A DeCSS shirt for the late 2020s

So, I see a lot of wittering and gnashing of teeth about online age verification laws. Both in general and specifically as the apply to Linux, BSD, and other open source operating environments. I want to talk about some practical issues around what technology will have to emerge to make them "work" and how easily even moderately technologically aware people can, to be blunt, screw the laws over.

And I want to propose a new fashion that might, just, catch on in the next few years.

What is going on

A few juristictions (including Brazil and California) have passed legislation pertaining to online age reporting and many other jurisdiction seem to be following suit.

Allegedly these are intended—as so many, many bad ideas have been in the past—to Protect The Childred (tm).

They're not going to work any better than content labeling of music, the v-chip, or video game content rating (just to name a few) did¹. I recall a time when every stand-up comedian seemed to have a bit about how parents would have to get their seven-year-olds to program the v-chip just like the kid was the one who set up the VCR. But hey, we have to do something and this is something so obviously we have to do this. Not that I'm depressed by how predicatable all this is or anything.

Why it's weird for open source

There are a few of things going on here. One is structural, one is philosophical, and under all that is brute technological fact.

Structural

While Windows, MacOS, IOS, ChromeOS, and Android² are controlled by large coorporate entities that decide what their customers get to install, Linux, BSD, and other open source operating system are, in principle, fully under control of the individual installing them. The weasle words are in there because few people build out their system from raw parts: they mostly use a distribution, which does have a central point of control (though many offer much more customization that the you get from Apple or MicroSoft).

This is not a funcdametal issue; the kernel and or the encrustation of supporting code could feasibly (I won't say "easily" because I'm not the one programming it) be altered to support the requirements of the laws. And those changes could be incorporated in upcoming distribution releases and make their way out to the mass of users.

But it's not like there is one place to go to try to enforce this decision. Or even ten places. Keep in mind that even if some major distribution (perhaps Ubuntu) were to comply nothing stops a downstream re-packager (say Elementary) from removing, disabling or defanging that support. More on that later.

By the way, there are litteraly scores of distributions originating on all the inhabited continents and from various points in Oceana.

Philosophical

As a generic term "open source" covers a lot of ground, but central to the that nebulous mass broadly known as the open-source/free-software movement we find Creative Common, the Open Source Iniitive, and the Free Software Foundation all of which of are organizations with some money, rather more precisely specified definitions, and some very strong opinions on matters of software control and human flourishing. And they're not the only ones. In fact the space is just crawling with various NGOs that provide legal support, lobbying services, publicity, and (obviously) software packaging.

The whole "the government is telling you how to build your software" thing isn't going down well. You may expect resistance at many levels. Anyone else own a DeCSS shirt?

The foundational reality of Open Source

Programmers program. In one sense that's a tautology, but it has profound implications.

Before delving into what it means for this issue, let's just talk about what it means for organizational cyber security. My employer has recently gone through a series of IT security exercises in an effort to lock down all the possible cyber threats. And they have a problem: what programers do on a day to day basis is indistinguishable from a large class of threats. We create new executables not known to the system and run them. Often dozens of times a day. And that is unavoidable: you can't have the benefits of what programmers do without having the relative chaos of programmers at work.

Similarly, you can't have open source and still be confident that everyone is running the nannyware you insist on. Remember that I said a downstream distributor could strip-out or neuter a reporting facility installed by an upstream provider? Well, in principle every single user is a downstream provider with that same capability. Worse, capable programers can provide tools to enable less capable people to perform the necessary modifications. Indeed, Ageless Linux is already pushing back against early complinace efforts on the part of systemd (the dominant, but often derided, init system on major Linux distros).

Legal aside

I think the intent is that anyone modifying the softawre is the "Provider" that the government enforcers can go after, but if that's just a couple of techy parents who don't want their machine identifying their minor childern to the wider internet, there is a "parent's rights" argument to hang a political and legal challange on.

But ... talk to an actual lawyer in your actual jurisdiction with actual expertese on the legal system you actually might be picked on by before counting on that kind of thing. K?

