted: How American Households Have Changed Over Time (1960-2023) - https://www.visualcapitalist.com/how-american-households-hav... ("A record 58.4% of American households now consist of married or single adults without children. Only 25.3% of American households contain children.")
The laws not stopping the criminals isn't the point. People are calling on their governments to do something and thus governments are going to do what they are going to do.
It's a mix of what they can do and what they're likely to do. They just have to be able to go back to voters and say they're doing something.
If you think that the fact that they did the wrong thing is an argument for not doing anything, you clearly are blind to politics & history.
And age verification being the wrong solution to the "privacy problem" doesn't remove privacy from lawmakers' crosshairs.
Governments can make effective laws, you know. There are tools that can solve this. Parental controls, separation of peer-to-peer communications from algorithmic feeds. The lawmakers are old, tech-illiterate people. You can tell them that a private Minecraft server is illegal and they will believe it.
Yep. For example on Instagram DMs, which is why Instagram abolished E2EE, and we all went into an uproar.
Also on Discord and Roblox, they are apparently the biggest platforms for this, but they're not E2EE anyway, they're just hiding it because their executives like what's happening.
Gotta disagree. The encryption part needed to happen: without it, there's just too much opportunity for governments to intercept unencrypted traffic and abscond with it. We saw that occur with Snowden, and with programs like MUSCULAR in particular.
I don't think it's that encryption was harmful, it's that it wasn't enough, and in a sense I agree with TFA & the Sun Tzu bit: it needed to be complemented by legislation that added decent privacy protections, and it largely wasn't. That was a mistake, I suppose, but the current political situation, esp. in the USA, disfavors privacy regulation getting done, ever. The Democrats are … maybe spiritually for it? … but not terrible effectual at getting it done; Obama's response to Snowden was "meh" at best, and Congresspeople, in particular Feinstein especially, let the DNI walk all over her. The GOP has no interest at all in regulating corporations, at all, ever, so with the House/Senate/POTUS all (R) at the moment, it's going to be until at least Nov before it is possible to even think that these might get addressed, and even that's … generous, and I won't be holding my breath for it to occur.
Stuff like what we saw in another thread today — with LG wantonly installing spyware — and things like Flock would have happened in addition to network intercepts; they are not happening instead of. Corporations and the government will do whatever the People permit them to get away with.
The guy’s logic is “if only we had allowed a small backdoor from the start they wouldn’t be forced to install a large backdoor now”. Other technologies that were open to the law were endlessly abused for surveillance.
His theory is bunk, there is absolutely no middle ground to be had with the people who want a backdoor. There are no small backdoors.
What do you consider a backdoor though? Saying that devices must have parental controls isn't a backdoor. Saying that devices must scan your ID is a backdoor to break anonymity, but is he saying that?
If we had parental controls that actually worked it would forestall any talk about ID scanning because parents could just enable parental controls.
Even the article talks about this. The backdoor is when there’s no E2EE - he speaks of the “absolute right to privacy” which the proposed age verification solution wouldn’t breach in any way, so it’s actually the loss of encryption. It’s when a legal and technical framework are put in place to do age verification which can be switched to identity verification in a blink of an eye. It’s when cryptographically attested software is the only way to use the internet which even the author, as a suporter of the upsides, knows what it implies on the downside.
A bit of an aside, but after someone introduced me to the notion of Reversible Decisions, it quickly became apparent to me that the solution to the bikeshed problem is to throw money at it before the roosters can start preening about which color the shed should be.
Decisions that are reversible should just go with the instinctive answer of whoever volunteers to work on it.
I've been in many meeting rooms where, because of the number and caliber of people in the room, we've blown $5000 worth of combined salary arguing about basically nothing. I've been in a few where that number was well over $10k.
If you're going to assign a relatively medium talent engineer to solve a problem, it's cheaper to let them solve it twice, maybe even three times, than it is to try to figure out what the right solution is before touching a keyboard. It helps them grow to give them that autonomy, and more importantly training your team out of reflexively reaching for optimization for every single feature saves gobs of money over time.
The interface for a piece of code matters to everyone. The internal implementation details mostly matter to the bus number on that code. If they're happy with it, that matters a lot. That can be overridden by the consequences of that design, but I've seen a couple cases where the bus number for a module wanted a solution with fewer consequences but the group wisdom wanted something flashier but also more brittle.
+1! I've fallen in love with many of Amazon's in-group concepts, and maybe I'm just drinking the koolaide, but they have the concept of a "two-way door", which is exactly this -- a decision that can be made, unmade, remade, etc relatively cheaply. If you can identify that a choice isn't very dangerous, you can focus on the things that really are instead.
Amazon's leadership principles are fantastic. They are applicable to anyone doing any job at any level.
This often massively discounts the cost of reversing decisions. People often work to build things without any thought given to those who have to maintain it afterwards. Especially when it's not them.
I worked at a large, publicly-traded multinational where decades prior and they were still just a 4 man startup they decided the database server and all timestamps should be in the local timezone.
They are still using EST today even when they have global sharding of their customers/databases between US, EU, LATAM, SEA...
--- you're also assuming that the product roadmap will afford your engineers any time to build it the second, third, fourth, etc. time.
There seems to be some general pattern here that you can find pretty often in "dev war stories" contexts:
(1) We're a small startup/new product team/etc, let's just build the MVP and keep everything simple!
(2) Now we're not small anymore and suddenly have all kinds of nonfunctional requirements we never imagined before! But our simple architecture from before is making everything a pain now!
The natural instinct is then to compromise on the "simpleness" of the first prototype and already try to anticipate all the scaling and nonfunctional requirements that might come later - but that rarely seems to work, as you can't really how (and if) the project will grow.
Seems to me, the real question here is why those teams are still using the "MVP" code even after being well inside the "scale up" phase. Shouldn't this be the point where you gradually migrate to a codebase that is more manageable at scale?
When you first introduce the idea you'll find a bunch of people think decisions are Reversible which are not, as you say. And the flip side of Reversible decisions is the Last Responsible Moment, which runs afoul of Hofstadter's Law, and people wait until halfway past the last responsible moment.
The key to reversing a decision is getting over Sunk Cost, to start thinking of some code as scaffolding. Scaffolding allows you to get on to other work and then remove it after, because it's either not needed or the 'real' solution has been installed. People get defensive when you propose to rip out their code. Hey that code made us $250k at a time when we were about to miss payroll. Yes. It did. Thank you for your service. But now it's costing us $30k a month and that shit needs to go.
Getting people to figure out that if a decision is important, making it later is actually the sane thing to do, is a challenge. Because many people's intuition is that we should put energy into this now while it's fresh and we have abundant energy. We can 'solve' it and not have it dangling over our heads. But we don't know the right answer yet. We don't know the strength of our tools or the expertise of our coworkers.
The product roadmap is now and has ever been complete bullshit. Refactoring teaches that you amortize rework across all new stories. That's just how it goes.
