I know this isn’t the point, but ffs The Verge. “Add age verification to it is consoles”? Seriously?

I suspect that the thinking when he was appointed was that logistics was going to be key to Apple’s future success. And at the time, they also had a number of high profile creative people in other roles, though they have pretty much all moved on since. And if you look at their financial performance in the years since Cook took over—which is the board actually cares about—it’s hard to say that this was a bad approach.

Cook’s expertise was in the logistics. He’s definitely not been a great leader for them putting out exciting products, but he’s the reason they’re so much less affected by things like global shipping crises or RAM prices exploding than many other companies are.

Maybe sometimes, especially among the bigger and more infamously privacy-invasive sites.

A lot of the time, though, it’s just that it’s the easiest way to write a website. Particularly if you’re using modern frameworks, you have to go quite a way out of your way to send static HTML that works well without JS enabled.

Too much pollution? Release wolves in factories in boardrooms

FTFY

What was her response?

Edit: and what was the cheer?

Yeah the “time for hijinks” factor is a problem if your group is used to the typical adventure RPG. And as much as Jenga is great for ludonarrative consonance in theory, if you’re not in the right headspace I imagine it could be an obstacle.

It’s one thing that’s great about 10 Candles. Turning out all the lights and playing a game entirely lit by the eponymous ten candles really helps set the mood and subconsciously cues players “this is different. We’re not doing hijinks”.

Horror RPGs have a history of some really interesting designs.

Call of Cthulhu is pretty basic, though seeing that sanity score inevitably drop down is nerving. VtM’s deliberate choice to make succeeding too much be a bad thing is really evocative. But those are both pretty typical rpg mechanics. It can get so much more interesting.

Dread using a Jenga tower to create an organic tension and release cycle is absolutely fascinating. I’ve not played it, but I’d love to, with the right group.

10 Candles tells the players upfront you will die; this is a story about how that happens. That sets such a strong tone from the outset. A scene gradually becoming more and more hopeless as you lose dice creates a similar tension and release cycle to Dread, and physically extinguishing the candles as you go adds to the atmosphere and clearly shows your progress towards the end. Physically burning off your character traits as you call upon them is icing on the cake.

All this to say: in the world of horror RPGs, Paizo has a lot to live up to. I wish them luck, but it’s not an easy job!

Han Solo hates snakes?

Yeah I was looking at the Fjällbo for that reason, but just aesthetically I would prefer closed at the front. Open at the back would be great. The one I linked I think has small cable holes at the top and a full wide cable gap at the bottom which was part of the reason it’s near the top of my list.

Re them being on the floor, this was always intended as temporary until I get something better. But they’re sitting on a wooden board rather than directly on the carpet, specifically to minimise the degree to which that’s a problem.

I’m not sure what you mean. Nobody’s talking about contracts?

identification isn’t a side effect, it’s the raison d’être.

In Australia, the law quite specifically says sites aren’t allowed to require ID as the method of age verification. It can be one option they provide, but it cannot be the only. Even a sort of sentiment analysis is permitted, and from everything I’ve heard that seems to be the method most have defaulted to. Social media sites don’t want to risk losing users by putting up barriers to them making accounts. People talking about politics and taxes are probably adults. People looking at Bluey videos are much more likely to be children. And it’s all based on information they already had used in ways a lot of them probably already did.

So at least here, I think the idea that it’s anything other than what they say it is is just an unfounded conspiracy theory. It may not be well-implemented, but it is genuinely well-intentioned. Or if not well-intentioned, the real intent is bad, but not in the same way you suggest—it’s just about being seen to do something good and win some good PR for the government, without actually having to go to any effort to implement good policy.

On second thought, I can’t think of a way to make that work, without compromising privacy

I’d say check out my top-level comment, and the link to the crypto Stack Exchange within it.

The short answer is yes, it can.

