You would need to include the birth date in the certificate. But of course that would have its own privacy implications.

And that’s what I’m trying to say: your “just do X” falls short. It is incredibly hard, maybe impossible, to build a reliable age verification system where neither the websites nor the government can violate your privacy. Even the tiniest mistake can mean that the whole thing comes crashing down. And no, “just trust your government” is not a solution. Even if I trust my current government, the next election could put raging Nazis in power who use every available database to identify and terrorize people they don’t like.

If someone designs a system that satisfies all these requirements and is reviewed by multiple independent security researchers, I’m all for implementing it. But from what I know about government IT projects, it currently looks like every country will implement its own system, each with obvious problems that can be exploited by the average computer science student.

About the part of sending the certificate, how do you say they should check the age? By smoke signs?

The whole point about certificates is that they are signed with an asymmetric cryptographic key so you can verify them on your own. You have a list of root certificates from trusted certificate authorities and when a user sends you a certificate that claims to be issued by the Spanish government, you check the signature with the Spanish root certificate. No need to contact the Spanish government’s server about that specific certificate.

This is exactly how any certificate validation process works today. Otherwise, your web browser would have to talk to a bunch of certificate authorities every time you open an HTTPS connection to a website.

And as a follow up to my previous point, now that I’m at my PC and don’t have to type on my phone:

Even if we made certificates in a way that can’t be shared, for example by locking the private key inside a physical device (like a digital passport), we have solved nothing.

Your certificate would immediately become your digital fingerprint that will be stored with your account (to find duplicates) and can be tracked across websites as soon as a database gets leaked or the sites’ owners sell your data to advertisers (when would that ever happen?). While that fingerprint alone doesn’t say anything about you except your age, it makes it trivial to aggregate your activity across the whole internet. Ever bought something on a site that requires age verification? Congratulations, your certificate is now tied to an address. Shared a selfie somewhere? Your certificate has a face. Even without personal data directly in the certificate, it would be a privacy nightmare and exactly what the EU GDPR tried (and failed) to prevent.

The next step would be to find a mechanism that creates single use certificates every time you need one. But you can’t do that locally, because the certificates still need to be signed (and revocable) by a trusted authority. So maybe you need to send a certificate signing request to a government server every time you sign up for something. That could work for some use cases but requires expensive infrastructure that is never allowed to fail even for a few minutes or it would cause chaos.

… and now I’ve noticed your exact wording, implying that sites would forward the users’ certificates to the authority to be verified. That’s a big no-no. A site may never ever acknowledge to an authority that it has seen a specific certificate. The authority necessarily knows who the owner of that certificate is and even if they don’t tell the website, the authority itself can keep track of every citizen. “On date X, PornHub asked us to verify the age for certificate ABCDEF which we know belongs to John Doe from Somesmalltown” is not something I would want to be stored on a government server.

And this is all still assuming that the infrastructure for this would be implemented according to modern standards without security-critical shortcuts. If you have any hope that will ever happen, I recommend you click through https://media.ccc.de/ and watch some talks about government IT fails. Many are available in English.

Certificates that can’t be tied to a specific person can and will be shared, making them essentially worthless.

We‘ve had that in Germany about 20 years ago. Some websites asked you to verify your age by entering a part of the encoded data on the back of your ID card. It took maybe a few days until lists with valid IDs were all over the internet.

Sure, certificates are marginally more reliable because they can be revoked but at that point, websites need to update their revocation lists close to real time which isn’t practical and still can’t catch every shared cert.

Reliably verifying your identity without revealing too many personal details is an extremely hard problem that has troubled computer scientists for decades.

I have exactly one reason why I own an Xbox One S: Gamestop went out of business in Germany at the exact moment I made plans to buy a cheap 4k BluRay player for my bedroom TV and they sold me one (used) for 60€.

I have two. Both not the worst in terms of total delay but memorable for being horribly annoying.

