Online Safety Act: What went wrong?

1 day ago (therectangle.substack.com)

> a statement like “we should stop young kids watching porn” is so agreeable that only the nuttiest amongst us could even begin to disagree with it

I mostly disagree with it. I don't want prepubescent children watching porn of course, but the vast majority of them aren't doing that with any regularity, nor do they have any desire to. It isn't a problem that demands a robust solution with serious downsides.

I do think an HTTP header saying "no adult content" that can be turned on via both simple browser settings and password-protected parental controls is a good idea. That would reduce accidental or casual exposure to porn and have no meaningful downsides.

  • Since gambling laws have been relaxed in a number of countries over the last few years, there has been a rather concerning rise in teenage gambling addiction.

    This is perhaps a better example than porn. I'd be much more worried about my 14-year old spending all of their (or my) money on gambling than having a wank every once in a while.

    That said, I have accidentally landed on porn sites over the years (including in a demo in front of the entire company haha). I'm not part of the hyper-prudish American contingent where any form of nudity does irreparable trauma to a child, but ... there's some pretty wild stuff out there. It's not like when I was young and stay up late to sneakily watch a soft-core porn at midnight.

  • I'd prefer the HTTP header be on the response. That way, it can't be used for fingerprinting and can easily put the website in a more fine grained category (e.g., porn, gore, political extremism) and the user agent can be configured to filter based on this. You could then create limited but present liability for mislabeling.

    • I'd be worried that doing that would invite bad followups - e.g. requiring web browsers to block tagged content by default (or always), defining LGBT or other politically sensitive content as pornographic and mandating that it be tagged, penalizing web site operators for failing to tag their web sites, etc.

      But in principle, I still agree. As someone who has managed some adult-oriented spaces online, I would love to have a way to put a sign on the door that, in effect, says "adults only", and have it be technically enforced for users who have chosen to do so.

      1 reply →

    • You’d have to come up with a technical spec on the category definitions though. For example, what is porn and what is political extremism? That has always been the struggle.

      1 reply →

  • > I mostly disagree with it. I don't want prepubescent children watching porn of course, but the vast majority of them aren't doing that with any regularity,

    This genuinely needs qualification and I suspect, based on discussions I have had with friends who are teachers and teaching assistants, that you would be horrified by how often very young children (seven, eight, nine years old) are viewing material that only a couple of generations ago would not have been seen in any legal publication in the UK.

    > It isn't a problem that demands a robust solution with serious downsides.

    This is an opinion, not a fact. I think I disagree, but I also disagree that websites asking you to verify you can access a particular link on a mobile device is a particularly serious downside (since that is one of the valid ways of age attestation in the UK -- it requires only that your mobile phone provider knows you are an adult, which they can establish in a number of ways).

It's mostly deliberate. Current petition to revoke it has half a million signatures, and the government have stated they will ignore that.

Censorship is one of the advantages they like: https://freespeechunion.org/protest-footage-blocked-as-onlin...

  • I mean, this was in the manifesto for both the major parties - this is really not what the petition website is for, and it was never going anywhere. X flagging protest footage as adult content is not the endgame of some great british elitist conspiracy.

    • >X flagging protest footage as adult content is not the endgame of some great british elitist conspiracy.

      No it is the prelude to a global elite conspiracy program to do anything they want with impunity.

    • > X flagging protest footage as adult content is not the endgame of some great british elitist conspiracy.

      No indeed, but it might be the beginning of a political campaign.

>Solving problems in the online world is no longer a technical issue

Unfortunately I have zero faith in UK government having a moment of introspection here.

Instead of realizing it's not fit for purpose they'll double down on the broken approach. Fully expecting the "solution" here to be more regulation, more punishment, more cost, more killing small sites, more inconvenience, more technically unfeasible things (vpn ban).

Have written to my MP about it and unsurprisingly zero response. Useless government

  • I don't really understand Keir Starmer on this. Or well, on anything really. The public has been pretty clear what they want most of all is a competent government that will take care of basic core tasks like cost of living, NHS, etc. Instead he takes a massively unpopular Tory culture war bill and implemented it as if it was his own idea (in addition to a number of other unforced baffling choices over the last year).