I actually think the best method is to put the onus on parents to parent in the way they think best, while giving them effective tools with which to do it. Parental controls should be baked into the OS, and sites should be required to hook into these parental controls via an API. The system could even have the capability, optionally, to block based on a crowd-sourced list, so it can still be effective against non-compliant sites. There would be no privacy problems, because no private information is ever shared. There isn’t even a middleman who has to see any identification at any point.

However, if the goal is to have specific age verification that actually enforces age, it’s still possible. I know of two main ways.

Here’s the first: https://crypto.stackexchange.com/a/96283

It has the downside of requiring a physical device like a passport or some specific trusted long-running locally-kept identity store held by the user. But it’s otherwise very good.

Another option does not require anything extra be kept by the user, but does slightly compromise privacy. The Government will not be able to track each time the user tries to access age-gated content, or even know what sources of age-gated content are being accessed, but they will know how many different sites the user has requested access to. And sites requiring age verification will not get access to any information they didn’t already have other than the simple answer to the question “is this user old enough?” It works like this:

1. The user creates or logs in to an account on the age-gated site.
2. The site creates a token T that can uniquely identify that user.
3. That token is then blinded B(T). Nobody who receives B(T) can learn anything about the user.
4. The user takes the token to the government age verification service (AVS).
5. The user presents the AVS with B(T) and whatever evidence is needed to verify age.
6. The AVS checks if the person should be verified. If not, we can end the flow here. If so, move on.
7. The AVS signs the blinded token using a trusted AVS certificate, S(B(T)) and returns it to the user.
8. The user returns the token to the site.
9. The site unblinds the token and obtains S(T). This allows them to see that it is the same token T representing the user, and to know that it was signed by the AVS, indicating that the user is of age.
10. The site marks in their database that the user has been age verified. On future visits to that site, the user can just log in as normal, no need to re-verify.

All of the moving around of the token can be automated by the browser/app, if it’s designed to be able to do that. Unfortunately a typical OAuth-style redirect system probably would not work (someone with more knowledge please correct me), because it would expose to the AVS what site the token is being generated for via redirect URLs. So the behaviour would need to be created bespoke. Or a user could have a file downloaded and be asked to share it manually.

The AVS could also be private third parties rather than governments, if necessary. Since it probably relies on government ID, I think it’s better for the government to do it, but technologically there’s no problem with private companies doing it. They would still not gain any information about which sites you access. Only that a user with this ID card tried to access an age-gated site.

There’s also a potential exposure of information due to timing. If site X has a user begin the age verification flow at 8:01, and the AVS receives a request at 8:02, and the site receives a return response with a signed token at 8:05, then the government can, with a subpoena (or the consent of site X) work out that the user who started it at 8:01 and return at 8:05 is probably the same person who started verifying themselves at 8:02. Or at least narrow it down considerably. Making the redirect process manual would give the user the option to delay that, if they wanted even more privacy.

The site would probably want to store the unblinded, signed token, as long-term proof that they have indeed verified the user’s age with the AVS. A subsequent subpoena would not give the Government any information they could not have obtained from a subpoena in an un-age-verified system, assuming the token does not include a timestamp.

IIRC one of the holidays was meant to be to Florida.

Castle-Nathan-Fillion.gif

I like the joke, but my pile of clothes is entirely about things that I want to reuse. They’re too dirty to hang back up in the wardrobe, but too clean to throw in the dirty clothes basket. I’m sure there’s an analogy someone could make for this, but Async’s analogy doesn’t work in my case.

It might or might not be true, but I’m not sure it’s particularly helpful advice. It’s too wide-sweeping. Literally everything is a fork, apart from Firefox and Safari. Maybe Chrome, since they hard-forked and now go their separate ways from WebKit. But still, that’s only 3 browsers. And unless you think that Firefox needs to be avoided because of its privacy violations but somehow are ok with Google Chrome, “avoid forks” doesn’t work as an option.

I misread that as “Win 11 runs Linux and macOS apps better than ever” and was ready to sarcastically point out that Linux runs Linux apps better too.