They're brokering the negotiation, they're not actually the identity provider. The broker has no knowledge of your actual identity. So in this case, the identity provider (such as your bank) knows that you've been referred by the broker and that you wish to provide your verified age and only that age. The social media company knows that you've chosen to use the specific broker to verify your age, but not who the actual identity provider is. The broker knows that a request with your metadata (IP addr, HTTP headers, etc.) has been initiated between a specific social media site and a specific identity provider, but they don't have access to your actual identity.
Nobody in the negotiation has a complete picture. To correlate it all together, you would need logs from all 3. And at least in the Australian case, due to our data retention laws, if you've got logs from the social media provider, then you can already associate the user with a specific identity by requesting the information from the ISP which they legally must retain for 2 years, so it's really not necessary.
All this concern about social media privacy is a little ridiculous IMO. If you're using social media then you've already compromised your identity. If somebody wants to find out who you are, they already can. They don't need a verified identity, and social media companies seem to me more than willing to cooperate with governments. Law enforcement has been using this type of correlating data for years to establish identity in CSAM investigations.
In Australia, the government has certified OAuth2 Identity Providers which act as a broker between social media sites and a provider that can verify your age, such as a bank. This allows age to be verified by a provider, with the social media provider having no access to your identity. If the social media companies chose to support this, they would be complying with the legislation. It's not the government forcing you to identify yourself.
It'd be fine if they were just using chat apps. It's not the communication that's the problem, or the bullying. That's going to happen regardless, and it's nothing new to online spaces. If anything, having online spaces available is helpful, because kids who are excluded at school are able to find places they fit in online. It's the algorithmic feeds and short-form video content. It's flooding their brains in their most formative time.
> What I don't understand is why parents don't take responsibility for reducing the contact with such harmful products.
It's critical mass. I didn't want my 13-year-old daughter on social media, because even 7 years ago we knew the harms. We were firm, and we kept her off it. The problem was that we were attempting to help her with her mental health, but when you're literally the only kid who didn't read the group chat from your friend group the night before, that does remarkable damage to your mental health. It cuts off an enormous part of their social life.
If the majority of kids weren't using it then it'd be easy, but because it's their primary form of communication, it's incredibly difficult.
If you draw a firm boundary with that contributor, and they continue to push, ban them.
"This doesn't meet the standards of our project for reason xyz. Please refrain from submitting further PRs that do not adhere to our contribution guidelines outlined in CONTRIBUTING.md."
I find the current recommendations from spotify or youtube music don't actually help me find new music very well. They just end up shoehorning me, instead of widening my options.
My (extensive) experience with LLM code generation is that it has the same issues you describe in your field. Hallucinations, over-engineering, misses important requirements/patterns.
But engineers have these same problems. The key is that the content creator (engineers for codegen, doctors for medicine) is still responsible for the output of the AI, as if they wrote it themselves. If they make a mistake with an AI (eg, include false data - hallucinations), they should be held accountable in the same way they would if they made a mistake without it.
You should always have an architecture in mind. But it should be appropriate for the scale and complexity of your application _right now_, as opposed to what you imagine it will be in five years. Let it evolve, but always have it.
They're brokering the negotiation, they're not actually the identity provider. The broker has no knowledge of your actual identity. So in this case, the identity provider (such as your bank) knows that you've been referred by the broker and that you wish to provide your verified age and only that age. The social media company knows that you've chosen to use the specific broker to verify your age, but not who the actual identity provider is. The broker knows that a request with your metadata (IP addr, HTTP headers, etc.) has been initiated between a specific social media site and a specific identity provider, but they don't have access to your actual identity.
Nobody in the negotiation has a complete picture. To correlate it all together, you would need logs from all 3. And at least in the Australian case, due to our data retention laws, if you've got logs from the social media provider, then you can already associate the user with a specific identity by requesting the information from the ISP which they legally must retain for 2 years, so it's really not necessary.
All this concern about social media privacy is a little ridiculous IMO. If you're using social media then you've already compromised your identity. If somebody wants to find out who you are, they already can. They don't need a verified identity, and social media companies seem to me more than willing to cooperate with governments. Law enforcement has been using this type of correlating data for years to establish identity in CSAM investigations.