Speculation on implementation and countermeasures

From ten kilometer altitude, communication between a user's machine and a software store or other endpoint that might want to use a age signal can take one of two forms, and one of them is harder than the other for actual installed systems. You see, one machine has to initiate the conversation, and if that's the store's server, then many home and corporate firewalls will drop the packets on the floor.³ For that reason I suspect the industry will settle on a strategy where the user machine asks the server for a one-off token, hands that to a local age-reporting API which cryptographically mixes it with the answer, and the mixed data is then relayed back to the server for decoding. There are other things they could try, but they're all pretty fragile.

Anyway, on Linux the bit that builds the reply would either be built into the kernel itself or in a kernel module, but either way a savy user will be able to disable them. Then they just substitute a dummy system that respects the protocol, but always returns a least-interesting answer to every query (Yeah, this user is of age. Trust me.).

What Ageless does is more than that: it removes the infrastructure and storage that could be used to respond, which is a good thing, but the above is enough to stop making meaningful responses. And I'll bet a bottle of scotch that the dummy responder can be constructed with code that will fit on a t-shirt.

Intent

I'll write the thing as soon as the spec is available (or grab someone else's if it's avilable, because I'm not stuck about this sort of thing). And then I'll be printing shirts. And maybe hoodies, too. You never know.

---

¹ Which is to say that (a) the kinds of parents who take the trouble to monitor their kids' media consumption will have another tool while other kinds will completely ignore it and (b) the kids will not only find ways around the tech, they'll use the system to advise them where the "good" content is.

² Android is a little weird, because while Google (whatever name they're going by now) controls the system, many devices ship with manufacture customized versions. But it is still the case that there is a corporate entity for the government to go after.

³ And maybe report them to an intrusion detection system, but that's not really relevant here.

Having your "Smart" and your "Open", too

This is the third of a group of of posts on "Smart" appliance. You don't strictly need the first and second entries one to read this, but they're meant to be building up a common context. In this episode I talk about a mechanism that would relieve most of my worries about these devices while allowing manufactures to maintain control of their trade secretes and the presentation of their interfaces.

---

My complaints in the first post aren't intrinsic. Instead they are complaints about a particular implementation of the smart model where the physical device requires a specific (rather than generic) piece of paired software; in that implementation our intellectual property regime around software puts the manufacturer in control your ability to have that software, and consequently puts the manufacture in control of your ability to use an physical device that you bought. That is totally unacceptable.

Out strategic goals are

• Possession of the physical device grants access to its functionality¹ because the requisite software is generic enough to be re-implemented on any suitable platform.
• The manufacture gets to keep their trade secrets to themselves.²

That's an interesting pair, because the first requires that the trade secrets be physically embodied in the machine (otherwise you can't guarantee that the functionality moves with the physical object). But that seems to be in tension with the second requirement, because how can the manufacturer control trade secrets if they're trading freely around the economy?

The thing is that the control software (which is already on board) also encodes the trade secrets. Anyone with the right tools and knowledge can already can extract the firmware, decompile it, and sus out the meaning of resulting code. It's just that that's a pretty hard trick (those boards don't need debug ports and I'd be unsurprised to find that many don't have them) and consequently time consuming and expensive. Then, as always, the legal regime puts up further barriers to someone trying to compete using that approach.

And we deal with systems that have those properties all the time. I'm describing a client-server architecture. The appliance is the server, your phone or tablet is the client, and the manufacturer can hide as much detail as they want server-side. By using open protocols for interchange and open standards to present the interface consumers get a extortion-free way to talk to the appliance, and in return manufacturers get reduced software development costs and all-platform³ functionality for free. It's that easy.

My hot-take, off-the-cuff, proposal for the whole thing: HTML5.

Literally put a little web-server inside every appliance. They already have non-trivial computers and at least one of WiFI or Bluetooth, so this is not a stretch. In the worst case users can use a plain web-browser to access it.⁴ With HTML5, manufacturers can control every aspect of their interface (I mean their pages can just be a canvas if they're that hung up on controlling the appearance), control how much functionality is pushed to the client-side, and so on.

What's not to like?⁵

---

¹ All of it. If you own the thing, you own it. This is non-negotiable.

² Within reason. There is no way to guarantee this absolutely, and (importantly) never has been. Anyone with the tools and expertise has always been able to reverse engineer a product, and it was only ever the high cost of reverse engineering and IP law that prevented them from taking that route to develop a competing product. We're looking for a regime where the level of difficulty in obtaining and profiting from the trade secrets remains similarly high.

