I am completely baffled by this wave of new laws and proposals... they feel dystopic and can seemingly only lead to brutal restrictions on the internet. What will we end up with? Only attested modems / endpoints in the home? With DPI? And a government issued smartcard to use it? It comes across as if this is what some legislators are actually after... they must have some technical advisors who can explain to them that the solutions they propose will not work and I am a bit worried they will morph the public discussion into enforcing at a lower level otherwise "the bad guys still circumvent"??
Honestly, I would like my ISP to block all traffic to and from Utah if this law passes. I can't think of anything I want or need that involves that state.
Unfortunately it does not work that way unless perhaps I am misunderstanding your comment. The traffic monitored by the NSA will pass through their collection points in each state and will be silently mirrored to them regardless of the routing of your ISP. Even if your specific ISP does not mirror data the traffic will very likely pass through ISP's that do.
Without it being good or bad (long term, second order effects), I do think all of these (proposed) laws and where we are heading will balkanize the internet. Alternative tech may sound appealing to the tinkerers, and they may keep certain important channels alive (think radio amateurs... they know this game) but for the masses? I already happily block entire countries or regions to my VPS as there is zero benefit for me to not drop them at the FW level.
I'm confused where all of this censorship is originating from. What wave of efforts is culminating? I can't really explain this from any movement I can see.
There is no evidence it is actually coming from Meta. The Reddit researcher the article cites generated their entire "analysis" in three days using Claude: https://news.ycombinator.com/item?id=47659552
Their website also added this page since I posted that comment: https://web.archive.org/web/20260411112604/https://tboteproj... where they claim their website is under "surveillance" because it got a few thousand requests from Google Cloud et al, most of them to a single page. This shows how low their standards are.
The way that Reddit "researcher" had Claude bang out a GitHub repo in a couple days and single-handedly established the narrative throughout the internet is scary.
When it was released I read a few of the reports in this repo and they didn't even support the claims made. Claude was admitting it couldn't find the evidence.
It's terrifying how easily this misinfo operation established itself as fact on websites where users view themselves as being more informed than average on these topics, like Hacker News.
> There is no evidence it is actually coming from Meta
My personal view that social media should be age gated is caused by Meta. But broadly, polling shows a commanding majority (60+ percent) of Americans believe in restrictions for under 14s.
Is there broad support for digital ID, age verification, etc? Or is it a broad sentiment that kids shouldn’t be on social media. Everyone I know agrees with latter but almost no one supports the former.
The parent commenter is conflating two things. Your right, there can be broad general sentiment that "kids probably shouldn't on social media, or better framed, social media in it's current iteration isn't healthy for people especially kids" but that doesn't imply people are asking for intrusive surveillance or to be monitored at all times when they are online.
I keep reading this but I don't understand how a company might want to push censorship on users. What is the economic benefit of censorship? Does Meta's bottom line increase if there is no illegal content and every user is age verified on the site? Would Meta care if you use a VPN?
The ones that stand to benefit the most are the governments themselves and their surveillance network.
Barriers to entry. If I want to make a small forum, these laws make that potentially much more difficult. Now users who may have used my forum may spend more time on facebook instead.
Multiply that times tens of thousands of new sites not being created, tens of thousands of existing sites no longer existing or being accessible due to new laws, this occurring over multiple surfaces (content moderation, age verification, etc) and the positive impact for meta is meaningful.
This is grasping at straws. Centralised social media platforms have won long ago for completely different reasons (mostly network effects and convenience). They haven't been threatened by independent sites for ages.
Not that many years ago, Facebook tried to broker a deal to provide free internet to India if all of their web traffic and communications would happen within the Facebook ecosystem.
It's long been the dream of more than a few American companies to be the gatekeepers of the web.
IIRC the model was closer to a freemium model where you would get free internet to approved websites (including Facebook) with the ability to access the entire internet for an extra fee.
Facebook and approved sites wouldn’t count towards your mobile bandwidth quota, but the rest of the internet does and requires a data plan.
I've read a take somewhere that seemed to make sense. They don't want to get stuck with the liabilities of the content that gets posted on their platforms. So by forcing the age verification onto the users, forcing users to identify and track themselves, they can have a "clean" route to someone who posts illicit content on their platforms.
