https://news.ycombinator.com/item?id=49080929

There is discussion about LLMs, models, CSAM, undressing people with AI, and posting those images to places.

No handy wavy stuff, makes this problem go away due to filtering at creation. That's because, open models are a thing. So you either ban all open models, or maybe make it a crime to publish uncensored models, or you punish what individuals do on the internet.

Slander and libel and defamation are a thing, and have been a thing forever, millennia. Suddenly, on the open and free internet, for barely an eyeblink, anyone could say anything with zero liability and responsibility.

Then, 2010s came. Then, doxing of people we didn't like, or didn't agree with, became OK. So suddenly, it was OK to "out" a person, but not to just force everyone to be de-anonymoized. In other words, unpopular opinions? Yeah, that's OK to remove the cloak.

And with AI, everyone and their dog will be able to render images of anyone they want naked. CSAM. Political lies, made up videos, slander, libel, literal wors in people's mouths, on and on.

What's my point?

Well, just as 2000 brought a new world to people, 2025 is doing the same.

This is only going to get worse. And I fully agree, the dangers for "control" are going to exist. But the dangers of people posting all of this stuff, has hit the point where a lot of people are uncomfortable with it. And if you think Grok creating CSAM is bad, then you must think anyone creating CSAM is bad. Or anything. So how to you prevent the harm?

Well really, you either heavily restrict software. Open LLMs, or?

You make people posting this stuff liable.

The world is at a fork. Everything will change. Because banning software requires immense control over hosting software, but so does deanonymizing the internet. And really, this is inline with how the political and societal landscape changes.

It's only been 20 years since a lot of people were on the Internet, and only 10 years since I'd label it 'mainstream'. As in, even grandma uses it. And so, now the laws are coming, as legislation and law and change takes time for politicians, and political bodies.

We're here. Right now. This is the moment.

So I 100% guarantee that absolutely nothing will stop the path to liability for slander, libel, and more that is coming. Nothing. Whatever it takes, you can be sure it will happen.

So how will it happen?

Well, by knowing who to sue.

Like it or not, that's the truth. And no, I don't like it myself.

By all means, if you have an adversarial relationship with the state, fight every expansion of its power tooth and nail. But conversely, if you think that everything is going basically fine and the police are reasonable folks overall, then giving them more power doesn't look like a slippery slope straight to dystopia.

I don't see any proposals yet that will actually work for what they say they'll do.

You can do that already, Facebook is pretty close to exactly what you're talking about. They do a lot of work to identify real people and de-prioritize spam/bots. You can configure your account to only be able to interact with real people if you want. Many people like anonymity though, it's important for speaking truth to power and discussing topics which are outside the Overton window.

There's a good reason that many of the United States' founding fathers used pseudonyms when writing. Anonymity and real freedom of speech are foundational to democracy. If you can put someone in jail for saying something that the government doesn't like, then the government will be able to steer discourse towards outcomes it deems acceptable, even if those outcomes subvert the will of the people.

There's no real need to have the government force all websites to always authenticate all humans. The only real argument for such a system is to move us toward dystopian authoritarianism.

It is trivial to demonstrate that this is incorrect (despite sounding plausible). There's plenty of incredibly toxic behavior to be found all over facebook.

Among other considerations it's worth noting that most of the usual social feedback mechanisms are missing from typical online interactions.

> The cost of running LLM botnets is going down.

Agreed that this is an existential threat to anonymous discourse as it is typically implemented.

Are you seriously saying that with a straight face while (apparently) living in Germany of all places?

May I suggest picking up a history book or two?

'Something impossible for kids to bypass' is not the goal. It's akin to evaluating a flu vaccine on the standard of zero breakthrough cases. Such a standard has no relevance on the efficacy of the vaccine.

Likewise for underage internet access. Proponents would be happily satisfied with 90% compliance. They really don't care that coverage isn't complete or circumvention is complete. Once you realize that, you can start constructing counterarguments that dismantle the claim that digital IDs would solve the problems they're supposed to.

This only makes sense if you have no concept of "future", wherein different, less reasonable people can gain power. This should be especially obvious in Germany, where an adversarial relationship with the state can easily be had by merely criticizing it.

>r warrant was for a different address and they left.

I am sorry but this is not something that I find "reasonable" or "positive impression" unless small children are the instigators or low stakes events are involved. If armed men are barging into sacred spaces they need to be able to triple, quadruple check they are performing what the warrant says and if not then nothing else they are doing shall be trusted either. Invading a home uninvited is a life and death matter and there is no room for policeman who make such glaring mistakes even if the natural untrained or undisciplined random person naturally might.

