But identity as a whole is a very murky thing - if you ask me it's largely an adaptive abstraction that our minds invent.

The purpose of said adaption is to adopt a role which functions within the tribe/society for purposes of survival.

I think we way over-simplify the whole thing by making it about gender and gender roles.

And it's that over-simplification that I would label as the ideology. Because that's what ideologies do: they take the complex ambiguities of the world and try to cram them into a simplistic box.

But I also think the internet has more potential for harm now. Widespread social media makes it easy for predators. YouTube actively incentivises content creators to produce brain numbing shit instead of the more amateur and educational content I was exposed to. Instagram creates vicious dopamine hooks that children have no mental defense against.

Also sorry to sound egotistical but I think I was an outlier that drifted into doing educational things, many or most kids will spend every moment they get just playing video games.

That being said, I’m in favour of parents doing the parenting, not the government.

I am in the same predicament as both of you, having grown up with unfiltered internet access, and not wanting it to have went any other way (I love my life, actually!)

There is a condescending tendency when people hear what I said above, to tell me that I am an outlier, or, God forbid, a "genius", and other equally worrying conclusions regarding my character.

I agree that, today, there are millions more ways that children can fall for objectively negative things, that have been completely, and intentfully engineered to be terrible in a way which can be exploited for profit.

But also, I simply think that, with enough access to mind-numbing content, for long enough... people will simply realize that, actually, they don't want that. At least, not just that.

Adults are not a good term for comparision in the matter of less aggressive addictions, like with social media, because they already have lives they want to escape, with responsibilities and whatnot.

These are not scientifically sourced claims, but, in my experience, children have a lot more time, energy, curiosity, and will/intent to create, for one reason or another, and they have been doing those things since time immemorial.

This is just a consequence of having access to ~the entirety of all human knowledge at their fingertips, with no restrictions, and with an incredible amount of free time at their disposal.

This aspect of parenting is really hard. If your kid is 10 years old and all their classmates have Roblox, saying 'no' to your kid does isolate them socially, because all the other kids are talking about what they did in Roblox at school and play Roblox together after school. To make it worse, some primary schools even allow kids to play Roblox at school during breaks or the teachers make TikTok videos, making kids want to have Tik Tok as well (TikTok-teachers are a real phenomenon), etc. So, even when you are trying, it gets undermined by others. Trying to fight it is kind of pointless, because most other parents don't see the issue.

Same for e.g. instant messaging, it is basically Sophie's choice: you allow them into these addiction machines or you isolate them socially. It would be much easier if social media and certain types of addictive games were just not allowed under 16. Just like we don't sell cigarettes or alcohol to kids.

I also completely agree with the counterpoint that age verification on the internet is generally bad.

Luckily, some things can be done without grave privacy violations. E.g. where high schools 10-15 years ago would gloat about being iPad or laptop schools, more and more are completely banning smart phones and laptops during school time.

At any rate, it's perfectly possible to hold both views at the same time: social media and addictive games should be forbidden under 16 and the age verification initiatives are terrible for privacy.

Maybe we should just ban Facebook, TikTok, etc. no more addiction, no more age verification needed :).

I think if a perfect system existed that could gate websites behind age verification, without any privacy compromise and assure the user of this, I would support it. There are zero-knowledge proofs of course, but they're a black box, and the user still has to trust that the system has been implemented correctly. Unless mandated by law, companies have no incentive to build a perfectly private age verification system.

So instead every time I got a new Linux or FreeBSD CD-ROM set, I would go through all the documentation and try everything out, and read source code. I got Pascal and C books through the local library, where you had to order the book and usually wait two or three weeks.

But I also didn't have the omnipresent cameras (you could still do dumb stuff as a kid and not get filmed/photographed). No pressure to show a fake version of yourself on social media. No pressure to be always available through instant messaging.

I feel like it was the best time to be a kid. Access to information was relatively easy (albeit slower than on the internet), but without all the terrible downsides for kids. Without all the dopamine shots and highly addictive social media and games. Without the all-ways present tracking of your every move.

Though even the kids slightly after me probably still had a good time. Early 2000s, Internet access became more ubiquitous, but it still took almost 10 years for the worst of addictive websites, etc. to rise. I sure miss the early web.

Unfortunately, internet evolved to become much more predatory and addictive, with platforms like Meta running world-scale ops that they know lead to addiction, depression, scam and sexual harassment.

I honestly would like to give my children the same experience of the internet as the one I had. Unfortunately I fear that it may not be possible anymore. That's not to say that we should run a surveillance experiment with everyone connected to the web.

I'm roughly the same as you in terms of information access, though whether I was a child is debatable; was 14 when I got my first dialup connection. My family wasn't tech-adjacent so it was me who pushed for it; the only control in place was the amount of time I'd spend there.

The only control I have in place on my son in terms of content is whether something is scary or if he won't be able to understand most of it, because arguably he's still too young for many things.

But once he's 12 I don't think I want to restrict most things in terms of content, and by 16 I personally don't care if he watches hardcore midget porn, as long as I have the chance to contextualise and explain the industry.

But.

What I'd rather control (or ban, even) is rather all ML-driven doomscrolling platforms and the "social media" that turned people no longer social. The Internet you and I grew up in no longer exists (or it's a small hidden fraction of it), and now it's a wasteland of engagement traps and corporate revenue directed dark patterns.