It just sucks that that's all in sacrifice of our privacy.
The idea from the case in the link is that their competitors would be more regulated then them but in general, if regulation is a requirement and they’ve already implemented the regulation then it’s hard for a competitor to emerge.
I keep reading this but I don't understand how a company might want to push censorship on users.
We're being astroturf-ed guy.
The comment you're responding to. The comments responding to you. All shaped by influence campaigns from the beginning.
Meta, X, google, data based big tech, the billionaires, and the government were in on the plan from the start. We were always the ones kept in the dark as to the ultimate intent. Even the anti-censorship and anti-surveillance posts and content that we saw, were being paid for by the same puppet masters. Professional influence campaigns controlled by these same groups shaped the internet discussion of both sides.
And it seems a lot of us still haven't figured that out yet.
We got played. We'll continue to be played if we don't recognize that fact and act to prevent it in the future.
Because I can assure you, censorship and surveillance is not the endgame. And their endgame is very likely not to our benefit.
I wouldn't say captured. Zuckerberg has been cutting deals with the new administration so often people were seeing him at the Pentagon. It's a partnership
Yep. I brought this up yesterday on the Roblox thread but HN has been ingesting the propaganda for too long to understand their beliefs about Roblox are misled.
Time to adjust your priors y'all. This is a concentrated effort toward surveillance, controlling who we talk to, and what information we're fed.
My guess is bots. Govts and law makers are afraid of the barrage of bots DDOSing them so they are slowly and surely tightening the noose around the internet. I'm all for net neutrality and anonymity on the internet and I don't like the age laws one bit, but I too am afraid of the bots scorching the internet. I still hate these growing dystopian laws but I also want the bots to be driven away from the "human internet" .
Pretend to be anti-censorship. Get voted in. Fast track all of the censorship and surveillance through congress.
When I saw certain billionaires talking up anti-censorship and anti-surveillance a few years ago, I knew we would be screwed. (I knew the same billionaires had large positions in censorship and surveillance tech.) No one ever talks against their own book unless they're planning on screwing you.
> What will we end up with? Only attested modems / endpoints in the home?
you might laugh/cry, but there was a time in germany, when the telephone at home was owned by the state (the "Post") and you were NOT allowed to tinker with it.
personally, i guess, things like sneakernet, lorawan and hamradio will become a lot more popular over time.
My pet theory is that network protocols will evolve to require some kind of certificate-based signing to uniquely identify individuals and groups. Hardware and operating systems will have legal mandates to enforce this. Penalties for carrying unsigned traffic will be stiff.
The “upsides” will be plentiful! User verification schemes will be streamlined like never before. If you think there are downsides… well, just think of the kids, damn it!
The people making these decisions are religious fanatics. They don’t care.
This is one of the reasons why the purge of the federal government and military has happened. Surveillance state stuff was pretty scary from day 1… doubly so now that the leadership is all toadies who will remain embedded for decades.
I dare you to get half a dozen people with a technical background to call their electeds and explain why these rules are stupid. (And, if they insist on implementing age gates, as seems to be popular, the least worst ways to do it.)
>>they must have some technical advisors who can explain to them that the solutions they propose will not work
You are assuming good faith on the part of those legislators.
That is an error.
There is no good faith to be had and they could not care less about physical restrictions, incompatibilities, or impossibilities.
Their goal is to maximize their power and minimize or eliminate people's power, regardless of whether it is legitimate or desired by the people they claim to represent.
You would be more productive summoning the ghost of Richard Feynman to explain quantum physics to a dung beetle than to have a network expert attempt to enlighten those pseudo-legislators.
We will end up with what China, Russia and Iran have. The American right has come to grips with the fact that their ideas and beliefs will not will not win on merit alone so they're moving to restrict and eliminate alternatives.
I mean if you're discussing strictly America, you lot haven't had any form of government that's been anything but right wing for at least a few decades (was not born before this lol).
The country is descending into fascism. If you’ve previous endulged in the politics of “I don’t care about politics”, it’s time to stop and look around you.
The only baffling thing is taht it took this long.