    I understand Boris Johnson. I understand Tony Blair. I even understand Liz Truss, mad as she may be. I just don't get Starmer at all. I almost suspect he's somehow in league with Nigel Farage to make him the next prime minister.

    • Yes, exactly.

      You do in fact understand Starmer. You just hope you're wrong.

      The UK's aristos have decided that Farage should be the next PM, which is why he's been all over the media.

      Starmer is wholly owned by business interests which exist for the benefit of said aristos, and his job is to pander to those interests. He is absolutely indifferent to what the public wants, and he is willing to force through incredibly unpopular pointless abusive policies to make that point.

      The end game is similar to the one in the US - the end of democratic accountability and public service government, an AI-administered online surveillance state run for oligarchs and corporations, all marketed with rhetoric that combines fake patriotism, violent hysteria against outsiders and noncomformists, the illusion of personal responsibility, and religious grift.

The world isn't child-safe. Nobody would want children to play on a motorway, nobody would feed children xxxtra-hot curry of death, nobody would want children to drive a car or play with kitchen knifes.

Yet none of those far more problematic things comes with an age check, a fence, government controls or any special kinds of locks. We just educate children, and parents pay attention. Children that are too young to understand are put in special places like kindergarten, and even at a later age are often supervised by responsible adults.

I don't see why the internet should suddenly be all of that in reverse: Things like the online safety act require a whole world full of child-safe sites, and a child-impenetrable fence put around the few ones considered unsafe. This is totally ass-backwards.

  • >Yet none of those far more problematic things comes with an age check, a fence, government controls or any special kinds of locks.

    I was thinking about this the other day: everyone has knives at home. Sharp and deadly. Yet I've never heard of somebody putting a lock on their knife drawer. Instead, the knives are almost always easily accessible to anyone, including kids. Yet somehow that is not a hugely dangerous safety issue that must be taken care of.

    • https://pubmed.ncbi.nlm.nih.gov/23849364/

      Results: An estimated 8,250,914 (95% confidence interval [CI] 7,149,074-9,352,755) knife-related injuries were treated in US EDs from 1990 to 2008, averaging 434,259 (95% CI 427,198-441,322) injuries annually, or 1190 per day. The injury rate was 1.56 injuries per 1000 US resident population per year. Fingers/thumbs (66%; 5,447,467 of 8,249,410) were injured most often, and lacerations (94%; 7,793,487 of 8,249,553) were the most common type of injury. Pocket/utility knives were associated with injury most often (47%; 1,169,960 of 2,481,994), followed by cooking/kitchen knives (36%; 900,812 of 2,481,994).

      Children were more likely than adults to be injured while playing with a knife or during horseplay (p < 0.01; odds ratio 9.57; 95% CI 8.10-11.30).

      One percent of patients were admitted to the hospital, and altercation-related stabbings to the trunk accounted for 52% of these admissions.

> In reality, this wouldn’t happen, because, generally, people understand that stabbings are a cultural issue, rather than a technical one

Many UK MPs don't understand this. I've heard of MPs making (moronic) suggestions such as selling kitchen knives without the point on it. I've literally seen this advertised as a solution on the news.

For whatever reason they don't seem to understand that literally anyone can make a shiv.

  • "We believe that paedophiles are using an area of internet the size of Ireland, and through this they can control keyboards." – Syd Rapson MP in 2001.

    But really, with 650 MPs there's bound to be a few that are a bit silly at least some of the time. You can hear some wild takes at the local pub too (or nextdoor), but that doesn't mean everyone in your area is a moron.

    • I too have watched Brass Eye, and they literally had MPs telling people about the dangers of "cake" in a previous episode. It showed that MPs and TV celebrities would literally say anything Anchorman style if it was put on a teleprompter / script in front of them. They are nothing other than paid actors.

      While I don't believe everyone in Parliament is a moron. I think more than enough of them are moronic, out of touch, malicious or home combination of the three for it to be a problem.

      Generally the only solution presented for any issue in the UK is banning something. There is no other course of action that they can envisage. So you end up in a false dichotomy, discussing whether something should be banned or not. There is no discussion why the issue is happening in the first place, only whether <thing> should be banned or not.