Kids these days have it too easy, we need stronger protections or the next generation will make pathetic hackers.

Now... how to effectively address this problem without introducing a dystopian surveillance state? I don't have a good answer.

That we aren't doing something like this gives the game away. How the EU is going about this means the point of all of this has nothing to do with children and everything to do with controlling political speech.

PS Yea, I know its a very vague suggestion, it can still be implemented

When you're age-checked on the internet, a scan of your ID goes on the website, then is likely forwarded to a helpful third party business. It extracts every bit of data, analyzes your picture, then carefully saves and catalogues everything, and returns True to the website, which may have also stored their own copy of this data, depending on how the process is implemented. This data is now in their hands forever. If, at any point in the future, you access another age-gated website that uses the same third party business, now there's nothing stopping them from correlating that private browsing data. How juicy. Adtech will love that. As you keep handing out your ID left and right, every single bit you divulge is recorded somewhere, forever. And at the end of the day, this is just moving data around, so there's nothing preventing your government, or the host's government, or all governments from passing a law that asks for that data to be shared with them - just in case, you know. Now there's many copies of your exact identity floating around, just one data leak or legal request away from revealing everything you've ever done tied in a neat little package. Real life ID is limited by constraints of practicality and our physical world, digital ID is limited by nothing.

And this is the best-case scenario I'm describing here. Imagine if they ask us to show our identities publicly, not just to the corporate all-seeing-eyes. Everyone would become doxxable by default, their whole life exposed and searchable, the mere idea of having secrets would be wiped away, communities made for marginalized or at-risk people would all fall silent.

Yes, there are ideas about zero-knowledge proofs and legislation about data privacy and whatever else. But these don't benefit either corporations or governments, and the average Joe doesn't care about putting his real name on everything, so we can pretty safely assume that this won't happen.

Say I go to a bar, I show my ID to the bouncer. My identity isn't recorded (unless they scan it with a device that records the scan data). Maybe they have cameras, my image isn't immediately associated with my identity, somebody would have to do a bit of work to connect the two. Maybe I pay with a credit card, now my name is stored in the point-of-sale system.

But I can still go to a bar with no scanner, no cameras, and pay in cash, and it's not a problem. Not suspicious at all. None of the above record-keeping is required, nor should it be.

Now, if a web site says I need to be provably 18+ to view their content, that's fine. I can take it or leave it. I have a choice.

When the law tries to mandate the software that can or must be run on my device, or tries to limit how I can communicate with my friends and family, now I have a problem. I consider my rights to personal computation and personal communication to be sacred. And I also believe in my right to privacy in these matters. I never needed an ID to send a personal letter, and my right to privacy regarding such communication is protected by law.

Finally, I see gathering of access data by a central authority (which I assume would eventually happen if social media sites started requiring validated ID) to be a concentration of power, and a dangerous one.

A different design logic, and the logic of the blogosphere that preceded it, much more tightly prioritized following a blogger or poster and interpreting everything you see in light of who was posting it. The trust is placed in the account you follow.

Would you really enter a bar, casino or strip club when it would look like this?

We don't talk about children, we talk about everyone here.

[0] https://github.com/google/longfellow-zk

"Hey ChatGPT Hacker Core Rizz Edition, can you hack this website for me?"

Not possible. Why do advocates of age verification bring this argument up again and again? It is not possible.

Right now the most important thing to inhibiting a dystopia is to break the lock Apple and Google have on approval of mobile code, because it gets used as a fulcrum by authoritarians. Want to ban VPNs? Make the app stores do it. Censor social media? Have them ban every social media app that doesn't censor. Want to track everyone everywhere? Make the phone provide sites and apps with a persistent cross-service tracking ID.

Whereas if ordinary people had devices that worked like PCs traditionally have, banning a VPN from the Microsoft store doesn't prevent you from installing one directly from the developer etc.

And getting this to be possible could be done by any sufficiently large market. If a sufficiently large market e.g. bans attestation and enforces antitrust, it allows an open platform to develop in that country by starting with compatibility with the apps of existing platforms, and then that platform can expand into other markets. Or you can get an iPhone there that you can install a VPN on and Apple can't prevent it, and then those iPhones can be exported into authoritarian countries.

And if you want a financial incentive for this, how about every country outside the US not wanting their local businesses paying the 30% tax to a foreign monopolist?