In the physical world, we can limit the types of businesses. We can limit access to them. Casinos, adult entertainment, drinking establishments, etc require efort to go to and there's enforcement (not always effective, obviously) to keep, say, minors out.
The Internet has broken down that structure such that there are no limitations and, like it or not, that's really harmful. Widespread access to sports betting and crypto gambling is just a negative. There is nothing positive about this. Gambling preys on desperate people and gambling addiction quite often leads to suicide.
So I think it was inevitable that lawmakers would get involved. The only question now is what kinds of restrictions we get, how they work and what the enforcement mechanisms are. Some will say "this is a parenting issue". That's shown to be completely insufficient.
My point is that fighting this is (IMHO) a losing battle.
There are a lot of predictable outcomes here. For example, Meta thinks age verification should be enforced at the OS level. Shocker. The company that has no OS thinks OS should be responsible and, more importantly, liable.
IMHO private companies shouldn't be trusted with verifying IDs. The government should do that because, you know, they're the ones who issued the IDs.
I also think the minors simply shouldn't be able to create Apple or Google accounts. Child accounts should belong to an adult account and that adult is responsible for setting the age correctly. The child account should become an adult account when they turn 18.
Attacking VPNs, as Utah is doing here, is... a choice. I don't think that's a winning strategy but we will see.
I also think that location of a user is going to be increasingly enforced and verified. NVidia actually does something like this to try and block their cards being used in China. The cards will ping various locations to try and establish location. I think sites will start doing that too.
Take social media sites like Twitter, for example. There are obviously bots. But there are also people in developing nations who have figured out they can monetize being controversial. I think it would actually be value if we know that Debra the MAGA influencer is actually in Nigeria.
Remember the conspiracy theorists talking about this for decades? I do. This is the goal of a bourgeois class of people who want to save their livelihoods and status in the world though don't want any circumstances they can't control - legislators are out of touch with the majority of people as they are funded by any really serve those bourgeois.
We will end with correct and desired behaviour. If you misbehave, you get internet ban, and lose your livelihood. Driving licences, passports, electricity, banking... etc already work this way.
Technical details are irrelevant.
You should not be able to criticise current or previous government!
> if a website cannot reliably detect a VPN user's true location and the law requires it to do so for all users in a particular state, then the legal risk could push the site to either ban all known VPN IPs, or to mandate age verification for every visitor globally.
Clearly anyone slightly sophisticated can bypass restrictions like this. A quick search reveals https://github.com/shadowsocks. This only harms regular users who might benefit from privacy. The dystopia levels continue to rise...
There's tension between this law and the 14th, 5th and 1st amendments.
Due process doctrine from the 5th and 14th establish unconstitutional vagueness. A law cannot be so vague as to be impossible to comply with. This law requires websites to enforce a ban based on information they don't have access to. Without explain how they might possibly achieve that aim, it can be considered unconstitutionally vague.
The 1st amendment requires that a law restricting free speech use the least restrictive means possible to achieve it's aim. Due to the vagueness of how to comply on a technical level, the only possible way to comply would be to require global identity verification based on Utah's standards. I don't think that would pass a least restrictive means test.
VPNs are on their way toward being banned and/or heavily regulated. I imagine what will happen is a requirement for VPN providers to "know your customer" just as banks do, and for them to be able to tie a particular traffic stream back to a specific human.
Truly enforcing this kind of ban would require a level of control over the internet much greater than China's. They actually do ban VPN use, yet plenty of Chinese people still use them, and not due to lack of trying on the part of the enforcers. You can basically never plug all the holes without essentially shutting off the whole internet.
China spends roughly $6.6B censoring their internet every year [1]. Much of that probably goes to "guiding" public opinion as opposed to simply removing undesirable content, but factoring in purchasing power parity of labor and parts, let's assume the US would spend roughly the same amount just to enforce a VPN ban mostly effectively. That doesn't sound like a position that will win elections.
China doesn’t actually want to ban VPNs. They want a list of all possible dissidents so they can actively monitor them. “Banning” VPNs just lets them narrow down the list of people who might engage in wrong think.