(And everything should be in GMT unless you can literally point me to a several hundred page treatise on why another time zone is the correct one. Yeah I've worked west coast places that got bought by NY or Chicago companies and it's a clusterfuck if you both didn't use GMT)
Don't get me wrong, I'm a fan of the idea. I pretty much follow a lot of what you're saying without giving it names. I'm just used to people giving lip service to certain ideas as an excuse to move with less friction in their org and end up doing long-term organizational damage.
Thank you for the added detail.
> The product roadmap is now and has ever been complete bullshit. Refactoring teaches that you amortize rework across all new stories. That's just how it goes.
Also agree, but teams use sprints and "the roadmap" as a way to say no to fixing bottlenecks they've created for other teams and don't want to take the time and effort to resolve.
For those unaware, PHK created (amongst other things) the MD5crypt password hashing algorithm ($1$…). It came before bcrypt (1999), scrypt (2009), SHA2crypt (2016), etc, and was committed in 1994:
* https://svnweb.freebsd.org/base/head/lib/libcrypt/crypt.c?re...
* https://github.com/freebsd/freebsd-src/commit/3b2b7f71deba2a...
* https://phk.freebsd.dk/sagas/md5crypt/
* https://en.wikipedia.org/wiki/Poul-Henning_Kamp
To clarify: not MD5 itself. It was created in 1991 by Ron Rivest. (It is my experience that knowledge of these things isn't as widely distributed as one might hope.)
I first came across it in 1995/1996: Wow, what a magical tool for backend web stuff! I used it for everything.
Wait, is that the same guy who co-authorer the Floyd-Rivest Algorithm? Hmm, looks like it[0]. Huh, neat.
[0] https://en.wikipedia.org/wiki/Floyd%E2%80%93Rivest_algorithm
Also the same Rivest as Cormen, Leiserson and Rivest (that Stein dude was after my time), and the R in RSA.
Okay.
What qualifications does phk have that are relevant to the current subject?
I don't think age restriction will impact FOSS in the long term. If there are some regulations that threaten FOSS now, they are going to be adopted in the long term.
Regulations for age restriction are understandable. A lot of modern technology is harming kids (and I don't mean dirty videos, social media seems to be much more harmful).
A sensible regulator would leave some responsibility to the parents, but require restrictions for consumer devices (smartphones, laptops). Maybe even enable age restrictions by default, block replacing the OS or the firmware, and only allow it once the age was confirmed.
I don't see a point of including all kind of OS or software into this regulation. Just the ones that are preinstalled on consumer devices, and commercially distributed to consumers. Once the age of the user was confirmed, the devices should be able to become as open as we know them now.
I strongly disagree. There are no kids in my household, and no one else ever uses my devices, so the idea that I need to prove that I'm not a kid for me to be able to pay bills or file taxes on a stock device is ridiculous.
"Age restriction" can be implemented where stock devices are completely unrestricted. For example, just with better parental controls and education: children don't have access to property, so the parent takes their device and enables the parental controls, but you own your device so leave them disabled.
And this wouldn't affect Linux or FOSS: on a child's device their parent installs either a proprietary OS or a FOSS with parental controls, but again, on your device you install whatever you want.
That's not what the comment I responded to was proposing:
> Maybe even enable age restrictions by default, block replacing the OS or the firmware, and only allow it once the age was confirmed.
Having an extra hurdle before installing Linux would be an awful secondary effect for this type of regulation independent of whether the check itself is already objectionable (which I always obviously think it is, although obviously plenty of people also don't)
Is anyone proposing age verification to file taxes? I'd hope you already have to provide some sort of stronger proof of identity to file a tax return anyway.
That's exactly my point; websites that already have absolutely no threat from having kids access them are literally unavailable due to the operating system put up a block that isn't necessary due to a hypothetical kid using the device to access an entirely different hypothetical website. The regulation is absurdly overbroad for what it's trying to actual protect against.
I don't know what regulation you're talking about. Nothing of the sort is being proposed in the part of the world PHK occupies.
The comment I was responding to said this:
> A sensible regulator would leave some responsibility to the parents, but require restrictions for consumer devices (smartphones, laptops). Maybe even enable age restrictions by default, block replacing the OS or the firmware, and only allow it once the age was confirmed.
If you think that this statement is too broad for this thread, I don't understand why you only have issue with my direct response to it. It seems like your issue is with the parent comment I replied to for not being on-topic enough.
I don't understand the force of that argument. Where is the "so" coming from?
I don't understand what's hard to understand. Regulation that affects people and devices that have no risk of being used for the purported thing that's supposed to be protected against is not well-scoped.
Obviously if the government knew that you had no kids, they wouldn't need to check it. How do you propose they find out, without asking you to prove it?
> How do you propose they find out, without asking you to prove it?
How do I propose the government know if I have kids? I'm pretty sure they already know that I don't?
> A sensible regulator would leave some responsibility to the parents
(Speaking as a parent of three) why can't we just leave all responsibility to the parents? In our experience in the offline world it seems this applies!
I speak as someone who's taken each of my three children - for two of them, multiple times - to the emergency room to be treated for broken bones incurred in the course of Real Life[tm].
Yes, they play contact sports.
Yes, we use Family Link with pretty restrictive settings.
Despite the series of broken bones, I'm still in favour of kids playing sports and still dubious about the effect of screen time on young minds...
> (Speaking as a parent of three) why can't we just leave all responsibility to the parents?
Then I'm sure that you appreciate that there are both legal and informal checks in place ensuring that you can take responsibility for your children in the offline world. For example: I would be surprised if your children were able to play organized sports without your permission. Failing to ask for permission would deny you the responsibility of protecting your child as you see fit.
Even in the offline world that is not the case. Ex. Alkohol sales
You don't need to show your ID to go into the store and buy something else though, so why would this provide any sort of precedent for "you can't use the internet for literally anything on this device without proving your age"?
I was responding to this quote only
> why can't we just leave all responsibility to the parents? In our experience in the offline world it seems this applies!
In many areas, this is left up to the parents - minors can't buy alcohol at stores, but parents are legally allowed to give alcohol to their children to drink.
You could always sign your kid into tik tok to avoid age restrictions if you want. Same thing
I think the distinction the comment is drawing is about the legality of it not the practical feasibility .
It would be illegal under the currently proposed /implemented laws and also open up social media to liability, which wouldn’t be true for other products like Alcohol or fire arms that require minimum age to buy but not give to children
So we don't leave it all up to the parents: parents can give it, but minors also can't buy it regardless of parental views.
Also give it to your kids too often and the state can step in.
Defense in depth
An analogous good implementation of age restriction is that one must show their ID to buy an unrestricted device if they look too young.
They can't be tracked, as long as the devices are in randomly sorted identical boxes. Of course someone can buy a device and give it to a kid, but that's already possible with alcohol (and legal if it's their kid).
> Even in the offline world that is not the case. Ex. Alkohol sales
I bought a beer yesterday and shared it with our 16 year-old, and I shared some wine with him this evening.
