Have you actually read it? It does not sound like anything drafted by
a lawyer: some makes no sense at all. It’s theater.
Also, since it appears as part of their Copyright section which includes
BSD, GPL, and other licenses, their position as providers of a
derivative work would seem to make their posture untenable. You cannot
provide software under the GPL and restrict it to particular groups
or prohibit some from using it. The GPL specifically excludes such
“further restrictions”, which would limit user freedoms.
I am no doubt confidently incorrect about this, but I am sure that idle
discussion here is fruitless. We should see what legal challenges arise,
how the upstream providers react following the legal advice they receive,
and then decide what steps to take.
To any one who wants to continue the discussion, it should be a
prerequisite that you actually read AB 1043.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
I am afraid I am losing my understanding of this issue completely. If some developers located in, say, Zimbabwe, have created something and published it under GPL, why should or could they be forced to look at a law created by some brain-dead politician in, say, the Heard and McDonald islands? Fortunately, there is still no worldwide regulation that could apply to such a situation, and it would be up to users in the Heard and McDonald Islands to decide whether to use this software. (As far as I remember, there are only penguins, and so, living there.)
Now replace the Heard and McDonald islands with California, and the situation stays the same, although there is an orange in Washington who tries to change that. But we are not yet at a point where this has happened. So, not being a lawyer, I see no need for open source developers working under GPL to care for laws made in some backwater - and I fear some people in California are trying to make their state a technological backwater.
It is true that there are few worldwide regulations, but it is long
established that states and countries can pass laws that govern imports.
I cannot buy chewing gum, regardless of how much is produced in the US,
and of what quality: many electronic devices can only be imported if
they meet stringent local regulations.
The argument would, I think, be that providers who supply to Californian
residents must ensure that the product they supply includes the age
verification mechanism set out in AB 1043. That law is untested and
subject to legal challenge, as well as being poorly drafted. (Eg It
requires a means to input age of a user defined as a child but also
requires an API that can return “Over 18”.)
There will also be questions about who is subject - where is Debian
located? (Not an issue for RedHat: North Carolina.) Do unpaid
volunteer developers fall within the term “operating system provider”?
Is it a law that is enforceable? None of these questions will be answered
by discussion here, unless contributors knowledgable in California and
US law will step up.
Even then, the impact on Qubes is uncertain - civil penalties from
the US are rarely enforceable outside the US, only in very specific
circumstances, and subject to local laws. Of course, no one wants to
see Marek apprehended at LAX, which is why decisions should be taken
based on informed advice.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
I had forgotten about Tor/Tails joining forces. As you say, the legal
interpretation of that will count, but I am sure that the Tor project
are considering their position, and taking legal advice.
For the rest, and others you have not cited, the major takeaway is that
the sensible approach is to wait for the leadership to take a decision
based on legal advice. I would hope that members of the Qubes community
would do the same. If I see a PR introducing an Age verification form as
part of the installation process, I am likely to explode.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
I consider “California law” as example to threat vector to privacy and freedom, today is California, tomorrow it will be European Union.
So as proactive defender I think about possible next step from offensive side against me.
This is quite comprehensive, but it will not work. Even with the proposed framework, legislators are creating nonsense at a much faster rate than could be followed by any software developers.
And it will not be sufficient. Surely, it will be capable of killing any official Debian distribution, but as long as you can get the original sources - which are protected by the freedom of speech act - you may build your own system. Here, Intel and AMD cooperation is required, such that only allowed systems, preferably Windows, can be run on commercially available hardware.
If you do that the orange will send you a beautiful armada (for peace making, ya know). So make a deal now, or bad things will happen.
It is amazing how quickly developers of free software (which is a whole ideology itself) can bow to the feet of those in power (“democratically elected”).
O’er the land of the free and the home of the brave.
I see a near-future where every existing distro has its ‘dark’ clone, run by one or more GPG keys (nothing else can be known), hosted and distributed on .onion + .i2p + hyphanet + torrent. Divorce actual developer identity from the project as identity is becoming a liability to writing Free Software.
Developers trying to straddle both sides of this fence must beware stylometric analysis is a thing you can buy right now to deanonymize people with.
Maybe coming up with a “Qubes from Scratch [and a Small Tarball]” book might help, which walks the user through Linux From Scratch plus Xen plus Qubes infrastructure tarball for dom0, and from there the user now has the skill to build his templates.
Hard for a printed book to ask for age. User is building his own operating system so he can be as noncompliant as he wishes.
Is giving the user a source code library and a compilation environment providing an operating system? Or is the user building his own operating system and therefore falling under caveat emptor? This could be important for Gentoo, if an “operating system factory” is itself an operating system for this travesty of a statute.
So far I see only one option for pushing back against age verification. Anonymous os development. It’s not realistic. How many people will actually take the same amount of precautions darknet vendors take to just develop an operating system? For free?
And if it will be implemented then there will be a convenient list of everyone who does not have this age verification api installed
