Baest (probably) has until July 1, 2023 to implement "Reasonable age verification", close registrations permanently, or migrate to revolver.
illust_32814898_20230504_032002.jpg

cc @hj @lanodan is there any way at all to omit posts marked as sensitive from the API for unauthenticated users?

@sjw @hj Could be either a backend setting or something like an MRF to put all things sensitive as followers-only (bleh).

But honestly, might be better to just remove API access from unauthenticated users as stuff is going to slip through regularly. (like FSE users typically don't tag porn as sensitive)

@lanodan @sjw @hj

> stuff is going to slip through regularly

from a legal standpoint this often doesn't matter. typically you just need to make a "reasonable effort" at whatever it is. so the combination of "you must tag NSFW" plus "we will (on a best-effort basis) force tag accounts and/or instances that don't do this" plus "unauthenticated users are not permitted to view NSFW tagged posts" should cover you as long as you actually do make a best effort attempt to force tag repeat offenders

@roboneko @lanodan @hj nope it will be my duty to verify the age of users before I give them access to NSFW media. This is why I want the ability to block NSFW at the API level.

Also blocking unauthenticated search would be really nice

@roboneko @hj @lanodan I really suggest you read the bill before posting your interpretation of it

@beardalaxy @sjw @hj @lanodan @beardalaxy having read through it now (I wish all legislation were so short and to the point) it is incredibly unclear to me who it does and doesn't apply to in practice

they seem to be using an odd definition of "commercial" that doesn't take into account whether the material is being sold or what the business model of the company is. I would guess that the intention is to take aim at sites like pornhub

then they have this bit in 2.i.

> "Substantial portion" means more than thirty-three and one-third (33-1/3) percent of total material on a website, which meets the definition of "material harmful to minors" as defined by this section.

a few observations. the first being the exemption in 4.ii. which includes

> access or connection to or from a website or other information or content on the internet or a facility, system, or network not under that provider's control, including transmission, downloading, storage, access software, or other

but only to the extent that

> such provider is not responsible for the creation of the content of the communication that constitutes material harmful to minors'

the way it's worded doesn't seem to exempt local user generated content. I'm not sure if that's intentional or not. but either way it's limited to

> internet service provider, or its affiliates or subsidiaries, search engine, or cloud service provider

which would make sense if they are targeting sites like pornhub (ie a "social network" full of user generated content) but leaves an awful lot of room for unintended consequences

I'm not clear how it would work for someone like you, a single entity who provides some cloud services in addition to the social network stuff (but split across separate domains)

so anyway for everyone else I guess that's where the exemption regarding 33.3% of the content comes in. thankfully the definition of that in 2.d. is quite limited. I think the only stuff on baest that would qualify is NSFW images and videos

but of course they provide no metric for quantifying units of "content" so I dunno how much faith you want to put in that exemption. but anyway a quick db query you could run. suppose we take that metric to apply to individual posts, whether text-only or otherwise. what is the count of total local posts on baest versus the count of local posts with NSFW tagged media attached? if that number is below 1/3 then maybe you don't have a problem

you might not want to count safe posts by bots against the total lest you be accused of trying to pad the numbers

another question, what would that ratio look like if you didn't have any of the porn reposting bots? is p finally going to get his dream of total image reposting bot death?

a potential issue tho is that I don't know if you'd also need to quantify remote content in addition to local. because the exemption for content that you are not responsible for only applies to "internet service provider, or its affiliates or subsidiaries, search engine, or cloud service provider" so I don't know if serving up remote content to verified users would qualify as "publishes or distributes" or not

also cc @Humpleupagus

@beardalaxy @sjw @Humpleupagus @beardalaxy @hj @lanodan

> the bill doesn't define "content" or any other unit with which to measure a quantity of the "total material on a website"

do DMs count? they aren't publicly visible but if you take the wording literally they are definitely a subset of the "total material" dished out by the server

what about FO posts? those are only visible to some subset of users

unlisted? those don't show up on the local timeline but the local timeline is only a small fraction of the website

speaking of which. the majority of my home timeline on baest is external content. so does that mean that stuff counts?

if you use a literal interpretation of "any content that the server is aware of and which could potentially be provided to one or more local users" then that would include

* TWKN (all public scope content the server is aware of)

* local (all public scope local posts, this is a subset of TWKN)

* any other content appearing in any timeline of one or more local users (ie external or otherwise, any visibility scope)

if that's the appropriate metric (but who knows if it is) then baest would definitely be exempt

@roboneko @sjw @Humpleupagus @lanodan @hj baest may already be exempt if it is not a legally recognized business in any way. It defines what "commercial" means, it's basically just any legally recognized entity. So if baest isn't that, then there's most likely nothing to worry about.

Personally I'd think that anything the website can access counts as being part of its content. Twkn. If you can see it on the site, it counts. Alternatively, it could just be content that you HOST, like if you're fetching images remotely maybe that wouldn't count, but I'd think of it the same way as something like a forum being full of imgur embeds, where it isn't hosting the content but you can still see it there.

Let's just say Reddit has less than 1/3 NSFW content. You can still customize your home page to only show that content if that's all you subscribe to. That doesn't mean Reddit has 100% NSFW on it, just that the user only sees 100% NSFW. You still wouldn't need to provide ID to make a Reddit account, or even to see NSFW subs. I know fedi is a little bit different but I'd assume it's a very similar concept, just instead of it being one server it's a lot of them, and those servers can even choose what servers they want to display to their users.

Idk, again not a lawyer, but I don't think this is an issue that needs to be worried about. The feature to completely scrub anything NSFW instead of showing up a warning would still be nice, though.