³ And not just iOS and Android, either. Everything, everywhere, all at once. As it were.

⁴ I imagine the ecosystem will rapidly spawn a genre of specialized appliance control apps with a HTML renderer at the core, and featuring convenience functions for organization and access, but a plain web-browser provides a fallback position.

⁵ Okay, so there is the addressing problem for devices that use WiFI. Some kind of discovery mechanism will be needed, and I don't know— off the top of my head—what the options for that are. But it's not like this is a new problem: printers and scanners, especially, already handle this in a variety of ways. Similarly bluetooth has a pairing problem to solve, but that's an issue for existing bluetooth devices as well.

The "Smart" appliance policy at Casa NoSwampCoolers

By way of introduction to some follow up posts: appliances that require a external computer to make them go are a kind of cyber vulnerability. The utility of the device is dependent on the availability of a working interface and thus on the whims of a third party. If they drop support; if they decide to lock some features behind a paywall;¹ if they don't support the app on the platform you use, your device is worthless.

While someone could, in principle, program a new interface there are a number of problems:

• Access to information about the device side of the interface. This stuff is trade secrets, and the holders rarely see it as profitable to share it, even if they are no longer supporting the affected devices.
• Good engineering practce may suggest using a a common code base, but manufacturers are also willing to switch hardaware platfomrs to minimize costs. The result is a lot of diversity even within single product lines, as witnessed by the long running struggle to support various peripheries in the linux kernel.
• Finally there are legal barriers to the "just hack it scheme". In the US, for instance, the DMCA, means that the most trival effort by the manufacture to "protect" their kit makes the hacking job a felenoy. Until the right to repair is legally recognized,² this multiplies the difficulties improsed by the others.

So here in Casa NoSwampCoolers we have a three part policy:

• No device which requies an account registered with the manufacturer.
• No device which requies an app provided by the manufacture to access it's core function.
• Any device which requires an app to access special features or functions must be explicitly discussed by the grownups prior to purchase.

The second part of this series will address the engineering reasons in favor of "use you device to control it", and the third will look at a solution that lets us have the upsides without the downsides.

---

¹ No names, BMW.

² I consider that a cause worth my political dollars. Would you care to join me?

A Modest Proposal

I believe proper consideration should be given to the benefits of creating an affirmative defense to charges of assault and battery in the case that the assaultee¹ is a telemarketer.

Now, I'm aware that some people will maintain that only the most hard-up and vulnerable of people will actually take some jobs which is a valuable point. Perhaps the defense could be limited to people of authority in such anti-social enterprises. Say, starting with shift-managers and working up from there certainly to include the technologists who support and enable the whole industry.

---

¹ Note: not "victim", they are very much at fault in the whole interaction.

Duty and painting oneself into a rhetorical corner

Duty is a debt you owe to yourself to fulfill obligations you have assumed voluntarily. Paying that debt can entail anything from years of patient work to instant willingness to die. Difficult it may be, but the reward is self-respect

Robert Heinlein

"Duty" in the sense of an obligation is a politically contentious idea. I am personaly a fan of Heinlein's definition, but it suffers for some people's purposes from not being something that you can dictate as in "Doing [this thing I'm interested in] is your duty". The best you can do is explain to them why you think their self-respect should depend on doing it.

As a legal reality a few "duties" are required and you can be punished if you don't comply. If you are summoned for jury duty and neither provide an excuse the court finds acceptable nor show up you can be held in contempt and subjected to fines or jail time. If you are a young but adult male in the US and don't register with the selective service you can get in trouble. In the same vein, many people were punsihed during the Veitnam war era for draft dodging, which brings us to the culture wars.¹

The political right in the country largely partakes of a long standing view that military service is and should be required of men "in times of war" (which really means at the discretion of the political leadership). Some who don't go quite that far feel that there simply shouldn't be a way for a "real man" to not want to join the fight which is a slightly different take. In either case the point is that the community needs defense at times, and the costs should be widely borne.