How does that not come under "parental responsibility"?
>why can't we just leave all responsibility to the parents?
because we don't live in a 15th century peasant village. The average adult reads at a 7th grade level, 20% of adults are considered functionally illiterate, most adults can't navigate digital spaces, privacy and social media themselves or take on trillion dollar companies.
This also hasn't applied in the offline world since idk, Kant and Hegel, every modern state recognizes that children are persons and citizens in development, not private possessions. If your children have broken bones you can't explain or your parenting is considered to threaten the welfare of your child you can be pretty sure you'll have the authorities at your door quickly, and countries like France have given children the right to sue their parents in case they breach their digital privacy. So called 'sharenting' laws exist because it's not guaranteed that parents are even respecting the privacy of their own children.
> If your children have broken bones you can't explain [..]
I don't mean to be combative about this but
1) do you have children and 2) if yes, how many times have you taken your child to hospital with a broken bone
I have (unfortunately) got a certain amount of experience with this, and I'm not sure it works the way the uninitiated may think it does.
>1) do you have children and 2) if yes, how many times have you taken your child to hospital with a broken bone
yes one and never but it's not clear to me what our personal life has to do with the legal fact that the welfare of our children is in fact not solely in our hands and is subject to limits we can run foul of
Your sharents don't love you like your parents do.
> A lot of modern technology is harming kids (and I don't mean dirty videos, social media seems to be much more harmful).
If that's all we want then that's trivial -- just make certain phones that don't have access to social media, or have whatever limitations enforced. And kids only get those phones. I don't think anybody's addicted to desktop social media.
This gets us the privacy and the protection at once.
That's how the California act works, but we lumped it under "age verification" anyway. If you have to select whether the device is for someone over or under 18 in a drop-down menu, apparently that's "age verification"
I think legislation could quite sensibly require OSes and browsers to have easy to enable well-integrated parental controls (which mostly already exists). Browsers could voluntarily send "I'm a child" flag, if you want to make it every website's problem.
But the current legislation is stupid. Treating toddlers like hackers, and forcing every website to deanonymize users. It is so backwards, that it's hard to believe it's not done on purpose as the first step to ban anonymity and strictly control all online access. In the UK of course they're already talking about having a VPN ban, because the hacker toddlers are learning how to mask their IP addresses.
I think a reasonable way to divide up responsibilities would be identify child-locked devices, not people. It should be trivial for a website to identify a device with a child lock turned on. Then it's up to parents to make sure their kids get a child-locked device. Manufacturers can make it easy to turn on, and society can help by not selling devices to kids without a child lock turned on.
It won't work against a determined teen (too many unlocked devices out there), but it doesn't have to work perfectly to change the culture that most kids have to deal with.
This is part of the very sensible Digital Age Assurance Act that is currently the law in California. It prohibits facial recognition, but requires each device to have a child lock. FOSS can implement this no problem.
What disconnects this discussion from reality, and maybe causes questions like “why don’t they just do it this way”, is the assumption that this is really only or even mainly about age verification and “protecting the children”.
The reason it’s not done “this way” or “that way” even when those are objectively better ways to achieve the stated goal, but rather in an unexplainable way broader way is because the goal is broader that that and age verification is just the tip of the spear. The rest of it is laying the groundwork for a framework to control the freedom on the internet by linking identity to speech and action.
Look at what solution is implemented to decide what problem is it supposed to fix, otherwise you’re just looking at the smoke and mirrors.
Not that every state and country is on board with this, but it’s getting a lot harder to maintain the pressure to keep these initiatives down. Every time they get pushed one step forward it’s that much harder to regain that ground.
How do you know that's the ulterior motive? Anything more than vibes?
There are a lot of different people in different countries pushing for age verification and I imagine they wouldn't all have the same motives.
The sensible regulation would be aiming at socially harmful features of tech, not forcing people to provide proof of identity to a third party in order to continue harming themselves with the same exact features.
Imagine if such an approach was taken to, for example, food safety? Instead of closing down a restaurant that has poor hygiene, you'd be instead horce the restaurant to hire a private security contractor to check people's IDs to verify that they are old enough to consent to getting a foodborne illness. That's an absurd approach.
Sadly a lot of tech is potentially harmful for kids. And also adults, but they should be able to handle it better.
But it extends to many other common items. Kitchen knifes, cars, lawn mowers, ...
Except we do that for venue that serve poison aka bars, so if you put it that way, it doesn't seem totally absurd.
> social media seems to be much more harmful
The stuff I've seen on this doesn't look terribly convincing. It seems to mostly be along the same lines as saying that since some people get bullied or hang out with a bad crowd, socializing in general is harmful.
It is already happening. E.g. soon F-Droid and any unattested open source Android app distribution will be gone, due in Sep 2026.
Same with GitHub and similar, we have CLAs for a while now for licensing. But I see project maintainers are frustrated with AI generated slop PRs and bad actor contributions. The ecosystem will be closing. You will be able to read code, but forget creating PR without some ID verification (because this is for kids or against terrorism).
> soon F-Droid and any unattested open source Android app distribution will be gone
This is not connected to age restrictions. It might've been used as an excuse.
First read of this pissed me off, but subsequent reads gave a much different opinion.
Do yourself a favor and read this, a few times, and take a moment to actually try and see what the author's getting at.
Oh it's so nuanced and hard to parse that he's arguing for compromise.
The trouble is, compromise isn't really a tenable option with encryption. Either you make a draconian law that forces all electronic devices to run approved software only, or people will have access to easy encrypted messaging. There's really no middle ground, because where the smallest weakening of encryption affects everyone's privacy, only outlawing encryption completely will get it out of the hands of criminals. The cat's out of the bag.
Author here and in earlier writing seems to make the argument that a little compromise would make the courts less unhappy, but I think that's misattributing motivation. These laws actually are originated by big tech, who think they will be shielded from liability and make more money off of selling your data. https://github.com/upper-up/meta-lobbying-and-other-findings
> make a draconian law that forces all electronic devices to run approved software only
That would outlaw programming. It's just not feasible at all, anyone with any kind of tech literacy understands that encryption is here to stay. It's also necessary for the web to function at all for the things we use it for, such as banking.
There is no way to prevent people from communicating in secret. Even if they did strictly control digital communication people would just communicate some other way.
I detest this writing style, where you assert arguments you don't actually believe in and know are in bad faith, in that sniveling "prove me wrong" tone, to provoke some kind of reaction.
Well, mission accomplished, reaction provoked. I'm not going to read this multiple times. I'm going to fire off this comment and remove it from my brain forever.
Not a fan of Cunningham's law, I see.
https://lawsofsoftwareengineering.com/laws/cunninghams-law/
I struggle with this because the author is lumping FOSS and "tech bros" together as taking the blame for what a handful of large corporations have done, and thinks that our punishment is what those large corps are lobbying for. It seems like an argument that this is a necessary evil to protect the kids - despite admitting that this is not the real reason for the laws - and then says that those of us who care about privacy are either very rare or "mythical".