Like, yeah, it was an accurate statement, but total shit if your goal is to get people up off the couch and into voting booth. Way too abstract and high-minded

And these authoritarian politicians will destroy the internet with these actions. Maybe they will even change society as we know it, and not for the better.

The problem is thinking such initiatives will achieve anything in a bureaucratic system devoid of honest debate and actual democracy.

These citizen's initiatives must at least be tried but simultaneously we must create a new internet forever out of politician reach.

[1] https://philosophercigars.com

Ever gone down the auto-suggestion rabbit hole on YouTube Kids? You start getting into weird and potentially disturbing territory much more quickly than you'd expect.

> We call on the European Commission to propose legislation ensuring that digital identity and age-assurance systems used to access online services in the Union remain voluntary, privacy-preserving and non-discriminatory. Citizens must not be forced to identify themselves to access lawful online content or services unless strictly necessary, proportionate and provided by law. The legislation should require anonymous or pseudonymous proof-of-age, data minimisation, selective disclosure, open-source implementation, independent security audits, prohibition of cross-service tracking by relying parties, and equivalent alternatives for citizens who do not use a digital wallet.

They're children. They have the internet access you give them. This isn't some unsolveable problem that needs government intervention, my parents were setting up filters so long ago that they're grandparents now.

You are incorrect. The NIMBY movement has been extraordinarily successful despite severe opposition from moneyed interests. Bloomberg lost embarrassingly despite setting records for campaign spending. There are countless similar examples.

I think it's time that "please let 1800 analytics firms monitor your every browsing habit in exchange for this content" was seen in the same light as "please let 1800 private foreign espionage and propaganda agencies spy on you".

But is it comparable to the amount of toxic behavior on 4chan?

That's a tall order, although there are plenty of reports of younger people switching to "dumb phones." I've switched to one myself. But how could you possibly stop it? They are terrible -- now that I don't have one anymore it's insane how many people are constantly staring at their phones, walking on the sidewalk, crossing the street, etc. It's really depressing.

But ya, at this point I don't care if parts of the internet are fine and if I had the power to burn it all down, I would.

To my understanding then, the issue is that the EU's implementation only has a ZK-based solution in the plans so far.

But then this initiative says "No Digital ID", not "No Auto-Deanonymizable Digital ID", so...

But I still believe that people will care about connecting with an actual person in meatspace. I just can't picture any other result except for complete and total burnout with the fakeness of the web.

"Persistent" reputation won't change that. Because on the internet nothing is persistent, without a central party enforcing it to be so. And as said above, the ones in charge of it now, don't want to enforce it really. You don't own your domain, you don't own your IP, you don't own your feeds, "content" etc. The infrastructure that routes people to your correct "reputation", isn't yours, it's controlled and owned by Big Tech, governments, and some smaller companies. Your feed can be taken offline or away from you in a whim. Access to your blog isn't yours. Not even if you host it on a rasberry-pi in your cupboard.

Aside from maybe some blockchain shenanigans, that is. Bitcoin and maybe Ethereum are the only decentralized "pseudonymous" identity providers that could step into this, but both are ridiculously costly and complex. And wholly unsuited to route content. Systems designed for this, like Tor, aren't really up to the task either. Just look at how insanely hard it is for "Content" that governments oppose, to remain online (e.g. on the tor network). Possible, but so complex, so fragile, that it's not a practical system to use en masse. Yet it's the only working system that comes closest to really owning content in the broad sense.

So it makes perfect sense to turn to the systems that have done this "persistent reputation", aka "identity" for centuries now: Governments. Compared to Big Tech, they're more decentralized - there are far more governments worldwide "doing identities" than there are FAANG corporations. Hell, even within the US or within my country alone, there are more. Compared with all other systems, we can control them, push them into a direction we want them to go - democracy. Far from perfect. Bad even. But the least worst way to have some "persistent identity" we can get. Unfortunately.

Heck, the parallel movement in the US even had a major legislative victory in California, so... what are we talking about?

I think the problem is that GDPR focuses on consent more than would be prudent. Regulation is usually introduced when some actions are not appropriate even when there was consent. For example, one is not allowed to sell spoiled food, no matter how clear warnings they gave to the customers.

PS The dishes are hard (but not impossible) to hide.

Specifically, the requirement to provide non-digital alternatives as well as control over relying parties (i.e. consumers of the 'digital ID' and/or 'age verification' APIs) makes all of this a non-starter.

I mean: non-digital alternatives to digital IDs? I guess that means that nobody should be forced to get a digital ID for access to essential government(-ish) services (like banking), and that's a valid point, but in the context of "stop killing the Internet" just obfuscates things.

