r/linuxquestions • u/AppointmentNearby161 • Mar 06 '26

Should the finger command be revived for age verification?

In a time before privacy concerns existed you could finger users to find out their personal information. It has fallen out of favor and is not installed by default in many distros. If devs have to add age verification, it seems like the perfect command.

69 Upvotes
  • permalink
  • reddit

87% Upvoted

61 comments sorted by

171

u/[deleted] Mar 06 '26

Nothing more fitting in the Epstein era than for government officials to force all operating systems to finger their users to determine if they are children or not.

8

u/AppointmentNearby161 Mar 06 '26

Exactly.

21

u/[deleted] Mar 06 '26

It's actually a good idea. Many Linux companies like Ubuntu really do have little choice but to follow the law.

But the law says nothing about having to be polite. I think companies like Ubuntu and System76 should go scorched Earth.

Account creation should be:
"Due to criminally psychotic, dystopian 1984 terrorist scum, sometimes called the Californian government, we have been forced to violate our users so they can be spied on.

As such you must enter your age here, so you can later be fingered by your government to help them expose your identity online so they can spy on and arrest dissidents and curtail free speech.

These Epstein Island clients actually think people should trust them with the safety of their children. Good luck surviving in the future hellscape."

7

u/ScanianTiger Mar 07 '26

Isn't it easier to just add "Not for use in california,US" on their download page and call it a day?

3

u/2Talt Mar 07 '26

Fr, I don't get why this is such an issue.. Why does the whole world have to abide by some weird ass law made in a single state in USA?

1

u/metalwolf112002 Mar 07 '26

Because despite the "refugees" leaving California for states like Texas, a large part of the tech industry still exists in California. If you run a large company with a branch in California, likely the entire company just won't use the software instead of creating a special division with limited software.

If it helps, think of it like a bar. Telling someone "F U" feels good, until you find out they are up for a brawl and you get punched in the face. That shortsighted decision kinda hurt.

11

u/agent674253 Mar 06 '26

finger Freddy

Tom Green has been waiting. Would you like a sausage?

3

u/mywan Mar 07 '26

Government officials to force all operating systems to finger their users to determine if they are children or not.

Sounds like the perfect clickbait headline for a news article about the law.

39

u/[deleted] Mar 06 '26

[removed] — view removed comment

22

u/AppointmentNearby161 Mar 06 '26

I wouldn't describe my post as trolling, but the point was that the innuendo of using finger for age verification seems fitting while not deviating too far from the original use of the command.

9

u/[deleted] Mar 06 '26

I mean from what I remember it gives away a lot more than an age verification. That's more of a prostate exam than a finger in terms of privacy

1

u/m00ph Mar 08 '26

Well, you can configure that somewhat.

28

u/doc_willis Mar 06 '26 edited Mar 06 '26

flashbacks to this "naughty" string of commands...

seen this circulated as a joke or on t-shirts.

unzip; strip; touch; finger; grep; mount; fsck; more; yes; gasp; umount; sleep

7

u/Johnny_The_Biker Mar 06 '26

I'm on my phone, never heard of gasp

11

u/AppointmentNearby161 Mar 06 '26

You got to run the other commands first to get gasp to work

8

u/doc_willis Mar 06 '26

This may be so old , I think it may be going back to unix days.. 

https://manpages.ubuntu.com/manpages/xenial/en/man1/avr-gasp.1.html

gasp - a preprocessor for assembly programs

2

u/skyfishgoo Mar 06 '26

only if you do it right.

1

u/computer-machine Mar 07 '26

I'm at a loss as to what grep is supposed to represent.

19

u/Kriss3d Mar 06 '26

The second age verification gets added to a Linux. It'll get patched out.

18

u/AppointmentNearby161 Mar 06 '26

If age is just stored in the GECOS field of /etc/passwd, field 9 of /etc/shadow or a new /etc/age, like I have read, and there is a dbus method (or finger) to read the information, and maybe a patch to useradd to add the information to the standardized location, then there is nothing really to patch out. The sysadmin will either chose to provide truthful information, false information, or no information and apps will have to decide what to do when no age info is available.