>I struggle with this because the author is lumping FOSS and "tech bros" together
This is on purpose.
This is the intent.
And please remember that Poul-Henning is an old-hat and well respected in the field, he's also not a product of American culture. Consider that he might have some useful insight that covers some blindspots your particular culture might not.
The relevant field is politics, not CS.
"LLM-assisted code review won't be a huge disruptor" is quite the prediction. Because it already is in a very big way. The take on LLMs seems incredibly out of date and out of touch with reality. (Which of course, has moved/advanced very fast the past months/year)
He explains how he thinks it won’t be a disruptor:
> Just on that repeated experience, I suspect we have already seen more than half of the “worst software bugs found with LLM-tools” list.
On the other hand, it’s not clear to me how you think that it already is “in a very big way”.
Which is such a crazy assertion, given that not even Mythos was trained explicitly as an exploit finder. Even if the US's profit-driven capital for AI dev dries up, China's state funding for results-driven AI isn't drying up, and they're going to keep building better models as long as the results are there (which they are), for better or worse.
That’s not his prediction, he made it clear they are useful. His conclusion for that section is this:
> The only real question for me is: Are the LLM-code-review tools economically viable outside the bubble?
So is he suggesting that in the future, models of Opus 4.8 tier will no longer be as affordable? Like it would become 3-5x more expensive?
Now that's quite a prediction.
I’m not exactly sure but I think he’s implying the AI labs aren’t profitable on inference? And that once the bubble pops those models won’t be available anymore? Just my assumptions
Did you continue reading? His argument is exactly that, like all the previous model checkers, LLM's are going to give us some bugs for a while. Then that is going to stop.
His argument is not that they aren't going to find any bugs, but rather that at some point those bugs will be fixed. At which point we will continue on as usual.
How would they stop? Are you insinuating they're going to have reviewed all code at some point, and that new code for them to review will just cease to exist? Or that they'll just decide to stop finding bugs they're finding now in new code when they review it? All the previous model checkers didn't stop giving us bugs to fix, which is why his premise is wrong; every big company is still running SonarQube because it still gives you bug findings. So will AI.
If the argument were instead that it will cease to find new classes of vulnerabilities and bugs, that may very well be true, because that is a question of the limitations of programming and at a lower level computer architecture, but that's not the argument the author made.
> At which point we will continue on as usual.
This part is the load bearing claim. Why would you continue on as usual? I'm using LLM's everyday on code reviews and they still catch bugs.
The question is whether the balance of white-hat and black-hat LLM bug findings gives us a different enough result from the previous balance of white-hat and black-hat human bug findings to constitute a major disruption.
I don't understand your point. How do you make your future code resistant to bugs without LLMs?
That wasn’t the question. The question is how LLM code review is a huge disruptor. What is it disrupting? At best, with regard to code review LLMs just solve the problems that LLMs create.
I did, his argument is that we've already discovered ~50% of all bugs discoverable by LLMs.
I'm treading lightly after you said "did you read it" to OP, I do believe we both understand that argument isn't nearly air-tight. (i.e. it implies either humans get so good at code that bug-introduction-rate falls percipitously, or, LLMs are so awesome they write all of our code bug-free. Neither of which jives with the thesis, that LLM code review is a nothingburger long term)
The best steelman we could say is "he meant 50% of all existing bugs in all currently existing code", which is still incompatible with a time-bound on their usefulness, unless we expect the rate of new code to fall percipitously.
The steelman I'm using, is they're speaking both loosely and strongly and intend us to understand these are strong opinions, held loosely, and they care for us enough to share.
Maybe he's trying to prove the point of why he's ready to retire...
I think the author is missing a layer of abstraction.
yeah - once regulators come into play - the private ecosystems take over. discord is already a precursor to this.
the era of mass public social networks will come to the end. next it will be just private networks of individuals. likely the won't interact.
how the dynamics play out - I don't know - but if you study history - you will know what behaviors will happen.
we replaced our bikeshed with a JIRA board and now we paint tickets instead, somehow it's worse
> my personal guess is that the opportunities for anonymity on the Internet will shrink until mothers no longer are forced to have “the talk” when their daughters get their first mobile phone. As the parent of a daughter, I am totally on board with that.
depends on the age but.. they've probably discovered all kinds of shit already or heard about it from others
> until mothers no longer are forced to have “the talk” when their daughters get their first mobile phone
I fail do imagine what kind of world is he implying.
I don't think he was talking about "the birds and the bees"-talk, but about the "some random men will send you unsollicited dick pics just because you're a girl"-talk.
The attitute expressed in the quote, "until mothers no longer are forced to have 'the talk' when their daughters get their first mobile phone," is both wrong in its assumptions and dangerous for its well-known consequence: the enabling of petty tyranny. Forced, indeed.
There will never be a world populated by humans in which you do not need to have numerous talks with your children about the nature of humans, especially humans they do not know and cannot trust, and about the technology those other humans know how to use. Saying you are forced to do so on account of some particular new technology is like saying you are forced to provision food for yourself on account of this newfangled capitalist system... As if needing to provision food for oneself were not a state of affairs dating back to the dawn of cellular life. And as if the uglier parts of human nature emerge from the smartphone and do not in fact date back to the dawn of humanity as a species.
Demanding everyone on the Internet show their papers to the government so that the author can hand their teenage daughter a free, always-networked pocket computer plus microphone and video camera without having to think about any related risks is an attitude repugnant for its laziness, its entitlement, its delusion, and most of all its contempt for the freedoms of others.
Well put.
But the problem is, those same forces you're describing are employed to fool people into believing the fictions that support these regressive movements. The real danger we should be focusing on is "won't someone think of the impressionable adults".
Long term, I think we need computer age fables. As in: stories children can listen to and read growing up to acquire effective instincts about computers and the digital, networked world, rather than trying to apply instincts about the analog world to computers. Inter-human societal complexity has long outstripped our genetically developed instincts, but we've already solved that problem with storytelling and cultural transmission/cultivation of instincts. That solution is as ancient as spoken language.
When humans come to these deeply flawed conclusions about computers, networks, and governments, it's a new case of an old problem. Maybe the old problem is screaming toward us at a new velocity and intensity. But I think we can improve the existing humane cultural solution with new stories for our children, rather than surrendering to the supposed inevitability of government mandates to lock down and restrict general purpose computing to only well identified citizens in good standing. The restriction to "in good standing" almost inevitablty follows from the "well identified."
> the weights of the model—which you have to sell many million times over before you turn a profit—easily fits on contemporary pocket-sized storage devices.
Which model is this author talking about? Which pocket-sized devices? Where can I get them? No one is using Gemma 4 to find cybersecurity issues.
Edit: there are a lot of sentences that I can't distinguish from sarcasm in this article. I guess I read it too seriously.