  • I would love it if my steak knives did not have a point. Never once have I needed to stab my steak. The only thing I’ve ever stabbed with them is myself by accident.

  • > I've heard of MPs making (moronic) suggestions such as selling kitchen knives without the point on it. I've literally seen this advertised as a solution on the news.

    As someone who is clumsy and easily distracted, I have such a kitchen knife. They are commonly available. It works absolutely fine and it has three times minimised an injury that would have been nasty because I am an easily-distracted tired old idiot.

    The point of a knife is only needed in a handful of kitchen applications. Most knives do not need to be able to stab at all. Only cut.

    And combined with rules on the sales of longer blades that do have a point, this idea could genuinely be part of reducing knife crime (especially among the very youngest).

    Because it does reduce access to knives that would be useful for stabbing, and it reduces the severity of injuries caused by the youngest in knife crime incidents. Without meaningfully affecting the kitchen usefulness of most small blades at all.

    If I go to a supermarket and buy a long enough knife with a point on it, in theory I am asked to prove my age (in practice they laugh at the idea that I might not be young enough). The same is true for many (not all) products on Amazon, in fact.

    The knife without a point on it did not trigger age verification. Nor does a boxcutter type thing, in practice; only retractible blades that don't snap off are on the list, AFAIK. (And only flick-knife-type mechanisms are banned).

    I anticipate being downvoted for simply writing about this, but harm reduction through knife sales controls is not something that just stupid MPs think: it is supported by expert opinion.

    Knife crime in the UK is a problem. It is still not a problem as severe per-capita as it is elsewhere, but we are trying measures to dissuade it.

    Behaviour modification is not always stupid or evil; cultures do it all the time.

    • A tipless knife may prevent accidents, but if you purposefully tried to stab yourself or someone else with one of those knives, do you honestly believe it wouldn't tear right through your flesh? Neither my butter knives or bread knives have tips, and yet I could easily stab people with them.

      2 replies →

    • > The point of a knife is only needed in a handful of kitchen applications. Most knives do not need to be able to stab at all. Only cut.

      But this isn't about what "most knives" need to be able to do.

      This is about what everyone in the UK will be permitted to buy.

      "I don't need to do X often, so why should I worry about it?" is a really, really bad attitude to take when your government is considering banning X for the entire country.

      1 reply →

There used to be a phrase in UK politics: "Something Must Be Done", expressing the incredible momentum to be seen to be doing something for noisy constituents...and not worrying too much if it fixes the problem or not.

Technological solutions against humans' sex drives seem to be doomed to failure. For one we're largely talking about teenagers who are infamously horny and tech savvy, but even if we weren't, one glance at the history of MPs utterly failing to keep their trousers on (even when they know the stakes for being discovered arr ludicrously high) would put paid to that idea that people won't do stupid things for their libido.

However...porn does damage young minds. It does move the overton window to dangerous places (witness the rise in nonconsensual sexual choking, for example). Coupled with a generalized incapacity (or sense of hopelessness in the face of 24x7 algorithms?) for parents to keep their kids away from this stuff, what should be done? For Something Must Be Done.

Some sites (eg Google) offer child friendly versions where safe search is enforced, by accessing the site using a different set of IPs. Some DNS providers (eg Cloudflare 1.1.1.3) automatically resolve to those safe IPs when available.

The government should require sites with "unsafe" content to make "safe" versions available (eg force safe mode, readonly, no signup). Sites that are wholly inappropriate for children should self-report so they can be made unresolvable by child-safe DNS.

I'm not saying this specific implementation is the one true way, there's alternatives and ways to work around it. My real point is that the government should have forced sites to implement a consistent method of enforcing child safe mode, that can be easily set in a blanket fashion by the parent.

I'm sure whatever approach will be "too technical" for many parents at first, but once a consistent safe-mode method becomes clear, I'm sure UIs and parental controls will evolve to make it easy to enable.

  • By default for me (in the UK) it still seems possible to view porn in a Google image search in an incognito browser tab. I don't think non technical parents can be expected to change their DNS settings to something safe to block it. I'm a bit unclear as to what the online safety bill is solving if Google can ignore it.

    • ISPs can provide dns or ip filtering by default which can be opted in or out in the account control page.

