• 5 Posts
  • 5 Comments
Joined 8 months ago
cake
Cake day: April 4th, 2025

help-circle




  • For the moment, that would not be enforceable in respect to people with technical knowledge. Enforcing it would require authoritarian control and even China’s Great Firewall has way to circumvent it.

    On the other hand, this is already far more difficult than you might think. You could not install such an app from a server authenticated with TLS because the TLS keys might be subverted - the certification chain has national institutions as the top certificate authorities. You would also not be able to install such an app on an Android phone because Google has decided it needs developer attestation to install apps in a way accesible to end users. You can run Linux now but if all that is taken seriously, your options to run Linux might become limited. E.g. you already can’t run many banking apps on phones with user-controlled OS software. Railway apps like the German one already don’t work. In future, you might not even be able to use a municipial library’s or bookstore’s website this way.

    But more to the point, the real application case for this kind of civil rights is not some nerd kids which want to play DnD or minecraft on their own server or test their self-written IRC service. The real application case is what we see in the US, people being dragged out of their house and disappearing just because of their ancestry, how they look, being poor or the area they live in. They don’t have time to compile software or configure port-knocking protocols.

    Somebody has called these systems of “democratic” mass surveillance uncovered by Snowden “Turnkey Dictatorship” . I for sure wish they would have been wrong.


  • Why is this specifically relevant to Linux users?

    Well,

    • controlling end-to-end encrypted messages is only possible if either the keys/certificates are not secret (which is possible with TLS), or the software on the end-users device is not controlled any more by the user (but perhaps by law enforcement, or companies). This overturns the basis of any FLOSS software system where trust is based on transparency and user control.
    • age verification will typically done by a form of attestation, a highly problematic concept. Again, this would require to run software on the users device which can’t be controlled by him or her, which is deceptively called “trusted computing”. (Technically, age verification could be done by other means, but this is not what these proposals aim for).
    • in the world of public-key cryptography, which is what TLS , GnuPG, and most other modern systems are based in, encryption and digital signatures are nothing but two sides of the same coin: Who breaks encryption keys necessarily also breaks signature keys. This means it is not possible any more to sign software such as the Linux kernel, or Email clients, or browser packages. Or even banking apps or bootloaders for smart phones. Which means to give control away to the entities, groups or induviduals controlling these keys. Ironically, this will make computing lot less safe, and also undermine trust in communication networks, because communication where we can’t be sure that the communicated symbols are genuine is for humans as worthless as the numbers on fake money. (As a corollary, it is also bad for business: All business is based on some amount of trust. Would you do important business with somebody if the only communication channel you have happens to be a messanger which is a compulsory liar?)

    To sum up, this is a massive transfer of control.