There are plenty of other ways to virtual data without a VPN, e.g. sockpuppets, ipfs, etc. Since data tends to drift towards being free, it is a game of wack-a-mole.
How many users are going to have the technical acumen & desire to keep playing the game?
At some point the number of people who are going to be able to succeed is so small they might know who you are just by virtue of you continuing to compete.
You'd also need to ban VPNs in other countries, which you cant, so short of stripping all access to the internet outside of America there's not a lot you could realistically do.
Ban them, demand GitHub et al take down the illegal repos, hit up Microsoft for records of everyone who ever downloaded them, hosting providers for customer records, and ISPs for lists of customers with VPN-shaped traffic between themselves and their hosting provider. Or if they’re lazy, just demand that the hosting providers sort it out.
This assumes US citizens using exclusively US based VPNs. You'd have to block all outside internet access as well, or you cannot stop someone in the US using a VPN based in another country (short of IP whackamole).
To an extent, but the US often compels foreign companies to either not deal with US customers or put up with US’s bullshit, so they could potentially get compliance from major overseas providers. More onerous domestic policy could also prevent it, like requiring that domestic network providers block unauthorized encrypted connections to foreign entities. And anyways, making something illegal doesn’t actually require making it physically impossible to do.
The question is not how will they ban it, they just pass a law.
The question is how and when will they enforce it. When they get access to your devices for some other reason, they will see it. It will give them another easy to prosecute law to use against you.
I gather that's what all the sneaky bills introduced over the last decade banning encryption were attempting to do. They absolutely want this at the federal level.
What is the motivation for such a measure? In other words, which problem is it trying to solve? And how it is supposed to do so?
I think that we should not carelessly invent laws that just "sound good" to some lawmakers but have no real fact checking done to support them and are not backed by science.
Because, in my opinion, then there is a high risk that these "good intentions" will backfire spectacularly. While not getting even close to achieve the desired effect.
This sounds reasonable to me. It only affects websites with content harmful to children, and forces them to close an obvious loophole. Many VPN ranges are published (including Tor) and it's not difficult to find most of the rest.
There is no need for age verification: ban all mobile devices and access to anything vaguely "social" (and possibly porn) for everyone under 18. Place heavy fines. But it requires more guts than governments have. They get lobbied, coerced by corruptible friends, and threatened, and we end up with the worst of all outcomes: addicted children without attention and lack of privacy.
I mean, I understand what it effects it has, and why many parties want to perfect their expanding panopticon, and why screaming think of the children makes politicians' brains turn off.
It won't fix children or social media. That's been apparent ever since Facebook defaulted to real names and people still posted everything they would have otherwise. It makes it easier to use social disapproval to destroy nonconforming individuals, I suppose. And to sell ads. And to destroy anyone who criticizes the government. So no real downside if you don't care about that sort of thing.
When I was a kid, I acquired long distance calling cards[0] so that I could dial into faraway BBSes and access a different variety of pictures of nakedness than I had access to locally. This notion that you can bar kids from accessing porn is highly amusing.
[0]Fictional; this is not a confession; I know my rights
This is the stupidest idea I’ve heard recently. Way to go, Utah.
My home router has a built in VPN server. When I’m out running around, my iPhone can route traffic through my house. Pray tell, o sage Utah legislature chucklefucks, how is anyone expected to tell that I’m accessing a website from a hotel in Berlin instead of my house in California? (Which is why we used it last time: I configured my travel router to use that same VPN so we could watch American Netflix at night before bedtime when we just wanted something familiar to relax with.)
Honestly, this is the new “pi equals 3” legislation. “Let’s make laws codifying technical ideas we clearly have no freaking clue about”.
> how is anyone expected to tell that I’m accessing a website from a hotel in Berlin instead of my house in California
Remote attestation in combination with location access as a start. DPI on TCP/UDP timinings/round trip time measurements for distant locations, combined DNS leak detection to catch bad VPNs. Use browser APIs to detect WiFi vs mobile data to let some 2G users through. IPv6 accessibility checks to catch many other VPNs.
There are always technical means, as the more restrictive streaming services like to prove. There are many, many more ways websites can verify that users are not on a VPN that most websites don't bother with, and until they all do and people still use VPNs, legislators will find ways to punish websites.