      In fact I thought they did.

Seems as though, if anything, the government are doubling down on it. I swear Labour are speedrunning "How to become the most hated party". I thought it'd take a bit longer than a year, but here we are.

  • They're not though. These types of policies are very popular. HN users come out in favor of them or some variant and you'd think they should recognize the dangers.

    People will happily demand these policies in the abstract, and then some will be unhappy with the implementation but not all.

> I mean, there are already a raft of tools available to stop children accessing harmful content online. There are filters and protections and safeguards on almost every device on the market today. If children are constantly accessing harmful content, it’s because these settings haven’t been enabled by parents or guardians.

These parental controls rather suck though; see e.g. [1]. This basically matches my own experience.

I do agree with the general gist of it, but it's not as simple as "these tools already exist, we just need to educate people". There is real work to be done here before this is usable.

And why isn't there a "Content-Rating: sex" or "Content-Rating: gambling" HTTP header? Or something along those lines? Why isn't there one easy "under 12" button on a phone to lock down tons of stuff, from PornHub to gambling sites to what-have-you? All of this is also a failing of the technical community to actually build reasonable and usable standards and tools, too.

[1]: Parental controls? What parental controls? - https://web.archive.org/web/20231119003608/https://gabrielsi...)

  • > And why isn't there a "Content-Rating: sex" or "Content-Rating: gambling" HTTP header? Or something along those lines? Why isn't there one easy "under 12" button on a phone to lock down tons of stuff, from PornHub to gambling sites to what-have-you? All of this is also a failing of the technical community to actually build reasonable and usable standards and tools, too.

    The mobile app world solved this years ago, and successfully generates age ratings for different countries based on developer interviews. (It's part of the app submission process).

    There are problems with the mobile app world, but that isn't one of them.

One of the positive side effects is that this will normalize the everyday use of Tor and Tor services. It won't just be for "those people" who are paranoid.

For me personally, I agree that wanting non-adults to be able get at online porn is commendable, and the fact that the tech industry is scrambling over itself to comply is evidence that this Act has teeth. However, what bugs me personally is that 1) The Government had nearly 2 years head start to set up a centralised ID repository, hopefully basing it on the same model as the DVLA and Passport Office sharing photo and other data. They did not. 2) Verification sites are not UK based, and therefore subject to the same mistrust with handling PII - which obviously can't be replaced. 3) There are no Goverment-created apps that can/should handle ID verification despite the fact that these would probably solve 95% of the problem. 4) Feature overreach: if you want to surveil your citizens, be honest for once and don't use the knee-jerk carrot of it "being for the kids" - we're not as stupid as you think (unfortunately).

That is all.

  • Everyone who is currently an adult and not geriatric could have had access to porn when they were a child. Is everyone fucked up? No? Why are you advocating for eliminating privacy for a made up problem?

    • This is my main frustration. Every teenager who wants to get porn will get porn regardless. VPN companies saw the writing on the wall years ago, and have been paying any YouTuber that will accept a sponsorship to shill for them.

      I think the Online Safety Act is just setting a precedent that will be used further down the line to ban personal VPN usage.

      "Children are using encrypted VPN tunnels to see porn online! Criminals also use those same VPN networks!"

      Let me guess... There will be a law requiring ISPs to block VPN traffic if the VPN server's hostname isn't registered to a business and approved by the government.

      UK: "Do you have a license for that VPN?!"

      Anyway, download i2p, or Hyphanet/freenet

      3 replies →

    • I'm not! I know how easy it is to "discover" porn, but if sites adopted the RTA labelling system (https://rtalabel.net/?content=howto) and browsers obeyed that would go a long way to preventing those "accidental" discoveries. What my privacy concerns are were as per my post - no accountability from various global third parties and indiscriminate use of my PII.

      1 reply →

  • There is no possible way to achieve this goal without 4 happening though: or moreover, without it being possible.

    Your prior 3 ideas all end up at "potential government surveillance of the people".

    There is no way to implement verification like this without surveiling everyone, even if you don't plan to use the data - the possibility will always be there.