He’s talking about storage required for the weights. Not actually running the model.
A large model like Kimi 3 should be something like, 1-2TB? That’s a pocket size hard drive
There are even 2 TB USB thumb drives.
It would even be common for phones to have 2 or more TB integrated had we not been co-opted to move all our data into the cloud.
Not with the current AI craziness :( We won’t see phones with good storage before a while given the current (completely insane) hardware prices
> — Day 1-2. Tried $tool out. Oh boy! We have some work to do.
> — Day 3-5. OK, there were a couple of solid bugs there, and a fair number of what were technically bugs, but not actually all that bad.
> — Week 2. I guess that was it?
There are a bunch of tools in the developer toolbox that some people never use, and the opposition use religiously. We are especially bad in this industry at turning things into a boolean where they should be a dial or a continuum. Something about that intro to Logic class either rots our brains or works as a filter to keep most of the philosophers out.
In sports there are drills one does a couple times a month instead of every day. You're trying to harden pathways in the brain to make certain reactions be more automatic, to correct subtle errors and suboptimal answers to problems. You don't do them all the time because they're expensive in some way, like time or danger.
I think this is an area where we miss a lot. I don't do TDD all the time. Maybe a week every couple of months. And it's a split between very hard tasks and very simple ones where I practice it. It's easier to work on first principles on a simple problem, but sometimes when you're stuck on a very difficult one, you have to go back to first principles anyway.
"Difficult" can be further broken down into several categories. 1) I don't know how to solve this, 2) the problem is straightforward but arduous and I don't know if I have the stamina for it, 3) I thought I solved it but it's not working.
TDD is a good way to get yourself into bottom up thinking and 'work the problem' by testing your assumptions one at a time. At the very least you have something to show for your work at the next standup even if the answer still eludes.
Similarly, a linter can be good while you're building up muscle memory for writing code the way the current team thinks it should be written. However, it can be a nightmare when you're trying to do exploratory development to fix a bug. I've landed PRs on two different FOSS projects to run the linter after the unit tests for this very reason. I don't fucking care if the code is Clean right now I only care if I've fixed the NPE that is crashing production. The PR is a problem for an hour from now. I need to make it work and then I can make it right.
I feel like “tech bro” is the scapegoat for all bad things in tech these days. It’s fairly dismissive of the ongoing debate and advancement of technology overall IMO
I had to stop reading halfway through to respond.
> In comparison, tech sisters advocating for an absolute right to privacy seem to be a very rare, and maybe mythical, species.
Ever heard of Meredith Whittaker?
> We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary.
This has to be a joke. There's private, and there's not private. There is nothing in between. This is not about tech bros. This is about guiding principles, about personal liberty, and about freedom from tyranny.
> It may not quite be a law of nature, but my personal guess is that the opportunities for anonymity on the Internet will shrink until mothers no longer are forced to have “the talk” when their daughters get their first mobile phone.
In addition to "the talk" guess what else they won't be forced (or allowed) to talk about? Political dissent.
This chunk of the article is both sexist and defeatist. Now to read the rest.
> This is about guiding principles, about personal liberty, and about freedom from tyranny.
The point he’s trying to make, as I understand it, is that states adapt. They don’t just throw up their hands and say “guess we can’t do anything about that encrypted traffic.”
The response to distributed kinetic kill capability in the US, for example, is for police to become more militarized and treat every encounter as a potentially lethal one.
> There's private, and there's not private. There is nothing in between
It’s not an argument about privacy per se, it’s highlighting that the stronger the protections against state surveillance and intervention, the stronger the state becomes. By taking an absolutionist stance, we push our institutions to towards the same in response.
I’m not making an argument or against encryption or privacy, just pointing out the systemic effects.
I finished the article. My own bad prediction: If FOSS "dies" it will continue to thrive in 3rd world countries, where no one bothers to administer punishment for the heinous crime of not letting your government's LLM read every word you type. The 1st world will ignore all this until it becomes apparent that the (former) 3rd world countries are suddenly in a position to economically surpass everyone else, and at that point the wise will see that their desire to keep a stranglehold on online activity was actually a bad idea that allowed their dominance to wane and wither.
> Ever heard of Meredith Whittaker?
The fact that you name one makes her very rare indeed.
- Cindy Cohn, Executive Director of the EFF
- Eva Galperin, Director of Cybersecurity at the EFF
- Runa Sandvik, formerly of Tor Project
- Yan Zhu, EFF Fellow and CISO at Brave
And many, many more.
It rankled me more than a bit that the author apparently looked around his bubble in Denmark and the FOSS community, saw no "tech sister" privacy advocates, and decided to paint with the widest brush possible and assume there are none anywhere.
Like half this list + Meredith are lawyers/policy people. Add in computer security specialists/operators. They use software as a tool to achieve political ends.
"tech bros" in context of the article is pretty much referring to builders of software. The tech sisters who have built significant projects are indeed mythically rare.
Names like Radia Perlman might be a better choice.
I mean I can point to a half dozen that I know personally but they’re not famous shrug. This seems like a weird argument to make to me, and besides the overall point the author was attempting to make anyway
The whole age verification thing is being pushed by one "techbro", because he wants others to deal with cleaning up his mess.
There's another misdirection here as well. Much of this mess doesn't just affect children. It's really pretty bad for everyone.
I make this point pretty much every time I comment on this subject and it's generally downvoted. It's more than one, but one may be the most obvious. The social media and big tech companies made their bed here. They want to operate as if they have no social responsibility and just blame all the bad stuff on users and parents. This was never going to fly over the long term.
This is a very strange read. If that was posted on a random blog, I would have dismissed it. I didn’t know that that cell (anti tech bro, anti big tech, pro age verification laws) in the alignment chart is populated by actual people. And by intelligent people even.
Also the fact they call it “age verification” when they clearly build an identity verification and we just accept their language is crazy.
I am anti big tech, that's why I support the California digital age assurance act, it pre-empts things like persona by saying that a simple checkbox is age verification.
I have a feeling it splits by gender. I know a couple of professional programmers in that corner of the alignment chart, but they're not "bros".
I'm surprised to see a publication about ACM join in the blabbing about LLMs instead of show and tell.
Talking isn't doing, just like word generation isn't an outcome.
I think the mechanism is that ACM has a certain archetype of "bro" self selected into the group. They all have similar views like hating big tech, loving FOSS, pro government regulation and so on. The author probably fills a gap of a priest. This publication itself needed a priest to do the sermon and who better than the author. He touches on all the points of interest here and there and keeps everyone satisfied.
At least, this is what I have come up with because this blog is mostly incoherent blabbering.
It’s interesting to claim that the ‘tech bros’ oppose hardware attenuation and age verification when this will massively benefit them; everyone will be forced to use their operating system and the government will have exercised its power to protect Microsoft’s god-given right to make money, Peter Thiel’s age verification startup’s ability to collect people’s data and their ability to trace the identity of any critics through identity-based age verification.