The real end goal isn't to block content these people dislike within their state, of course. The goal is to go after the existence of adult websites and, in worryingly more common cases, websites discussing basic LGBTQ topics.
No. That’s how someone with pervasive access to Internet infrastructure could tell when I’m on a VPN. It’s impossible for a given website to tell that I’m accessing it over a VPN. Not difficult: impossible. It cannot be done.
Technical measures while technically existing failed first in China and then in Russia lately, Russian authorities recently all but admitted that they can not block xray+reality-style VPNs (which were and are developed in China to go over their "great firewall") and now talk about a blanket ban on foreign traffic and basically a whitelist for internet.
The goal is always a perception of control of public narrative. Those people deeply care what "masses" think of them. That they measure mostly by sampling more or less public media (and I actually worked at a company in 2010s which was selling exactly that). And when they don't like what they see, they try to fix that by controlling that media, up to and including banning the whole world.
That is what is happening with all this protecting the children stuff.
Well, yes—parents’ groups are coordinating. Similar to how drunk driving and cigarette rules were passed globally in about a generation. You don’t need reptiles when polling is so strongly against kids on social media.
What a coincidence that Utah is following the same pattern as Australia, the European Union, Norway and the UK, while pretending they came up with it independently.
Utah is actually trailblazing ahead of the UK here. It was only ministers possibly suggesting VPNs would be next in the firing line and AFAIK nothing has progressed beyond that yet
Yet articles about UK age verification stuff got HUGE amount of attention and backlash here...
> Commercial entities that host "a substantial portion of material harmful to minors" are now prohibited from facilitating or encouraging the use of a VPN to bypass age checks.
People need to do their best to stop paying so much in taxes to their state governments, failing which the governments get increasingly authoritarian. The state governments clearly have run out of real problems to solve, and when they do, they then attack basic freedoms. Keeping them strongly tax-constrained keeps them lean. As it stands, these governments are representing special interests, not the people. It doesn't matter how many places or where this is happening; the logic is the same. What happens is that the tax money is a prerequisite for strong enforcement. Without an excess in tax money, there isn't going to be substantial enforcement. I am not asking anyone to break tax law; only to aggressively hunt for exceptions to your advantage.
Outside of a W-2 salary for which taxes are pre-deducted, there are many ways, more applicable to businesses, also to independent contractors. Even for those with a salary, they ought to do their best to collect all the legally qualified benefits that they can. Lots of independent contractors get paid as W-2 when they could be getting paid as a corp, for which they could write off a portion of the taxes via deductibles and in various other ways. Lots of people could be ordering online at websites that don't deduct a sales tax. Using a Delaware corp for various transactions can also go a long way. Living in a geography where the property taxes are not absurdly high or rising also matters.
Unfortunately it’s been impossible to avoid Red or Blue flavored authoritarianism for the last few decades due to authoritarian control over both the political process and the entrenched bureaucracy.
Yes because the countries with lower taxes are so free and democratic. Pretty sure the relationship is inverse if you take even 5 min of your time to look.
Sure if you wanna put it that way. I don't like paying taxes because our government doesn't use it well. But I also know that if I don't pay taxes I'm gonna have a bad time.
Outside of a W-2 salary, there are ways, more applicable to businesses, also to independent contractors. Even for those with a salary, they ought to do their best to collect all the legally qualified benefits that they can.
Lots of independent contractors get paid as W-2 when they could be getting paid as a corp, for which they could write off a portion of the taxes via deductibles and in various other ways.
Lots of people could be ordering online at websites that don't deduct a sales tax. Instead, they pay a substantial amount in sales tax.
Using a Delaware corp for various transactions can also go a long way.
I don't think anyone voluntarily pays more taxes than they ought to. People DO collect all their legally qualified benefits. It's why software like turbo tax is still around despite being a shitty company.
Honestly, I would like my ISP to block all traffic to and from Utah if this law passes. I can't think of anything I want or need that involves that state.
I realize all my traffic gets siphoned there regardless more than likely anyways.
Big tech wants regulatory capture.
