• 6 Posts
  • 5.8K Comments
Joined 3 years ago
cake
Cake day: June 11th, 2023

help-circle
  • Suppose Microsoft adds this capability to Windows, and you edit the registry to disable it. How is that any different?

    By allowing the end user to change it instead of locking it down, they are not making a good faith effort to comply, and they lose their liability protection. To maintain their immunity, at the very least they will need to prohibit Californians from disabling the feature.

    Canonical is prohibited from adding comparable terms.

    I can see the argument for something like iOS.

    How is iOS any different from Windows here?

    Let’s say you own a computer store in California, you sell Windows laptops, and you setup your preinstalled Windows image with the registry edit made, because customers don’t like the silly age prompt. How are you not the OS Provider?

    Again, to maintain their immunity under this law, they would have to prohibit me from doing this in their licensing agreement. My violation is what protects Microsoft. I would, indeed, be the OS provider in that scenario.

    But in the scenario you describe, I’m not the end user.

    Neither Canonical nor I can include the same restrictive terms in our OS offerings. We can simply inform our users that the OS is not California compliant. Our users become their own OS Providers as soon as they decide to use them in California.


  • And a user of Ubuntu only has access to the functions that Canonical has provided.

    That is not at all accurate.

    Administrator access to Windows is not at all comparable to root access on Linux. Windows “root” access is held solely by Microsoft, and granted only to Microsoft employees and contractors. They are the only ones with the capability of changing Microsoft’s binary blobs.

    Canonical doesn’t restrict root access. Everyone who installs Ubuntu has root access by default.

    Suppose Canonical adds this capability to Ubuntu. Suppose I take an Ubuntu install, and remove this capability. Who is the provider of the resulting OS, Canonical, or me? Obviously, I am responsible for the changes; I am obviously the OS Provider in this scenario. What I am saying is that I was the OS provider before I made the changes. For FOSS software, the end user fits the OS Provider definition that California creates with this law.



  • If your code is installed on a general purpose computing device that is provided to a child, you can be fined.

    If you provide code to the general public without requesting an age signal from the receiver’s OS, you can be fined.

    The attorney general of California might consider the JavaScript in your web page to be “content”. They might consider it to be an “application”. There is no clear distinction. If you request an age signal before providing content, you can be fined. If you fail to request an age signal before providing an application, you can be fined.

    The more I read about this law, the less I think it will actually go into effect. It’s going to face a whole series of injunctions. The lawyers are going to bill thousands of hours, but the whole thing is going to be scrapped.



  • No… The law literally says that if you make a good faith effort then you are not liable.

    It used to be that my liability was to the people using my code. If I code badly, they won’t use it, and I might be blocked from contributing to a project. That was the worst penalty that I faced for providing bad code.

    Now, I might have to argue against a lawyer claiming my mistakes are negligence, and my efforts are in less than good faith, with financial penalties should they prevail.

    They merely need to point to my opposition to this law as evidence that I am not acting “in good faith” to support it.

    Throwing up our hands and exiting California and Colorado is playing into Microsoft’s desires. It is also the only rational response should this law go into effect as planned. Which means the proper course of action is to denounce this idiot law, not lend it our support or rationalize the harm it causes.









  • They control the OS the same amount under either windows or Linux.

    That is false. The Windows sysadmin does not fully control the binary blobs of the OS, including (presumably) the blob that performs this age verification process. If Microsoft is going to be held responsible should that feature be absent, Microsoft is not going to allow that feature to be disabled, unless responsibility for compliance transfers to another “OS Provider”. This restriction is well within Microsoft’s power and control: they do not grant full and total control of the OS to the end user.

    The age-signaling apparatus will be well within the the Linux sysadmin’s control. This is simply the nature of FOSS. The Linux sysadmin can’t be stripped of that control: they control the source code to the OS. They always have the power to determine what functions their OS will and will not perform. Their decision to use such an operating system qualifies them as a “developer” under this law.

    But it isn’t like Canonical and RedHat are just some guy in a basement - these are commercial entities developing and licensing software just like Microsoft.

    Canonical produces a version of Ubuntu with the age signalling apparatus. A California sysadmin installs it on a child’s computer and removes or bypasses the signalling apparatus. Is Canonical still the OS Provider?

    What if he doesn’t disable it, but a bug in the age verification app causes it to fail. Canonical puts out a bug fix in an update, but the sysadmin’s update policies block that update. Canonical can’t force an update in the way that Microsoft can. It is the sysadmin’s choices that are preventing the patch from being applied. Is Canonical still the “OS Provider” under this law? Or is the sysadmin the responsible party?


  • This bill makes the operating system provider the responsible party. They have to implement this, and ensure compliance. Failure is a $2000 fine every time a child launches an application.

    Under this law, Microsoft and Google are charged with implementing this feature and ensuring compliance. They are, obviously, “OS Providers”. They control their respective operating systems.

    With FOSS OSes, Ubuntu isn’t the OS provider. Arch isn’t the OS provider. Debian, Redhat, Gentoo aren’t the OS Providers. The product each of these entities provide is an OS, but it is an OS that is under your full and total control. Not theirs. They cannot control what you do with the OS. They cannot ensure your implementation is compliant with state, local, national, or international law. Under this law they are not the responsible party.

    Under this law. You are the “OS Provider”.