That’s why large tech companies are lobbying in favour of this!
Lol this feels trite to say, but tech bros are not ideologically homogenous. You and the author are mixing up different people commonly identified as tech bros.
> When Edward Snowden revealed that Somebody Important had been taking an interest after all, the tech bros, who had grown up free of adult supervision, felt betrayed and started a campaign to encrypt everything and anything so that prying eyes could never again look them in the cards.
TIL: Phil Zimmermann was a "tech bro" and had a time machine.
This whole thing can be reduced to "think of the children", see the literal example around paragraph ~30. I'm not sure I've ever seen anyone try so hard to equate being pro-privacy with being pro-crime.
He really seems to think he made some deep insight on the "bubble" that he seems so confident about.
> So, it is not obvious to me who will be training new iterations of these models once the current bubble explodes, in particular if the returns are diminishing the way I have experienced.
It looks like he has no clue on how market equilibriums work. He really seems to think LLM's will just like.. stop existing.
So in their world, people would suddenly realise that AI is actually not that economic and we can't have Opus 4.8 quality models just with updated knowledge cutoff perpetually. So in his future, things won't just stall, they will literally go back.
He's really putting his emotional weight on this particular kind of future.
Either that or he's making nebulous emotional claims - its his blog so he can do it.
"We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary"
Unfortunately, no, you can't have a prophilactic that just makes you a little bit pregnant. We used to know this.
> And before you ask: Yes, I’m laying this one squarely down before (and partly on the toes of) the tech bros: We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary.
Ah, the famous “maybe if I take a step back they’ll appreciate it and not push harder”. Or maybe it’s “if I give the leopard my face maybe it spares my body”.
I’ll let reality speak for itself: look no further than Stingrays and every bit of legal abuse they enabled, where innocent people are spied on in bulk with flimsy excuses. How well did it work out when the protocol was already maximally compatible with laws?
There’s no “minimally compatible”, you either have the privacy technically guaranteed or you don’t. If it’s technically allowed to breach it, it will soon be done as a matter of routine under the guise of “protecting”, “preventing”, and so on.
So in the end we didn’t lose anything, what we did was we gained a short period in which we could all taste that freedom. If we used your proposal nobody would have had even that to begin with.
This logic would have been easier to forgive if it came from youth and inexperience, from someone who never got to know about the endless abuse of surveillance that was inflicted indiscriminately on everyone.
> I promised myself I would never join their ranks.
A wasted opportunity, missed by at least 1 article :).
A working solution can forestall a worse one. Because of the age verification law in California, which is very explicit that you only need a device-wide checkbox, nobody can use the argument that they need a passport scan to comply with the law.
We’ve had the “compromise” solutions forever before the harder stance tech took on privacy in the last few years, and governments abused them into oblivion. Every time the tech allowed it, it was legally abused and applied much wider than initially promised. This isn’t just about age verification but also encryption.
Every time you step back, the opposing force advances one step and soon you’ll have the same discussion again except from an even weaker position. Do you really think that once the framework is in place everyone will forever be content and not push for the next step?
Like the author, you are advocating for the “small backdoor”. Or like another commenter put it, the prophylactic that only gets you a little pregnant. There’s no such thing.
Non sequitur. I didn't say anything about backdoors or privacy.
I also found the compromise bit of the article strange
The minimally compatible is what existed before. The Snowden leaks showed that the Government, and not just the US government, would abuse the shit out of that for mass surveillance.
So now privacy advocates no longer trust that such a compromise can exist
It’s strange that the author both recognizes that the Government broke the social contract and then says privacy advocates should just keep trusting them in the same article
This. Author does talk about a lot of facts but seems very defeatist wrt whether an anonymous, encrypted internet can be preserved.
I do recognize their point that it's been made very hard to catch and prosecute cyber criminals. I think there are ways to improve that that don't destroy the privacy of everyone. But if that's the real goal, why isn't it the big pitch line of the Parent's Decide Act?
From TFA:
> In this last Bikeshed in acmqueue, I will ponder the far future of free and open source software (FOSS), hoping to upset so many readers that...
> During the past couple of decades, rampant neoliberalism and “globalism” allowed...
And I’m out. I guess congratulations to the author. Mission accomplished.
But I’m disappointed that the article took a turn towards partisan politics.
I don’t even know which party he champions. There is no pro-privacy party in America. That quote can come from either side of the establishment. Both increased surveillance.
None of the ones you're thinking of. PHK is Danish. Danish politics and society at large leans pretty left. Even what you might call the rightwing party there consider themselves as bourgeois-liberal, or "not-socialist". The farthest they'd generally position themselves is center-right.
Except for shit like Stram Kurs, which nobody really supports or tolerates.
You should've kept reading:
> During the past couple of decades, rampant neoliberalism and “globalism” allowed the U.S. tech industry to capture almost the entire European IT market, including all “social media.” This has recently proved to be a ghastly mistake, and now the EU, along with its member states and companies, are scrambling to claw back their digital sovereignty.
This is not a partisan political statement, it's a factual one. It is simply a statement of fact that neoliberal world markets have permitted hyperscalers to cross national boundaries and provide the same services at scale to governments worldwide, and like, without even going into any U.S. politics at the moment, isn't that... really weird? Like many EU governments had essentially put their ability to function as states in the hands of a foreign actor. That's WILD.
> Right now, there is a LOT of shrill propaganda from the tech bros, who call themselves “privacy advocates,” about how mandatory age checking is the gateway drug to comprehensive identity checks on the entire Internet, and ridiculing the valid civic concerns governments are trying to address as merely “think of the children” strawman arguments.
Oh, it’s not a slippery slope. It’s a single step: age verification IS identity verification, and it abolishes anonymous publishing on the internet, allowing on day one for violent retaliation against political speech.
If you think that authoritarian governments won’t be abusing this instantly, you are sorely ignorant of history.
What is the Digital Age Assurance Act in California? Is it identity verification? If so, how?
State-based regulations on tech are largely irrelevant. See CCPA for an example.
There are some incredibly strange equivalences going on in here that make me think the person in question is indeed quite out of date.
The people pushing for the destruction of privacy and attested software integrity ARE the tech bros. I'm sure there are people here that will vehemently disagree with me, but we see the biggest tech companies pushing for age verification and we see founders and rich folk gleefully giving up their earlier pro-privacy stances in favor of supporting locking down identity. They're building up their moat in real time because not only does it let them kill that pesky FOSS, but also it means they can legally gather even more data from individuals in question.
It also goes hand-in-hand with the increasingly authoritarian bent a lot of those same people have taken and these resources will absolutely be used to crack down on minorities and things they don't like.
I think your head would have to be firmly planted deep underground to somehow not connect the two dots. As another poster here said, they're literally lobbying for these age verification laws because it benefits them.
I was about 50% sure this whole piece is parody when I read through the LLM part, and after I read the whole thing now I'm 99% sure.