You and I learnt to separate wheat from chaff, research, deep dive, and what not. Internet is now, by and large, instant gratification loops and user tracking. I don't want my son (or myself, actually) pulled into that. Porn is literally healthier: you bust a nut and go on with your day, but I see some people wasting hours on end, reel-after-reel, with increasingly targeted ads shoved to their face. Hard pass on that.

Age control, if any, should lie in the hands of the parent/guardian. Make it by law a setting on the routers (new devices are <18 until admin approves them), or the ISPs for mobiles. I'm okay with that. Absolutely not on random third parties handling personal information filling the gap for every random website.

All of that leaving aside the fact that zero knowledge proofs solve this problem without sharing any sensitive information.

But of course, the corporations benefiting from this are not interested in pushing those, IMO reasonable, age controls.

Granted, on its own, this should be safe. But attacks are usually composed from multiple bugs and/or weaknesses in design. Hence why security folk keep talking about “defence in depth” — ie not to rely on the security of any single facet but instead layering your security just in case any one particular layer does prove to be insufficient.

This is why in my own terminal emulator I implemented hyperlinks via user defined RegEx. The terminal user gets to decide what text becomes click-actionable rather than the attacker.

I actually voiced some concerns with this original hyperlink proposal several years back. In fact lots of developers and security researchers did. And the gist authors response was to delete the replies and turn off comments. Which adds additional concern about this proposal. It follows no process, no feedback, nothing. Just one persons mission to dictate how everyone else’s terminal, and security model, should operate.

Yes, that’s exactly my point. With websites you need two clicks to be compromised, but with a shell session you only need one.

> Why would the terminal make requests? Obviously it will dispatch the link to another program specialized in making requests to a protocol, like... a browser?

Social engineering is rife in browsers and this proposal offer almost nothing to prevent that from happening in the terminal

> Every feature can be part of an exploit chain, but the "clicking a URL will always lead to the text it is under" ship has sailed 30+ years ago. If your system cannot safely handle this operation then you're in deep trouble, and I don't see how crippling every program in existence is the right solution to that.

Again, that’s exactly my point. Terminal emulators are not designed around preventing these kinds of problems and this proposal does nothing to address that concern.

> Based on what you've written: you and other self-claimed "security researchers" started spamming this spec with concern trolling about hypothetical (non-existent) "security issues", then the author finally got tired and locked down comments, which were obviously intended for people interested in the feature, not those trying to sabotage it.

Wow, just wow. There’s taking a comment in bad faith and there’s what you’ve just done. Thanks for calling people trolls just for trying to discuss genuine security concerns.

> Nowhere does the proposal say that your terminal has to implement this. Indeed, if you have a working ANSI parser the escape sequence is ignored automatically (as the spec also explains).

Except the author of this proposed started spamming other projects asking them to implement it. How do you think this random gist became so infamous? It wasn’t stumbled upon by chance.

> Have you considered that the person trying to dictate how others' terminals should operate might be you?

This is another bad faith argument because I’m not the one pushing any proposals nor agenda here. I’m just offering some expertise.

As I said before, I have actually implemented hyperlinks in an open source terminal emulator which I contribute to. But we did it in a completely different way that ensures the terminal user has control over the links rather than an attacker.

And if other terminal maintainers want to follow this proposal verbatim then that’s their choice. I’m not stopping them. But it also doesn’t make my concerns any less valid.

e.g. "Log in to receive your bitcoin: https://colnbase.com" (phishing)

Is this safe to do? Are all secure operations browser-safe and separate? Does this avoid side channels? The browser is famously challenging for safe encryption.

It is indeed challenging and you can take a look at that link for some further details of what is available.

It's also why it's important to mention it's a work in progress.

On my nixos-rebuild, building a simple config file for in /etc takes much longer than a common gcc invocation to compile a C file. I suspect that is due to something in Nix's Linux sandbox setup being slow, or at least I remember some issue discussions around that; I think the worst part of that got improved but it's still quite slow today.

Because of that, it's much faster to do N build steps inside 1 nix build sandbox, than the other way around.

Another issue is that some programming languages have build systems that are better than the "oneshot" compilation used by most programming languages (one compiler invocation per file producing one object file, e.g. ` gcc x.c x.o`). For example, Haskell has `ghc --make` which compiles the whole project in one compiler invocation, with very smart recompilation avoidance (pet-function, comment changes don't affect compilation, etc) and avoidance of repeat steps (e.g. parsing/deserialising inputs to a module's compilation only once and keeping them in memory) and compiler startup cost.

Combining that with per-file general-purpose hermetic build systems is difficult and currently not implemented anywhere as far as I can tell.

To get something similar with Nix, the language-specific build system would have to invoke Nix in a very fine-grained way, e.g. to get "avoidance of codegen if only a comment changed", Nix would have to be invoked at each of the parser/desugar/codegen parts of the compiler.

I guess a solution to that is to make the oneshot mode much faster by better serialisation caching.

    preferLocalBuild = true;
    allowSubstitutes = false;

If you are interested in seeing my experiment, it's open on your favourite forge:

https://github.com/poly2it/kein

https://crane.dev/getting-started.html