The political left, on the other hand, mostly feels that it is the right of every citizen to question the motives behind and necessity of military action and to demur from participating if they find them unsavory or unecessary. Some go so far as to consider it an obligation to make such judgements. Some have even held unwilling particpants in military misadventures responsible for the failing of the political and military leadership under which they served.

That is a stark divide, and has been the cause of much dislike and mistrust between people on opposing political teams for the whole of my lifetime.

Then comes Covid19 and the issues of wearing masks in public, social distancing, enforced closures of some kinds of business and so on...

Suddenly there talk from the left of a duty to protect others by respecting these rules and talk from the right about their right to judge the urgency of the threat, the effectiveness of the suggested measures, and the motives of the leaders.

Laugh or cry.

---

¹ There is, of course, some tension between this notion and that of religious liberty. Quackers, various Menomnites and other conciencious objectors have been a bone of contension on this matter since the beginning of the nation.

"Rights"

I've been thinking about 'rights' as in "constiutional rights" in the context of mask orders.

Leaving aside the reasonableness of mask orders and the long history of the courts upholding public health measures, I've been wondering in particular about why people might¹ claim there is (or should be) a 'Right' to not wear a mask in a retail establishment.

And I think we should see it, at least in part, as pedictable fallout of a long-running campain from the political left.

I'll explain.

Originalism

It is a common argument on the political right (or at least the political right as it was in my younger days) that 'rights' are something that the people have against the government. That's basically the content of the Bill of Rights, after all: things the government may not do to "the people" or to individual people.² In that view restraints may be imposed on people vis a vis other people by way of laws, but those are different from and limited by 'rights'.

Plenty of newfangled models

But here's the thing. For more than my entire lifetime there have been 'rights' that control how a person may interact with another person.³ A business may not discriminate against a person on the basis of a moderately long list of things, right? Nor is this limited to corporate entities (which recieve privileges from the state), but also applies to a person who is simply doing business with their own money. Similarly a business (i.e. even a person) generally may not discriminate in hiring against a person with a recognized disability nor in most cases forbid some service animals.

Now, I think a pedantic examination would suggest that these aren't 'rights', but rather requirements of the Civil Rights Act in the former case and the American's With Disabilities act in the latter (and various pieces of legislation that have followed) and as such are "laws".⁴ But the narrative I see in the popular press uses 'rights' or 'right' on a regular basis. To the extent that the descriptivists have won the argument over the meaning of words, that's a change in the understanding of what a 'Right' is from the beginning of the republic.

Not that am I terribly worked up about it. I'm strongly in favor of treating people decently whatever their color, gender, religion, etc and even ::shudder:: poltical beliefs or favorite college football team.⁵ And I recognize that a coordinated campaign of "individual" intolerance by the majority is completely asymmetric and every bit as oppresive as legal inequality,⁶ so allowing people to freely discrimiante in their public lives would be little if any movement toward equality. Nor do I think it is reasonable to say to the members of an oppresed minority "Well, I think you're right about this, but you really need to suffer for another couple of generation so that we can have a smoother transition with less friction", which seems to be the alternative.

But it sets the rhetorical stage for the idea that people can have 'rights' to deploy against other people

Right 'Rights' right back

The political right has been getting beat up using this language for roughly sixty years, so it shuoldn't come as a surprise to find that they have decided to retailiate in kind. In this the left have won the cultual wars: the rhetorical weapons of choice have become those the left selected way back before I was born.

---

¹ I say "might" because I am just guessing.

² And we'll just not talk about how incredibly wonky it is to have a system that on one hand holds up these shining ideals that people are in many ways more important than governments and on the other lets people be held as property. Denial is not just a big river in Egypt, after all, and even people who try to be rational and principled can suffer from it in startlingly large ways.

³ Here I'm attributing existance to positions held up by the courts and by the Supreme Court in particular. You're welcome to believe (as I do) that some of these are in error, but they are the things that will be enforced for good or for ill.

⁴ Generally the rulings are that the governement may in fact make such a requirement in law.

⁵ "I don't have anything against Buckeyes, but would you want your sibling to marry one?"

⁶ Even if we posit a lack of organized and legally unaddressed violence and intimidation ala Jim Crow (and even if you can belive it starts that way how long do you think it would last in the face of any resistance?).