4 ms·

There should not be an HTTP header indicating that the client is a child-locked device. That puts the onus on the server to respect the header, and HTTP doesn'

by kragen 5d ago

There should not be an HTTP header indicating that the client is a child-locked device. That puts the onus on the server to respect the header, and HTTP doesn't require any action on unrecognized headers. Also, it reveals to the server that the client's user is likely vulnerable to manipulation — exactly the opposite of what you want! Instead, there should be an HTTP header indicating that the server is an adult-only website. Then, child-locked devices can refuse to show the content to their users. Moreover, this can be more granular than just a single adult-only bit. This standard has existed for 30 years and was supported in Internet Explorer 3; it's called PICS: https://en.wikipedia.org/wiki/Platform_for_Internet_Content_Selection https://en.wikipedia.org/wiki/Platform_for_Internet_Content_... If the current age verification controversy was intended to protect children rather than destroy anonymous speech, it would be focused on requiring the implementation of PICS or something similar.

skybrian 4d ago
That standard is mostly used to indicate “adult” websites (porn, basically) which is useful, but rather a different thing than what I’m advocating. There are many websites intended for adults that should not be blocked when Google’s safe search is turned on. It should be possible to write a web crawler for the children’s Internet. Whether it’s a client-side or server-side header doesn’t matter for that use case. Roughly distinguishing between children and adults based on behavior can’t be stopped and shouldn’t be considered a privacy violation. For example, see how Lego does it: https://www.lego.com/en-us https://www.lego.com/en-us A client-side header would let them do a redirect instead of a dialog box. There could be alternatively be a server-side header that causes a redirect, but either way, they could distinguish child-locked devices from unlocked based on the destination of the redirect.

by kragen 5d ago

skybrian 4d ago

That standard is mostly used to indicate “adult” websites (porn, basically) which is useful, but rather a different thing than what I’m advocating. There are many websites intended for adults that should not be blocked when Google’s safe search is turned on. It should be possible to write a web crawler for the children’s Internet. Whether it’s a client-side or server-side header doesn’t matter for that use case. Roughly distinguishing between children and adults based on behavior can’t be stopped and shouldn’t be considered a privacy violation. For example, see how Lego does it: https://www.lego.com/en-us https://www.lego.com/en-us A client-side header would let them do a redirect instead of a dialog box. There could be alternatively be a server-side header that causes a redirect, but either way, they could distinguish child-locked devices from unlocked based on the destination of the redirect.