1. ICE train from Dortmund to Karlsruhe (Germany) in December 2017. We’d had a couple of centimeters of snow the night before but nothing too drastic… until right after Frankfurt am Main. A railroad switch near Frankfurt am Main Stadion was frozen and could not be operated so we had to stop for over an hour at that tiny station. In the meantime, the beer in the onboard restaurant had run out and some already drunk passengers stole the conductor’s phone to blast the anime music over the train’s speakers and argued who would leave the train to buy more booze. Eventually we had to return to the previous station where dozens of additional passengers boarded. We were confused but got told that ours was the only train that would even attempt the rest of the trip. In the end, we arrived about three hours late.
2. A trip by regional train from Kassel to somewhere near Duisburg (Germany) in September 2021. Should have taken about four hours but due to an unexpected storm and a tree that damaged the overhead lines, the train had to stop in the middle of nowhere. It took 90 minutes just to figure out which taxi company would take us to the next station and a total of eight hours to get to our destination because it was so late at night that at some point no connecting trains were available.

I think it’s more of a general sentiment against Merz. He pushes for longer work days, fewer public holidays, later retirement, “incentives” for people to still work part-time during retirement, fewer protections for workers overall and worse social security. The guy is massively unpopular so nobody trusts that these statements come from any sensible reasoning.

Nobody cares what Friedrich “we need to treat workers like slaves” Merz thinks.

I think OP is not a native speaker. The (implicit) question is probably “Do you agree?”

And now you understand what we Germans feel when Americans ask what our ancestors did during the 1930s and 40s.

I finished high school in spring which was a true blessing. I had always been a good student (4th best in my year) but got bullied for being a nerd.

Over the summer, I worked as a programmer for a small game studio, making a Nintendo DS game that got cancelled by the publisher on the day we sent in the last release candidate because they finally noticed that their idea was crap and they should have accepted the changes we had proposed. Didn’t matter, I had already been paid and got a lot of experience out of it.

In October, I started university which was a great chance to make new friends. By now I’ve lost contact with most of them but some are still around and I appreciate them a lot. I was lucky enough to already live close to the university so I could stay at my parents’ house.

Through all of this, I was in the middle of my first serious relationship. My partner moved from across the country to a town just an hour away from me. Being able to see each other more often was amazing but at the same time it made things more complicated. We were constantly struggling with aligning our schedules, couldn’t agree at whose place we should meet and got annoyed when one wanted to meet friends on a day the other would be free. We broke up in 2009 but we’re still good friends.

It was pretty much the peak of a community that I’m still part of today. Apart from long online discussions, we met twice a year for community events with about 60-80 guests who decided that it’s our turn to define what being a grown-up means. These events still exist (the last one was just a few weeks ago) but they’ve gotten smaller and some of that chaotic creativity has been lost forever.

Overall, 2008 may have been the start of one of the best sections of my life. I’ve never had more active friendships at the same time, before or after. I had many of the perks of being an adult without most of the drawbacks. I earned a bit of money and could keep most of it because university is cheap in my country and I didn’t have to pay rent. If I had the chance (and could take a few people that I met later with me), I would probably go back.

He stopped them so early you haven’t even heard of them! /s

Yeah, I got that but I don’t think he would notice the difference. If they do anything, he’ll somehow twist it into an argument. Doesn’t have to make sense for anyone but him, he’ll use any excuse to play with his military toys.

I fear that the only option to prevent WW3 is to finally remove him and his friends from power. No, I don’t know how to actually do that.

The problem is, if China and Russia make a move, that only confirms Trump’s delusion that he must take Greenland before they do.

Did we ever get an explanation for that?

Lost? He haven’t had faith in the US for at least 25 years.

Maybe New Zealand? Far enough away from anything interesting and their main exports are dairy products. English as one of the official languages. Only time will tell which way the politics will go.

I tried to summarize it but couldn’t get it to a good length without losing too much detail. I would recommend this Wikipedia article (just run it through some translation tool; it’s way more detailed than the English article).

What they did was far beyond “agile”. They didn’t care for naming conventions, documentation, not committing commented-out code, using existing solutions (both in-house and third-party) instead of reinventing the wheel…

In that first review I had literally hundreds of comments that each on their own would be a reason to reject the pull request.

For any non-trivial software project, spending time on code quality and a good architecture is worth the effort. Every hour I spend on that saves me two hours when I have to fix bugs or implement new features.

Years ago I had to review code from a different team and it was an absolute mess. They (and our boss) defended it with “That way they can get it done faster. We can clean up after the initial release”. Guess what, that initial release took over three years instead of the planned six months.