Their website also added this page since I posted that comment: https://web.archive.org/web/20260411112604/https://tboteproj... where they claim their website is under "surveillance" because it got a few thousand requests from Google Cloud et al, most of them to a single page. This shows how low their standards are.
When it was released I read a few of the reports in this repo and they didn't even support the claims made. Claude was admitting it couldn't find the evidence.
It's terrifying how easily this misinfo operation established itself as fact on websites where users view themselves as being more informed than average on these topics, like Hacker News.
My personal view that social media should be age gated is caused by Meta. But broadly, polling shows a commanding majority (60+ percent) of Americans believe in restrictions for under 14s.
The ones that stand to benefit the most are the governments themselves and their surveillance network.
Multiply that times tens of thousands of new sites not being created, tens of thousands of existing sites no longer existing or being accessible due to new laws, this occurring over multiple surfaces (content moderation, age verification, etc) and the positive impact for meta is meaningful.
If there are less sites, meta wins.
It's long been the dream of more than a few American companies to be the gatekeepers of the web.
Facebook and approved sites wouldn’t count towards your mobile bandwidth quota, but the rest of the internet does and requires a data plan.
Which raised net neutrality concerns.
It just sucks that that's all in sacrifice of our privacy.
Anything that makes it harder for a user to escape their dragnet is a win.
It’s just that
“Move fast, break things, regulate impossible to repair.”
We're being astroturf-ed guy.
The comment you're responding to. The comments responding to you. All shaped by influence campaigns from the beginning.
Meta, X, google, data based big tech, the billionaires, and the government were in on the plan from the start. We were always the ones kept in the dark as to the ultimate intent. Even the anti-censorship and anti-surveillance posts and content that we saw, were being paid for by the same puppet masters. Professional influence campaigns controlled by these same groups shaped the internet discussion of both sides.
And it seems a lot of us still haven't figured that out yet.
We got played. We'll continue to be played if we don't recognize that fact and act to prevent it in the future.
Because I can assure you, censorship and surveillance is not the endgame. And their endgame is very likely not to our benefit.
Time to adjust your priors y'all. This is a concentrated effort toward surveillance, controlling who we talk to, and what information we're fed.
Pretend to be anti-censorship. Get voted in. Fast track all of the censorship and surveillance through congress.
When I saw certain billionaires talking up anti-censorship and anti-surveillance a few years ago, I knew we would be screwed. (I knew the same billionaires had large positions in censorship and surveillance tech.) No one ever talks against their own book unless they're planning on screwing you.
you might laugh/cry, but there was a time in germany, when the telephone at home was owned by the state (the "Post") and you were NOT allowed to tinker with it.
personally, i guess, things like sneakernet, lorawan and hamradio will become a lot more popular over time.
The “upsides” will be plentiful! User verification schemes will be streamlined like never before. If you think there are downsides… well, just think of the kids, damn it!
Baffled? The whole country's democracy is diving off this cliff, seems to me.
This is one of the reasons why the purge of the federal government and military has happened. Surveillance state stuff was pretty scary from day 1… doubly so now that the leadership is all toadies who will remain embedded for decades.
I dare you to get half a dozen people with a technical background to call their electeds and explain why these rules are stupid. (And, if they insist on implementing age gates, as seems to be popular, the least worst ways to do it.)
I would expect they mostly listen to special interests advocating for those laws. They don’t come from nowhere
You are assuming good faith on the part of those legislators.
That is an error.
There is no good faith to be had and they could not care less about physical restrictions, incompatibilities, or impossibilities.
Their goal is to maximize their power and minimize or eliminate people's power, regardless of whether it is legitimate or desired by the people they claim to represent.
You would be more productive summoning the ghost of Richard Feynman to explain quantum physics to a dung beetle than to have a network expert attempt to enlighten those pseudo-legislators.
In the physical world, we can limit the types of businesses. We can limit access to them. Casinos, adult entertainment, drinking establishments, etc require efort to go to and there's enforcement (not always effective, obviously) to keep, say, minors out.
The Internet has broken down that structure such that there are no limitations and, like it or not, that's really harmful. Widespread access to sports betting and crypto gambling is just a negative. There is nothing positive about this. Gambling preys on desperate people and gambling addiction quite often leads to suicide.