There's a lot to talk about here. I think this is pretty interesting:

> In reality, this wouldn’t happen, because, generally, people understand that stabbings are a cultural issue, rather than a technical one. The issue is less the existence of knives and more the factors that drive people to use them aggressively.

I think this may be true but also nearly impossible to address.

Maybe I'm being pedantic, but I really hate this statement: Until we start thinking about the true test of any policy: implementation and enforcement.

The true test of policy should be the desired outcome behind that policy.

  • If the desired outcome is world peace and the means of which is murdering every human then I don't think the desired outcome is all that relevant.

  • Let's include who is pushing for the new policy right up to the head of considerations, because these "child protections" are not child protections, they are using children as fear vehicles to make political careers and to generate new revenues for their tech security company backers. Calls to "protect the children" rarely are about children at all, but are almost universally a vehicle to usher in some Orwellian fear-laced perspective forced on the public.

  • Why would the desired outcome be a more true test than the actual outcome?

  • You're saying the true test of a policy is its stated intentions? This attitude is exactly why we get so many terrible, unworkable policies with terrible unintended consequences (though often the consequences are so obvious that the claims that they are "unintended" are incredible).

An obligatory link for either anyone living in Britain or with British citizenship:

https://petition.parliament.uk/petitions/722903

More people have signed this than the membership of the labour party(!)

  • The whole country could sign that petition and it will be ignored. There is no legal/political solution to this. The sooner people accept that the better.

    • Nonsense. Promoting the petition and keeping talking about the law is one of the most effective things that can be done to make life uncomfortable for the politicians who are responsible for this mess. More pressure is needed and politicians will have to face journalists asking unpleasant questions when people continue to complain.

      1 reply →

Absolutely nothing about it has gone wrong.

They have collected some personal data from law abiding pornography consumers: obvious perverts who should know better anyway. If their information gets released it will be their own fault. Some other stuff got hidden, but that's no problem as the BBC will tell you anything that you need to know anyway.

They can, and will, readily ban VPNs later, since those have no legitimate purpose for individuals, and will only be allowed for licensed operators like banks, hospitals, and defence manufacturers.

If you think this is sarcasm you haven't been paying attention to what the people pushing these laws actually say.

  • > obvious perverts who should know better anyway.

    Why are these perverts obvious?

    > They can, and will, readily ban VPNs later, since those have no legitimate purpose for individuals, and will only be allowed for licensed operators like banks, hospitals, and defence manufacturers.

    This is not true. All kinds of companies and private people use VPNs to safeguard their computer infrastructure.

    • This is a red herring. Obviously corporate VPNs will not be banned. Same goes for your personal use of something like ZeroTier or Tailscale. The gov will simply learn from China

  • > They have collected some personal data from law abiding pornography consumers:

    Who is "they"?

The knife crime analogy is a bit off, as we already have age restrictions for buying knives in the UK.

That it was proposed in the first place perhaps? Along with all the completely iffy premises behind it?

Generally, legal minors won't become raging trauma victims if exposed to some nudity and sex as part of the non-disney real world they inhabit.

This adds little to the debate.

A really interesting question would be to ask Aylo -- the world's largest pornographer -- why they are complying with the UK law and working with the regulator (population ~70M), but blocking whole states in response to the French law (population ~70M also) and Texas (population ~30M).

Because there obviously is some nuance and realpolitik here, when Aylo could very easily just block the UK too.

Has anyone done this journalism?

  • You can just go to their press releases [1].

    > For years Aylo has publicly called for effective and enforceable age assurance solutions that protect minors online, while ensuring the safety and privacy of all users. The United Kingdom is the first country to present these same priorities demonstrably.

    At least according to their release, the UK worked with them on it.

    They also have an updated statement on France [2].

    [1]: https://www.aylo.com/newsroom/aylo-upgrades-age-assurance-me...

    [2]: https://www.aylo.com/newsroom/aylo-suspends-access-to-pornhu...

    • I mean, in the second or third round of this with the tories in 2016, Aylo (Mindgeek) were offering up their own solution for age verification. So they are not exactly unconflicted.

      But the fact remains here that the world's largest porn company is not presenting this as a big civil liberties issue; they have moved on from that.

      I think it's important to understand that Ofcom isn't just imposing nonsense policies without any consultation with the very people they are trying to regulate.

