There's just shy of 200 countries in the world. That's a lot of product managers already! But if provinces/regions/us states all decide they too can define how software has to work, we are up to thousands of little emperors all telling the world how we have to think, how we have to compute.

It's frelling disgusting.

This effort here has similar vibes to Chrome's Digital Credentials API. Which can be privacy preserving, but where site's can demand basically whatever they want. Either way, each site is returned material, that it then has to verify. So we are back to only approved identity working. And it seems unlikely credential issuers will willingly work with anything but 1st tier browsers/OSes. https://developer.chrome.com/blog/digital-credentials-api-sh...

It feels like a sure creeping doom that the internet is not going to be available in many places, except by commercial OSes that use DRM and attestation to deny users access to their own systems. This is against mankind, and imo, against every spiritual fiber that made man a great creature & arose us to what we are. To deny us a view of the world is to deny us from being toolmakers, is to mame our senses. This is an affront to our humankind. This making the machines infernal.

The real challenge will be ensuring this doesn't inadvertently entrench the gatekeeping power of major OS vendors or create a single point of failure for identity tracking. However, from a data-minimization standpoint, it feels like a more robust approach than the current fragmented landscape of requiring users to upload sensitive IDs to dozens of different websites.

From my admittedly poor understand of legal stuff, these are largely proactive measures happening at company and state level. Congress nor Supreme Court have issued any rulings around this yet.

I mean, if android allows sideloading anyone would be easily able to get around these checks am I right?

Here are the definitions from the bill in a more reasonable order than they are presented there:

> "DEVICE" MEANS ANY GENERAL-PURPOSE COMPUTING DEVICE THAT CAN ACCESS A COVERED APPLICATION STORE OR DOWNLOAD AN APPLICATION.

> "COVERED APPLICATION STORE" MEANS A PUBLICLY AVAILABLE INTERNET WEBSITE, SOFTWARE APPLICATION, ONLINE SERVICE, OR PLATFORM THAT DISTRIBUTES AND FACILITATES THE DOWNLOAD OF APPLICATIONS FROM THIRD-PARTY DEVELOPERS TO USERS OF DEVICES.

> "APPLICATION" MEANS A SOFTWARE APPLICATION THAT MAY BE RUN OR DIRECTED BY A USER ON A DEVICE.

> "DEVELOPER" MEANS A PERSON THAT WRITES, CREATES, MAINTAINS, OR CONTROLS AN APPLICATION.

The law applies to Operating System providers that runs on such a device:

> "OPERATING SYSTEM PROVIDER" MEANS A PERSON THAT DEVELOPS, LICENSES, OR CONTROLS THE OPERATING SYSTEM SOFTWARE ON A DEVICE.

Basically every Linux distro falls under this. Never mind the fact that OS providers don't really have control over where you run their code. If my device doesn't have a network card, does that mean my OS can skip this?

This also is not privacy preserving. It does require the device only report what age bracket a user belongs too, but on a long enough time frame, anyone currently under that age of 18 has their age accurately disclosed, often down to their birthday.

Worse, all applications MUST query this information every time it is run, regardless of whether or not age is at play. Every time you run grep, grep needs to know how old you are:

> A DEVELOPER SHALL REQUEST AN AGE SIGNAL WITH RESPECT TO A PARTICULAR USER FROM AN OPERATING SYSTEM PROVIDER OR A COVERED APPLICATION STORE WHEN THE DEVELOPER'S APPLICATION IS DOWNLOADED AND LAUNCHED.

Now, oddly, user is defined to be minors:

> "USER" MEANS A MINOR WHO IS THE PRIMARY USER OF A DEVICE.

But, the way the law is written, the implementation necessarily applies to everyone.