So I think it was inevitable that lawmakers would get involved. The only question now is what kinds of restrictions we get, how they work and what the enforcement mechanisms are. Some will say "this is a parenting issue". That's shown to be completely insufficient.
My point is that fighting this is (IMHO) a losing battle.
There are a lot of predictable outcomes here. For example, Meta thinks age verification should be enforced at the OS level. Shocker. The company that has no OS thinks OS should be responsible and, more importantly, liable.
IMHO private companies shouldn't be trusted with verifying IDs. The government should do that because, you know, they're the ones who issued the IDs.
I also think the minors simply shouldn't be able to create Apple or Google accounts. Child accounts should belong to an adult account and that adult is responsible for setting the age correctly. The child account should become an adult account when they turn 18.
Attacking VPNs, as Utah is doing here, is... a choice. I don't think that's a winning strategy but we will see.
I also think that location of a user is going to be increasingly enforced and verified. NVidia actually does something like this to try and block their cards being used in China. The cards will ping various locations to try and establish location. I think sites will start doing that too.
Take social media sites like Twitter, for example. There are obviously bots. But there are also people in developing nations who have figured out they can monetize being controversial. I think it would actually be value if we know that Debra the MAGA influencer is actually in Nigeria.
Technical details are irrelevant.
You should not be able to criticise current or previous government!
The bottom line:
> if a website cannot reliably detect a VPN user's true location and the law requires it to do so for all users in a particular state, then the legal risk could push the site to either ban all known VPN IPs, or to mandate age verification for every visitor globally.
Clearly anyone slightly sophisticated can bypass restrictions like this. A quick search reveals https://github.com/shadowsocks. This only harms regular users who might benefit from privacy. The dystopia levels continue to rise...
Due process doctrine from the 5th and 14th establish unconstitutional vagueness. A law cannot be so vague as to be impossible to comply with. This law requires websites to enforce a ban based on information they don't have access to. Without explain how they might possibly achieve that aim, it can be considered unconstitutionally vague.
The 1st amendment requires that a law restricting free speech use the least restrictive means possible to achieve it's aim. Due to the vagueness of how to comply on a technical level, the only possible way to comply would be to require global identity verification based on Utah's standards. I don't think that would pass a least restrictive means test.
Host them on the cloud providers? You get banned.
Host them in your homelab and the ISP finds out? You get your Internet cut.
How will either of them find out? IP addresses and/or DPI.
All it'll take is an executive order or an act of Congress.
China spends roughly $6.6B censoring their internet every year [1]. Much of that probably goes to "guiding" public opinion as opposed to simply removing undesirable content, but factoring in purchasing power parity of labor and parts, let's assume the US would spend roughly the same amount just to enforce a VPN ban mostly effectively. That doesn't sound like a position that will win elections.
[1]: https://jamestown.org/buying-silence-the-price-of-internet-c...
At some point the number of people who are going to be able to succeed is so small they might know who you are just by virtue of you continuing to compete.
It'd be a stupid future, but it's a stupid present so I'm not going to rule it out on those grounds.
The question is how and when will they enforce it. When they get access to your devices for some other reason, they will see it. It will give them another easy to prosecute law to use against you.
I'm more scared that there is a push to do this federally, as that will, effectively, be tantamount to establishing explicitly state-controlled media.
https://news.ycombinator.com/item?id=47969868
I think that we should not carelessly invent laws that just "sound good" to some lawmakers but have no real fact checking done to support them and are not backed by science.
Because, in my opinion, then there is a high risk that these "good intentions" will backfire spectacularly. While not getting even close to achieve the desired effect.
This is just one of the way. “The Anxious Generation”- Jonathan Haidt put it across. Rey well. It’s import at this day and age to check age online.
Banning VPN is not the way.
Even ChargePoint app does not work with vpn on I am baffled.
I mean, I understand what it effects it has, and why many parties want to perfect their expanding panopticon, and why screaming think of the children makes politicians' brains turn off.