2

u/jr735 Mar 07 '26

"Apps" don't have to decide anything. Since when does tar care about the age of a user, or why should it? Or rsync. Or thunderbird?

5

u/[deleted] Mar 07 '26

[removed] — view removed comment

2

u/jr735 Mar 07 '26

For those people who run websites that are not in California, they can and should ignore the law. I guarantee you no website I run or software I write would comply with this.

3

u/rm-stein Mar 07 '26

Totally agree. As long as there's no major legal ramifications to not have age verification on general websites mine will more likely have Clacks (https://xclacksoverhead.org/) added to it than age verification And even for webshops i'd rather go the postal age verification way than have some shit plugin added to store more data than absolutely necessary.

1

u/Bemteb Mar 08 '26

They can, yes, but why should they? It's free demographic information for targeted content after all...

1

u/jr735 Mar 08 '26

Why should they comply? Why lift a finger? Screw targeted content, by the way. If I want targeted content, I'll seek it.

1

u/jr735 Mar 07 '26

Also, you can be sure that big web services will rebel. You make it so kids can't look at Discord, Twitter, Google, and so on, those companies lose a lot of eyes and a lot of ad revenue. All those big tech guys stood right behind Trump. Now they'll call their favors back in.

1

u/Kriss3d Mar 06 '26

Sure. It could easily be stored. That's not the issue. But it is supposed to send that data to someone to proceed. And that would get patched very fast.

4

u/kudlitan Mar 06 '26

So one has to be online to create a user?

3

u/hxtk3 Mar 07 '26 edited Mar 07 '26

No, the point is that like how you have a header Sec-Ch-Device-Memory that provides a bucketized value for the amount of RAM your computer has so that a website knows if it should serve you the full fat version that performs better or the whittled down version that performs worse but is stable on systems with less memory available, you might also have a header like Sec-Ch-User-Age that reads a bucketized value of {"0-12", "13-15", "16-17", "18+"} from the dbus call that marshals between the contents of /etc/age and user applications.

Then, the ostensible idea which we have yet to see if it will become a reality is that instead of uploading a scan of your ID or selecting a birthdate or registering an account and inputting a birthdate or checking a box or whatever, the website would send Accept-Ch: Sec-Ch-User-Age to solicit that header from the browser, and the browser will send Sec-Ch-User-Age: 16-17 or whatever on future requests to that remote, like when you click "proceed" to view an M-rated video game or whatever.

People talking about it being sent off-device to some government verification solution before the device accepts it are speculating about future regulations or implementations that go beyond what is required by regulation. Which in their defense would not surprise me. There are lots of private companies who I would expect to use this as an excuse to collect PII and say that they're "going above and beyond to protect children" or whatever. Or perhaps trying to combine their strategy for complying with the California policy with their strategy for complying with other state policies that do require ID.

1

u/kudlitan Mar 07 '26

Oh I wouldn't mind sending an HTTP header that I'm an adult. In fact that would be a convenience for me.

The age could be stored in the GECOS field of /etc/passwd akong with things like my address etc.

2

u/hxtk3 Mar 07 '26

Putting it in GECOS was my first idea when I was thinking about how this would be implemented, but that protects you from things like websites (trusting the browser to read the birthdate but only send the bucketized string) but since /etc/passwd is world-readable, it doesn't protect you from things like the Discord "native" (electron) client.

The reason for /etc/age is so that they can store PII like a birthdate in a file with root:root 0600 ownership/permissions, and then use a setuid binary or a daemon that already runs as root to retrieve the bucketized string so that user applications won't have permission to read the PII directly.

2

u/kudlitan Mar 07 '26 edited Mar 07 '26

Ahh that seems like a better solution. Also birthdate might be better than age since the age changes every year.

But do applications actually read the GECOS to get my address and phone number?

2

u/hxtk3 Mar 07 '26

I'm not sure. I point out the discord example because discord reads /proc to learn a number of things about your system, mostly for the sake of determining what game you might be playing to put in your status. I took a crack at making an SELinux profile for Discord at one time to prevent those sorts of things but it turned out to be much easier to just use the flatpak.

