kbal / is on Nostr

I'd appreciate it if everyone could just stop burning fossil fuels, please. Thank you for your cooperation.

Last Notes

2025-04-25 05:57:48

- reply

Okay I can imagine it being similar to a yubikey, albeit one with a totally new protocol along the lines of what you described. But it occurs to me that people wanting to share their age credentials with friends or strangers wouldn't actually need to give up the keys to anyone. People could run rate-limited age verifier relay services using their legit keypairs without having to compromise their ownership of those keys, similar to the way some people are willing to run bittorrent clients today.
If we assume that anyone who puts in a little effort being able to bypass this elaborate system is not a problem because it's only meant to deter people who can't be bothered, I guess it only remains to design the Tor-like service over which this will run and make it resistant to traffic analysis.
Anyway, thank you for being patient with my questions.

2025-04-25 01:18:17

- reply

Maybe that could be kept under control by making the keys valuable — hard to replace and maybe even the same keypair that's used for age verifying your mastodon login also used for more important things. But key management is probably going to be a nightmare. Just ask the cryptocurrency guys.

2025-04-25 01:09:32

- reply

I'm not imagining a friendly adult signing in for their child, I'm thinking a completely automated service that instantly gets past age verification for anyone who signs up for it by sharing a pool of stolen, purchased, fraudulently obtained, or willingly shared IDs.

2025-04-25 00:55:56

- reply

The ID server knows who its response is about, but it does not know if they're the person using the website.

2025-04-25 00:47:47

- reply

Okay, there is a nonce. Presumably it is negotiated somehow to prevent the Website from hiding any info in it. But then the question for the ID server is simply "Does a user who knows this nonce have access to a keypair indicating the right age range?" The user (i.e. the "trusted app" that is in their control) can then simply send that question off to Charlie or whoever and get the desired answer to relay to the Website without revealing to anyone any secrets of their own. The ID server has no way to know it was proving the age of the wrong person, the Website doesn't know who it actually got an age for, and neither can identify the actual user.
I think the people implementing these age verification schemes do want to try and defend against that sort of thing, because both the ones I've seen so far in reality (the one from Spain and some other thing a couple years ago that was closer to your idea) seem to have willingly sacrificed any semblance of privacy in their efforts to prevent it.

2025-04-24 22:51:18

- reply

One particular way in which the story makes no sense to me: The website wants to ask a question about "the visitor." How does it identify the visitor in its message to the central authority? If nothing prevents it, said visitor could simply pass the question on to Charlie's Web Age Verifier Bypass Service down the road which is in posession of an age-appropriate keypair, and relay the response in an automated fashion. How does one prevent that?
I mean it's not as if people wouldn't do it. Borrowing an older kid's ID to buy beer was commonplace when I was younger. Imagine if it could be done automatically, instantly, on a large scale. Shutting down The Pirate Bay is already nigh-impossible for the powers of law and order, it seems. Imagine if everyone under the age of 31 had to use it if they wanted to connect to Instagram.

2025-04-24 22:24:35

- reply

That protocol is simplified to the point where it makes no sense and thus we cannot really evaluate its security, but yeah, I was glad to see that you do get around to semi-acknowledging that a scheme like that would need to rely on some kind of service like Tor to begin to provide any semblance of privacy. Even then the central authority would have a record of it every time each of us hit an age gate, which is valuable metadata to be giving away whether or not it's probably just pornography.
Lots of people seem eager to claim that it can feasibly be done in a privacy-safe way but I still have yet to be convinced of it.
And it's all just to set up a new system of oppression with the other problems you mention. It seems utterly ridiculous.

2025-01-29 19:10:31

- reply

When a literal hammer is liberated by workers who put it to use dismantling the master's house, it can no longer be counted among the master's tools.

2024-12-31 13:38:22

- reply

Finally, an AI so smart that it can tell us that the wikipedia entry for "orbit" is about orbits.

2024-11-14 21:26:40

- reply

Why are you shilling for like six different things at once? You'll never make a living at it that way.

2024-10-04 12:28:11

- reply

Vivaldi is not free software, and therefore not a suitable replacement for Firefox. Please stop polluting the #linux and #firefox tags with your ads for it.

2024-09-30 21:00:25

- reply

I guess printer ink cartridges come to mind before razor blades since they haven't yet figured out how to get computers involved in shaving, and because in many parts of the world today people don't even remember when standard interchangeable razor blades were the norm. It wasn't that long ago. I'm still using my grandfather's old safety razor and you can still buy the blades for ~10¢ each from the Internet even though the only ones sold locally in shops are literally 15 times that price because apparently capitalism doesn't work.
As the remaining market for safety razor blades shows, standard interchangeable products doesn't necessarily mean "generic." There are a variety of recognizable brand names to choose from. Nor do I think of them as "third party". They are suppliers of a product. Who's to say which is first and which is third, between the razor and the blades? The suppliers of each are essential, and neither deserves to have primacy over the other.
When I buy brake pads for my bicycle or an SSD for my home computer there's no concept of a "third party" supplier getting involved. I will not be spending $10,000/gallon on ink. I'd sooner build my own printer out of crayons and stepper motors.

2024-09-18 13:38:51

- reply

> 2017 and 2021 it stayed mostly stable at 190 million users
Interesting that they almost managed to stop the decline for a few years there. In 2024 after the recent string of nonsensical decisions it's down to 158 million.

2024-09-08 18:13:43

- reply

The journey from "generative LLM chatbots can be a useful tool" all the way to "we need a whole new browser UI for chatGPT" must've been a long and perilous one.

2024-08-26 22:45:43

- reply

There's also a "diverse" in there.

2024-08-26 22:38:20

- reply

The problem is that there's no "i" in "federated."
I propose that we all start calling it the Feddaverse