And control over RPs beyond GDPR is just pushing it, again, quite on purpose.

Written in 1960, but very prescient.

Loving your children means fighting censorship, not promoting it.

You could make same exact argument regarding kids health, alcohol abuse, nicotine abuse, all types of addictions, age of consent, and so on.

You can't just have all the safeguards dropped because you think you're doing a good job. Or, even worse, you have no kids and it's your virtues merely projecting.

Ah, OK, so you admit a problem exists. That's step one...

It would be nice to have some good standard that is less invasive.

"The Internet sucks. Get offline," is the battle cry of someone who likes Marvel movies and the book that Target has at the checkout line, or lives in one of about five cities in the USA.

People remembering your handle is persistent, and people remembering if they had good or annoying interactions with you is persistent reputation that exists in the minds and interactions between different people. These are things people naturally do. If people don’t recognize your name and see it come in a trusted spot they just don’t trust you.

How tech breaks this is deprioritizes the people in the interactions. Instead of sending messages you use a “like” button to be intelligible to the platform. You don’t see the people putting stuff on your feed, it gets fed to a timeline that cuts it off from all context and atomizes it for your consumption. It’s the UI/UX that drives this. Even compare Reddit and HN with old forums. On forums like 25% of every post is just static bits of self-expression. There’s a PFP, the username is bigger, there’s often a big signature block. All of this makes the peoples’ posts feel like a person talking to you rather than text blocks that happen to have a tiny username and timestamp on it.

From both someone involved in raising kids as well as someone who knows a lot of teachers: none of the involved parties want that. Schools are at best for teaching, but never for raising.

"It takes a village to raise a child." Except these same parents who won't take care of their kids are also the very first who go all "How dare you speak to my child like that! I'm going to have you fired!"

Don't let kids have an internet-connected phone, the same way they can't have a bottle of wine.

If they really need such device make sure that device is locked to a small list of app/contacts possible.

There's no need to lock down the rest of the internet because the responsible person of such kid can't tolerate their complaints. It is a parenting issue.

Okay but for your position to be tenable you have to then go to step 2, which is some parents are incompetent at doing this, and step 3, which is that, nevertheless, their children, who are randomized copies of them genetically, still somehow need and benefit from the filters that their parents can't or won't apply. Then you get to step 4, which is that all of the competent people must suffer so those children can get it from a heavy handed government solution. I don't see how you jointly accept all these steps; it means you want to have a tyranny of the incompetent over the competent. You must jointly assert that they are dumb while placing them up and over the not dumb. That's full on crab-bucket, dysgenics by force ideology.

Every power you grant the government is another knife they'll eventually stab you in the back with. Maybe you like your current government, but what about the next one, and the one after that?

Instead, just use the tools you already have access to. I was not opposed when California mandated that applications add parental controls, that's fine. If parents want to restrict their children's internet access, there's a continium there ranging from "prudent parenting" to "child abuse", but that can be worked out on a case-by-case basis. I am, however, rabidly against the state requiring you to dox yourself every time you log into a website, because inconceivably lazy parents can't figure out how to use the parental tools that they already have.

Edit: to clarify: You aren't your handle, because it can be taken away from you, can be injected, blocked, overridden, etc.

My technical rambling then went on about how or when we can make this "handle" decentralized so it cannot be taken away from you. Hard. As proven in practice. Almost impossible.

My name is maintained by a government. It is a "handle" that could be taken away too, but is governed in lots of rules, systems and regulations. My face (an extension of my DNA, I guess) is decentralized and owned by me: its the only handle that afaik no one can take from me.

So in social interactions, you're right: reputation, bound to "me", my face, my DNA is all that matters. But online we don't have this. The closest we can probably get is "my name", controlled by governments.

Sincerely, your fellow terminally online HN commenter.

The saying is about kids watching and learning from their environment - from how adults act. If you set up to be jerk or take advantage of random kids that happen to be around, you are teaching them to take advantage of people. And no amount of yelling "their parents are responsible because they did not stopped me" is going to change that.

We’ve had a live experiment with this during COVID and it’s pretty clear that kids raised solely at home by their parents fared way worse. Not just on academic metrics, but basic conflict resolution or social skills.

Is it the sole responsibility of a school to ensure well raised (for whichever specific definition of “well”) children? No. However, they are a large factor in the raising of children.

Unless your point was that we should legally ban kids from handling phones, which I think is too extreme.