It won't fix children or social media. That's been apparent ever since Facebook defaulted to real names and people still posted everything they would have otherwise. It makes it easier to use social disapproval to destroy nonconforming individuals, I suppose. And to sell ads. And to destroy anyone who criticizes the government. So no real downside if you don't care about that sort of thing.
[0]Fictional; this is not a confession; I know my rights
My home router has a built in VPN server. When I’m out running around, my iPhone can route traffic through my house. Pray tell, o sage Utah legislature chucklefucks, how is anyone expected to tell that I’m accessing a website from a hotel in Berlin instead of my house in California? (Which is why we used it last time: I configured my travel router to use that same VPN so we could watch American Netflix at night before bedtime when we just wanted something familiar to relax with.)
Honestly, this is the new “pi equals 3” legislation. “Let’s make laws codifying technical ideas we clearly have no freaking clue about”.
Again, way to go, Utah.
Remote attestation in combination with location access as a start. DPI on TCP/UDP timinings/round trip time measurements for distant locations, combined DNS leak detection to catch bad VPNs. Use browser APIs to detect WiFi vs mobile data to let some 2G users through. IPv6 accessibility checks to catch many other VPNs.
There are always technical means, as the more restrictive streaming services like to prove. There are many, many more ways websites can verify that users are not on a VPN that most websites don't bother with, and until they all do and people still use VPNs, legislators will find ways to punish websites.
The real end goal isn't to block content these people dislike within their state, of course. The goal is to go after the existence of adult websites and, in worryingly more common cases, websites discussing basic LGBTQ topics.
The goal is always a perception of control of public narrative. Those people deeply care what "masses" think of them. That they measure mostly by sampling more or less public media (and I actually worked at a company in 2010s which was selling exactly that). And when they don't like what they see, they try to fix that by controlling that media, up to and including banning the whole world.
That is what is happening with all this protecting the children stuff.
> Fighting Federal Overreach
"The US govt can't overreach! That's my job!"
Equally clearly, this is a first step to requiring identity, and ultimately government approval for your activities in the internet.
Somehow, we really must reign in the political class, before we truly land in a dystopia.
One would think this would be obvious to more HN readers, being the supposed technical “systems thinkers” they purport to be.
Well, yes—parents’ groups are coordinating. Similar to how drunk driving and cigarette rules were passed globally in about a generation. You don’t need reptiles when polling is so strongly against kids on social media.
Yet articles about UK age verification stuff got HUGE amount of attention and backlash here...
This country is led by idiots that do not enjoy or like freedom.
This country is populated by idiots that do not enjoy or like freedom. These people didn’t just seize power in a coup.
The people who lead our country love their own freedoms, as long as it allows them to infringe on everyone else's freedoms.
So if I have jo-blow web site.
And a user uses a VPN, how am I supposed to do anything about it. And why should i?
> Commercial entities that host "a substantial portion of material harmful to minors" are now prohibited from facilitating or encouraging the use of a VPN to bypass age checks.
https://www.eff.org/deeplinks/2026/04/utahs-new-law-regulati...
I say things in support of my LGBTQ friends and neighbors. Now it’s technically harmful to minors.
This isn’t a slippery slope. It’s already an avalanche.
The fun part is when you post videos of yourself using a vpn to go to gov website or the candidate website and watch them do nothing
Outside of a W-2 salary for which taxes are pre-deducted, there are many ways, more applicable to businesses, also to independent contractors. Even for those with a salary, they ought to do their best to collect all the legally qualified benefits that they can. Lots of independent contractors get paid as W-2 when they could be getting paid as a corp, for which they could write off a portion of the taxes via deductibles and in various other ways. Lots of people could be ordering online at websites that don't deduct a sales tax. Using a Delaware corp for various transactions can also go a long way. Living in a geography where the property taxes are not absurdly high or rising also matters.
If you’ve had a successful career already, you may be able to “drop out” and find a place to live cheaply. I’ve heard good things about Panama.
Lots of independent contractors get paid as W-2 when they could be getting paid as a corp, for which they could write off a portion of the taxes via deductibles and in various other ways.
Lots of people could be ordering online at websites that don't deduct a sales tax. Instead, they pay a substantial amount in sales tax.
Using a Delaware corp for various transactions can also go a long way.