      They may not be succeeding, and people can disagree with the policy outcome, but there's a huge amount of misinformation suggesting that this is simple thoughtless autocratic censorious wishful thinking, when it is in fact an attempt at a policy of industry self-regulation backed by penalties, which is how the ombudsman system is meant to work.

      Also I think a lot of US commentators don't understand that mobile phone providers in the UK block adult content by default and have been moving to that position over the long term because it is the only practical parental control mechanism that exists in a market of devices with different operating systems, menus, and often absence of on-device parental control mechanisms at all.

  • Perhaps they earn more from the UK market? Or decided it was easier to comply with that specific law.

    • It was a partly rhetorical question.

      They have an age verification business.

      But they also have a policy position about this and I'm not sure anyone has asked them to talk about those three decisions in the same sentence, as it were.

Any device with a Government service (eg NHS) or a Banking app knows who and old the primary user is, so seems the obvious technological solution is some kind of securely anonymous attestation that websites can request from the OS.

  • This appears to be what Aylo think, essentially:

    https://www.aylo.com/assets/files/age_verification_fact_shee...

    And I think this is right. If Apple and Google can add a thing that lets us track Covid exposure they can surely figure out secure age attestation.

    As it is, you can use your mobile phone for simple age attestation in the UK anyway, since mobile phone companies block adult content by default until they are unblocked, as a parental control measure.

Problem goes back to UK government, an offense to the senses that can only be described as a malignant entity whose main goal is supporting injustice, misery and evil.

The introduction to any level of this degenerated amalgam, from lowly bureaucrats to top level asshole in command is to read 1984 and then pass a test where you have to describe how to recreate such a system but make it even worse. Supplementary extracurriculars is to be close friends with rapists and pedophiles.

"Surely you're exaggerating this you online troll"

No I don't, you just haven't scratched the surface to the modern Belgian Congo that is the UK, vile doesn't even begin to describe it.

The core argument presented is that children watching porn is a cultural problem and therefore can’t be addressed by a technical solution.

I agree with the preface that the online safety act is a big dumpster fire. Regulators and lawmakers can and often do fail to effectively regulate.

I disagree that calling it a cultural problem and saying “oh well, can’t do anything” is a legitimate conclusion. I mean governments aren’t supposed to attack cultural problems, only protect the safety and wellbeing of its citizens. Nobody wants the government telling you what clothes to wear and what shows to watch.

The rhetorical “example” given is just plain false. It’s not like the government sending someone to your house to age check you when you pick up a knife. It’s like them requiring a bouncer at the door of a knife store.

We ID people for purchase of alcohol. It’s not perfect. Older kids get around it. And it’s definitely a “cultural problem” to some degree. But there isn't harm being caused by requiring an age check to purchase.

So often lately I see people letting perfect be the enemy of good.

If you wanted to fix problems with the implementation of the online safety act you would loosen the burden imposed on user content driven communities by exposing the individuals posting to legal liability for their posts rather than imposing unimplementable moderation requirements on the service operators. You would attack institutional porn not message boards where someone uploads a nsfw photo. Regulators don’t understand the stratification of the internet. You’d require sites that fall under regulation to use digital ID documents. You make it illegal for that data to be stored at all and simply tell sites to update a column in the user db “age verified: true”. You would not use IP address-based or credit card based filtering.

There are many ways this could have been not a regulatory dumpster fire and still moved the needle towards sustainable and effective online ID document presentation. One example of failure doesn’t damn the whole concept.

In this instance, though, the online safety act should definitely be repealed and reworked.

Also no parental controls are not readily and widely available nor are they easy to configure and install, not least because of lack of a digital ID story.

UK now cached up with Russia of 2015. One may even say Russia is 10 years ahead!

Children shouldn't have unsupervised access to the Internet. Stop off-loading parenting onto politicians who infringe on liberty in the name of a (false) sense of security.

  • They're not offloading it onto the politicians. The politicians are taking that onto themselves against the will of many of the parents.

    • They're not offloading it onto the politicians.

      The people voting them into office certainly are.

Politicians listened to the "smart" guys from Google/Apple/Microsoft/Whatever who were there with their own ulterior motives.