I have seen religious parents been vocally opposed to their children seeing or even discussing anything related to sexuality.

An example from the past:

"The National Legion of Decency, also known as the Catholic Legion of Decency, was an American Catholic group founded in 1934 by the Archbishop of Cincinnati, John T. McNicholas, as an organization dedicated to identifying objectionable content in motion pictures on behalf of Catholic audiences."

https://en.wikipedia.org/wiki/Legion_of_Decency

https://www.archbalt.org/catholicism-influenced-moviemaking-...

The mail order wine stuff is way older and under way different rules than most other alcohol delivery services.

PS Also, no solution would ever be perfect. Walls don't deny access, they change traffic patterns. So if it works 99% of the time, its good enough.

And don’t pay attention to downvotes, that’s part of the game, it’s nothing against you, just accept that sometimes you lose karma :) in some way it’s a good exercise for the ego

The joke about middle-of-nowhere towns is that the only thing for teens to do in meatspace is to go to the Walmart. Because there's nothing else to do.

This is a good point. I wrote a self-deprecating post to Reddit one time that got flagged by AI or someone who isn't a native English speaker as a "threat of violence." This is almost word for word the exchange that triggered it:

Me: [some in-depth discussion of electrical wiring in a house]

Other person: Wow, thank you so much! I would hire you to fix my wiring!

Me: haha oh I'd probably find some other way to burn your house down

The final line was meant to be a humble way of dismissing the compliment by playing down my expertise. But someone with the power to ban accounts parsed this as "I am going to commit arson."

And so I lost the ability to DM any of my friends. My entire reputation was gone. This was a nearly 20yo Reddit account.

And I can't make a new account and tell people "this used to be me" because then Reddit bans your new account because it's against the rules to create a new account if you've been banned.

Yes, I've created other accounts since then. But I can't ever link them to my old one because Reddit will just ban the new ones. (I tried this, and that's exactly what happened.)

I can't even participate on the same subreddits because there's some algo that recognizes if two accounts have similar subscription habits and does some kind of analysis to guess at if it's a person evading a ban.

I was shocked at first (I was in the mid of organizing an event using Reddit in part for communications, and had to rely on an IRL friend who was helping rn it to speak for me), and then angry, and then just sad.

It's one reason I've begun using one moniker everywhere, and I own that domain name as well. It's the closest I can get to fully owning my handle.

I wouldn't think that COVID is a good indicator as this was in no way typical home-schooling. The vast majority of kids were going to school "online," and not schooled by their parents. They were also largely confined indoors with their families all day and all evening.

I'm having trouble making my other point without slipping deep into trying to define "raising," so I'm just going to hit "reply" here.

I'm guessing you don't have kids.

Chase the responsible adult if you see a kid with an overpowered phone, much like you would if you found the same kid with a bottle of wine.

And granted, we don't have locked-enough phone in market yet, but that's a solvable problem if we were to create that market.

Expecting platform monopolists and dopamine dealers to design for this is folly. They are wired to try to normalize an unhealthy level of dependence on them. Their business model is addiction.

So I do the same as you. But I am quite sure e.g. The Great Musk In All His Wisdom will one day either find me annoying and hand over the now discontinued x.com/berkes to someone who agrees better whith His views. Or decides his politics are better served by raising accounts from the deaths and making some AI voice act like me, that spew political messages.

I own "berkes" about everywhere. But nowhere do I really own it. Not even the domain name. The only handle I truly own is some bc1q....... address. One that has -by design- no reputation and one that's impossible to write in pen on the back of a beermat after a nice discussion in a bar.

For the EU, this has nothing to do with kids.

The laws do indeed vary by state.

You are full of shit. Opinion safely discarded.

https://www.pa.gov/agencies/lcb/shop-wine-spirits/direct-win...

>The laws do indeed vary by state.

I am not disputing that. I am disputing that "most US states, they require the delivery driver to recheck the ID in person" (the original comment I was replying to). "UPS or fedex has to check" is meaningless since they have no idea what it is and essentially no historical nor practical route to prosecution of a common-carrier deliveryman who has no idea what is in the package and no mens rea for wittingly transmitting alcohol to a minor. The states that require adult signature on common carrier delivery essentially have zero legally binding requirement as the deliveryman in most states can't be successfully prosecuted unless there is mens rea that they had prior knowledge the non-descript package was alcohol and the economics of common carrier delivery practically guarantee they will not check IDs when requested to. Thus the "requirement to check at delivery" for mail order wine is actually just a weakest of suggestions with a wink and a nod with no teeth.