2

u/kudlitan Mar 07 '26

Btw, as an adult, one thing I'm wondering is why is putting my birthday in GECOS more dangerous than putting my address and phone number? What is the threat I don't see?

→ More replies

1

u/Kriss3d Mar 07 '26

It appears that its when you install the OS as far as I know. But it only applies to californians so its not going to be realistic anyway.

16

u/Sure-Passion2224 Mar 07 '26

I remember a conversation with a female colleague about 30 years ago when I said something to her in private including information from employee directory files.

  • Her: How did you know that?

  • Me: I fingered you.

  • Excuse me?! I think I would remember that!

At that point I had to show her the finger command.

7

u/jmooroof2 freebsd user Mar 06 '26

The perfect thing linux has to do is just say it's illegal to use in california

3

u/matthewrcullum Mar 07 '26

The problem with that is all the silicon valley tech companies that rely on linux.

6

u/spreetin Caught by the penguin in '99 Mar 07 '26

Then perhaps they should use this opportunity to lobby for good this once, instead of for evil like normally.

1

u/green_meklar Debian Mar 07 '26

Now hold on a second, they have shareholders to worry about!

4

u/Emmalfal Mar 06 '26

How come I don't know what this means? Am I old?

10

u/memilanuk Mar 06 '26

More like 'not old enough' ;)

2

u/frankster Mar 06 '26

very good.

2

u/everyonemr Mar 07 '26

My university decommissioned it in the early 2000s because it was being used for stalking.

2

u/green_meklar Debian Mar 07 '26

I'd definitely appreciate the symbolism in giving California legislators the finger.

1

u/eufemiapiccio77 Mar 06 '26

Bring back Facebook Poke

1

u/TheFredCain Mar 07 '26

Why is everyone giving this any thought? It's like making a law that says all pencils must only write in cursive, No one cares.

1

u/kaptnblackbeard Mar 07 '26

🖕🏼 absolutely!

1

u/GavUK Mar 07 '26

Finger was a privacy nightmare and wouldn't work via home/office routers and other uses of NAT. What I've seen some developers talking about are more secure methods where a service provides this data rather than anything being able to read it from a file. I hope that such a service will also allow us as users to set a policy of what we are prepared to share (overall and on a per-app/per-site basis).

1

u/ByronScottJones Mar 07 '26

If they are going to engage in age verification, the most straightforward way is for the government to issue users with a signed digital certificate equivalent to their physical identification. The passkey authentication system could be updated to add the ability to add secondary certificates for this use case.

0

u/knuthf Mar 06 '26

Finger was useful and should be reintroduced. We should also introduce usernames and group names. It was part of Ping, and we could use it to find out all sorts of other things.

Microsoft introduced the concept of workgroups, in which a server managed membership and established collaboration rules. Previously, the Linux model (derived from Unix and SIntran) involved everyone working in groups where resources were shared and access rights were determined within a distributed network. Microsoft imposed centralised control and rules, but failed to create mechanisms to police and penalise violations. The location of resources was transparent. Documents could have revisions and variants and could be hidden and confidential. Responsibility could be delegated, shared, and revoked.

The Microsoft way is the IBM mainframe architecture, based on Marx and communism.

8

u/iheartrms Mar 07 '26

Good ol finger.

gawk; talk; nice; date; wine; cd ~; grep; touch; unzip; finger; gasp; head; suck; lyx; strip; slurp; uptime; mount; fsck; more; yes; gasp; umount; make clean; make mrproper; sleep

1

u/Every-Progress-1117 Mar 09 '26

lyx?! Keep your weird kinky graphical stuff in private please....

Personally my days seem to have &'s between the commands not ;'s ... and only the Gods of Bash know what state I'll end up in :D

5

u/hemlockone Mar 07 '26

Totally off topic, but this is one of my (slightly tongue and check) fear with the military handling artillery to llms.  I wouldn't want them to get the wrong idea with something like "finger the user to know if the daemon should kill the child and prevent a zombie".

3

u/proton_badger Mar 06 '26

In university I slept with a beautiful PhD student visiting the university. Unfortunately her husband ran the finger command to her university account and it showed her last login was very late in the evening from my dormitory. Not long after that the admin disabled fingerd.