> old men who had no idea what I was talking about but were 100 percent certain that they had the infallible answer
HN existed 20 years ago...? /s
edit: yes it did, lol
Proof: site design
Proof: not built with react :) Long may it stay that way.
goodbye
yeah man its cool
Was it ever decided on what color the bike shed should be painted?
I guess tech has grown too large and fractured and maybe most working software engineers are too young to be familiar with phk and his points of view.
He's been a strong privacy and FOSS advocate for decades and has more credibility on both of these topics than nearly anyone on this board.
He also has an account and comments frequently. phkamp. I suggest reading some of his comments before making judgment.
So many kneejerk and nuance-less opinions. Absolutely hilarious that people are thinking the guy who wrote MD5crypt and BSD Jails is anti-privacy.
Also eye opening watching how many people are getting frothing-at-the-mouth mad seeing somebody with that pedigree coming to different conclusions than they do.
Sadly, after the 2024 anti-E2E-messaging piece[1] I do in fact think he’s pretty anti-privacy overall. Perhaps calling that pro-regulation is more correct, but my (non-American) experience over the last, say, twenty years does not include literally a single piece of regulation that traded privacy for more government control (however reasonable) and went well, so, same difference. Accomlished hacker holds some wrong-to-downright-harmful political opinions; wouldn’t be the first time.
[1] https://queue.acm.org/detail.cfm?id=3703126
It's extraordinary to me how highly intelligent people can't tell the difference between saying "don't this because people don't have the right to do it" and "don't do this because even if you're correct you'll go to prison for it".
That's the difference he's pointing out in your linked article. There's nothing "anti-E2E" about that piece that he wrote. He says explicitly that people can have whatever standard of encryption they're comfortable with in the post. His piece is entirely about letting all parties to communication decide their limits on privacy. It's a solution that lets people maintain their rights, lets businesses stay compliant with the law and also meets with political reality.
The staunch privacy advocates acting like privacy has to be all or none are right but not in the way they believe. If you continue to build privacy technology where the only option is total privacy then don't be surprised when nation states take all of your privacy away. There's no privacy in prison.
Also you can be totally justified in working on such tools, but western liberal governments will still imprison you for it. Hell, a guy sat in jail for four years just for ignoring a court order to unlock his phone (United States v. Rawls). He won the appeal but still sat in prison and judges can do that. That's kinda the point of the article.
phk is doing nothing more than telling people the temperature of the room outside of their bubble.
I’m mostly seeing people disagree with the substance of his argument, though. Your argument through authority is weak.
Really? I'm overwhelmingly seeing people just complain and call him a crank without really making any arguments. There are some arguments but it isn't the majority of the comments, or even what I was responding to.
Just use fedora
Regarding the article title, is the editor trying to make a witty reference to Douglas Adams? Because that is not the phrasing that Adams used -- it was So Long, and Thanks for All the Fish (rather than "Goodbye") so unfortunately, any intended humour sort of falls flat for me. Sadly, the nerds at ACM should know better.
I tried to give this a fair chance but it's really an incoherent rant.
There is nothing of substance here. You don't like AI, I get. But it still exists and pretending that no-one finds it useful is utterly foolish.
Edit: I overuse the word utterly. Nice to identify one of my tells.
He acknowledged the LLM tools are useful, and ponder on the economic viability. I don’t see something that seems to say he doesn’t like AI? he seems to be mostly a critic of AI boosters
Didn't know ACM was anti-privacy. Glad I haven't paid dues in who knows how long if they're spending them to platform these noxious opinions.
Wow, re-read the fine article. He was NOT stating that he wants the outcome you think. He is afraid it is going to happen because the younger generation has no clue or ability to maintain FOSS.
Wow, you missed the entire point of the article.
Honestly? It's weirdly written and incredibly hard to understand what their point is. I can't tell if they hate or love privacy.
> Please make my predictions come out wrong.
It's not anti-privacy to point out the obvious that privacy-advocacy is sometimes at odds with governments and the will of voters at large.
Privacy is being abused by criminals to victimize people at scale. Just because privacy is a moral good doesn't mean you are morally off the hook for enabling criminals.
Governments are so aware of this they're passing sweeping laws against it. This is your new reality -- you can't just bury your head in the sand. The whole point was saying that there could have been a middle ground that protected more of your rights than where you're at now if it weren't for the absolutism.
Turns out that being an absolutist isn't helpful.
Age verification is not the will of the voters. It is the will of large political donors (specifically tech companies and religious censorship groups). It is certainly not the will of adult citizens who use adult websites, who have overwhelming shown in their usage patterns they will abandon any website that tries to do age verification.
Parental controls remains the right way to do age gating. It works today and has no privacy impacts.
Just for those who aren't aware, most of the recent push for these laws has been bankrolled by Meta. They wish to avoid legal responsibility for their attacks on democracy and human health by convincing governments that people don't need any right to anonymous speech, and thusly free speech, as much as Meta needs to not have to pay moderators.
Nobody wants age verification (except Zuck), but most people want children kept away from social media, and nobody's suggested a better option. Why haven't we suggested a better option? Well it's because we called the whole thing authoritarianism and refused to get involved.
You know who didn't refuse to get involved? Larry Ellison, Peter Thiel, Mark Zuckerberg. They made suggestions to governments about how to solve this problem, and the best proposed solution was adopted and made the law.
Parental control does not work today, it's too fragmented and too difficult.
> Parental control does not work today, it's too fragmented and too difficult.
Then legally require it to be effective and easy-to-use-if-you-take-a-few-minutes-to-read-the-instructions.
See also [0].
[0] <https://news.ycombinator.com/item?id=48911863>
This is literally what California did with the Digital Age Assurance Act, AB1043.
> This is literally what California did with the Digital Age Assurance Act, AB1043.
There's apparently information that you didn't read contained in the footnote of the comment you replied to.
Based on this layman's reading of the law, [0] California did literally the opposite. They require major OS vendors to require users to enter their birthdate or indicate in some other way their current age, and then require programs and websites to act on that age information. This is entirely different from requiring major OS vendors to allow a "guardian account" to set fairly-fine-grained restrictions on one or more -er- "ward accounts", and then requiring programs and websites to refuse let the "ward account" do the things that those restrictions say that it isn't permitted to do.
"Restrict by age" neither accounts for precocious under-eighteens, nor does it account for vulnerable elderly or otherwise brain/developmentally-damaged adults who need protected. And because "restrict by age" cares very much about your age, and because it's not going to work nearly as well as promised by those pushing it, it will inevitably require scans of both a photo ID and one's face and/or other biometrics.
A "you don't need to know anything about this account other than that these are the things it's not supposed to be able to do" system gives zero shits about the identity of a person, so there's no plausible path for it to gate access behind submission of any identifying documents to any third party.
[0] <https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...>
It requires you to enter a birth date which is not required to be your birth date. In case of a conflict between the age verification birth date and any other birth date, only the age verification birth date may be used for age appropriateness checks.
Okay? That is not parental controls that are
Additionally, I expect that -due to kids lying about their ages- within five or ten years, the regs will have "graduated" from self-attestation to ID and biometrics collection. It's likely that other states will require that sort of collection much sooner, causing every US-based company to do that regardless of the existence of less-invasive regs.Like, seriously... if "the kids can lie about their age and there are no consequences for lying" is the bar you want to set, just do the 1990's thing where sites and programs have a "Warning! This might not be suitable for kids!" page/screen that has a checkbox that the kids can check or button that they can press that lets them lie that they're over-seventeen and grants them access.
Please provide citations regarding public support for age verification. Surveys show majority support, for dating sites, social media, adult content, and sports betting.
https://www.pewresearch.org/short-reads/2026/07/01/majority-...
https://x.com/PTBwrites/status/2031529878021923118
https://yougov.com/en-us/daily-results/20250502-1e408-1
https://yougov.com/en-us/daily-results/20250502-1e408-2
> Parental controls remains the right way to do age gating. It works today and has no privacy impacts.
This opinion is not grounded in data and facts. If this was true, we would not be here. But we’re here because parental controls are insufficient, the vast majority of parents are just hanging in there getting their kids to adulthood.
More than 3 million college students are raising kids. Most won’t graduate - https://news.ycombinator.com/item?id=48709130 - June 2026
The real single-parent capital of America - https://news.ycombinator.com/item?id=42867716 - January 2025 ("The places with the most single parents tend to be, to put it bluntly, struggling. The strongest predictors of single parenthood are high poverty rates and high shares of the population receiving government assistance." [There are ~13.6M single parents in the U.S. raising over 21M children. This means single parents head roughly one in three households and approximately 34% of all U.S. children live in a single-parent family.])
Parents Under Pressure: The U.S. Surgeon General's Advisory on the Mental Health & Well-Being of Parents - https://www.hhs.gov/sites/default/files/parents-under-pressu... - 2024
> When stress is severe or prolonged, it can have a deleterious effect; 41% of parents say that most days they are so stressed they cannot function and 48% say that most days their stress is completely overwhelming compared to other adults (20% and 26%, respectively).
> Nearly 70% of parents say parenting is now more difficult than it was 20 years ago, with children’s use of technology and social media as the top two cited reasons.
> Recent data from 2021-2022 indicate that among parents, 23.9% (or 20.3 million) had any mental illness and 5.7% (or 4.8 million) of parents had a serious mental illness.
> Lastly, many other caregivers assume primary caregiving responsibility when parents cannot, thus acting as a critical safety net for children. In recent years, there has been a notable increase in such individuals taking on caregiving responsibilities for children, with approximately 2.4 million children being raised by grandparents, other relatives, or family friends, without their biological parent(s) in the household.
U.S. has world’s highest rate of children living in single-parent households - https://news.ycombinator.com/item?id=37628812 - September 2023 (108 comments)
(fertility rates continue to collapse though, so hopefully this problem continues to decline over time, only time will tell; 40% of annual pregnancies in the US and internationally are unintended, per the Guttmacher Institute and the UN, respectively)
Charted: How American Households Have Changed Over Time (1960-2023) - https://www.visualcapitalist.com/how-american-households-hav... ("A record 58.4% of American households now consist of married or single adults without children. Only 25.3% of American households contain children.")
The laws they pass do nothing to stop the criminals. Do you think an “age verification” law can stop any criminals?
The laws not stopping the criminals isn't the point. People are calling on their governments to do something and thus governments are going to do what they are going to do.
It's a mix of what they can do and what they're likely to do. They just have to be able to go back to voters and say they're doing something.
If you think that the fact that they did the wrong thing is an argument for not doing anything, you clearly are blind to politics & history.
And age verification being the wrong solution to the "privacy problem" doesn't remove privacy from lawmakers' crosshairs.
People are calling on governments or Meta is calling on governments to preemptively deflect punishment onto everyone else for their own misdeeds?
Exactly. Voice of the people if very faint, sound of lobby banknotes makes lawmakers listen.
Governments can make effective laws, you know. There are tools that can solve this. Parental controls, separation of peer-to-peer communications from algorithmic feeds. The lawmakers are old, tech-illiterate people. You can tell them that a private Minecraft server is illegal and they will believe it.
It's a shame that non-evil tech-literate people refused to talk to lawmakers about any of this.
> Privacy is being abused by criminals to victimize people at scale.
Almost all victimization is being done without end to end encryption. This is not a problem caused by privacy.
Yep. For example on Instagram DMs, which is why Instagram abolished E2EE, and we all went into an uproar.
Also on Discord and Roblox, they are apparently the biggest platforms for this, but they're not E2EE anyway, they're just hiding it because their executives like what's happening.
And I guess you have statistics about how much victimization happens over e2e?:)
Gotta disagree. The encryption part needed to happen: without it, there's just too much opportunity for governments to intercept unencrypted traffic and abscond with it. We saw that occur with Snowden, and with programs like MUSCULAR in particular.
I don't think it's that encryption was harmful, it's that it wasn't enough, and in a sense I agree with TFA & the Sun Tzu bit: it needed to be complemented by legislation that added decent privacy protections, and it largely wasn't. That was a mistake, I suppose, but the current political situation, esp. in the USA, disfavors privacy regulation getting done, ever. The Democrats are … maybe spiritually for it? … but not terrible effectual at getting it done; Obama's response to Snowden was "meh" at best, and Congresspeople, in particular Feinstein especially, let the DNI walk all over her. The GOP has no interest at all in regulating corporations, at all, ever, so with the House/Senate/POTUS all (R) at the moment, it's going to be until at least Nov before it is possible to even think that these might get addressed, and even that's … generous, and I won't be holding my breath for it to occur.
Stuff like what we saw in another thread today — with LG wantonly installing spyware — and things like Flock would have happened in addition to network intercepts; they are not happening instead of. Corporations and the government will do whatever the People permit them to get away with.
The guy’s logic is “if only we had allowed a small backdoor from the start they wouldn’t be forced to install a large backdoor now”. Other technologies that were open to the law were endlessly abused for surveillance.
His theory is bunk, there is absolutely no middle ground to be had with the people who want a backdoor. There are no small backdoors.
What do you consider a backdoor though? Saying that devices must have parental controls isn't a backdoor. Saying that devices must scan your ID is a backdoor to break anonymity, but is he saying that?
If we had parental controls that actually worked it would forestall any talk about ID scanning because parents could just enable parental controls.
Even the article talks about this. The backdoor is when there’s no E2EE - he speaks of the “absolute right to privacy” which the proposed age verification solution wouldn’t breach in any way, so it’s actually the loss of encryption. It’s when a legal and technical framework are put in place to do age verification which can be switched to identity verification in a blink of an eye. It’s when cryptographically attested software is the only way to use the internet which even the author, as a suporter of the upsides, knows what it implies on the downside.