Content Rating System in Debian

classic Classic list List threaded Threaded
27 messages Options
12
Reply | Threaded
Open this post in threaded view
|

Content Rating System in Debian

Bagas Sanjaya
Hello Debian Developers,

Debian provides more than 51000 packages. From those packages, some are appropriate for every ages, and some others are
only for specific age groups for some reasons.

In order to inform to users, especially parents, about potentially objectionable content in Debian packages, Content
Rating System (CRS) can be deployed to Debian. With CRS, users can choose to install packages that is rated for their
age. In some cases, CRS also filter or block certain contents in certain jurisdictions when legally required.

As in Google Play, Debian CRS is based on official ratings from International Age Rating Coalition (IARC).

Pros:
- Users, especially parents, can install packages suitable for their age. In case of parents, this apply to their
sons/daughters.
- For users in some jurisdiction, they can only install packages that is legal in their jurisdiction. For example, Debian
users in USA can only install US version of GnuPG, but in outside USA, users can install international version of GnuPG
instead.

Cons:
- Since there are more than 51000 packages currently in Debian, rating review for those existing packages and new
packages can take long time, depending on complexity of packages that are reviewed.
- Current Debian system need to be overhauled (for example, when creating users with adduser, sysadmins need to input
date of birth of their users) in order to make CRS work in Debian.
- Not all programs/packages is suitable for rating review, especially command-line programs.

If CRS will be implemented in Debian, I proposed following packaging workflow, based on Google Play:
- Maintainers that is about to package a program, will notify to the upstream whether he/she would take a rating
questionnaire or not. If he/she didn't take the questionnaire, the resulting package will be categorized as Unrated.
- The upstream fill rating questionnaire and send it to IARC.
- IARC calculates rating for upstream's program and send rating certificate back to upstream. If upstream don't agree
with rating assigned to the program, he/she can file appeal using link in the certificate email.
- Upstream contact maintainer about rating of the program that he/she get.
- Maintainer then do packaging as usual and add rating for the package, possibly to control file.

Based on above, what are your opinions/thoughts/positions about Content Rating System in Debian?

Regards, Bagas
Reply | Threaded
Open this post in threaded view
|

Re: Content Rating System in Debian

Russ Allbery-2
Bagas Sanjaya <[hidden email]> writes:

> Based on above, what are your opinions/thoughts/positions about Content
> Rating System in Debian?

It sounds like a whole ton of work to get a useful amount of coverage (not
to mention bothering upstreams with questionnaires that I suspect many of
them would find irritating -- I certainly would with my upstream hat on),
and I'm not clear on the benefit.  Do you have some reason to believe that
this is a common request by users of Debian?  If so, could you share with
us why you believe that?

Debian already has a couple of voluntary labeling mechanisms that, while
not precisely relevant to this, are at least adjacent: debtags for general
package tagging (see the junior tag root, for instance, and name-based
labeling of packages with potentially offensive content per

https://www.debian.org/doc/debian-policy/ch-binary.html#packages-with-potentially-offensive-content

Both of those are nowhere near as comprehensive as CRS, of course, but
it's not clear to me that something as comprehensive as CRS has enough
demand to be worth the effort, and there's obviously a maintenance burden
incurred by using it.

It's probably worth noting, though, that if any group felt strongly enough
about CRS to do the work, I don't see any obvious reason why debtags
couldn't handle a set of CRS tags, which has the huge advantage of not
requiring any work by the package maintainer and instead shifting the
burden to the people who care about CRS.

--
Russ Allbery ([hidden email])               <http://www.eyrie.org/~eagle/>

Reply | Threaded
Open this post in threaded view
|

Re: Re: Content Rating System in Debian

Bagas Sanjaya
Russ Allbery:
It sounds like a whole ton of work to get a useful amount of coverage (not
to mention bothering upstreams with questionnaires that I suspect many of
them would find irritating -- I certainly would with my upstream hat on),
and I'm not clear on the benefit.  Do you have some reason to believe that
this is a common request by users of Debian?  If so, could you share with
us why you believe that?
I'm discussing about CRS inspired from Google Play. A case study of implementing CRS is when parents which have Debian system installed on their computer wants to make sure that any programs installed there are appropriate for all family users there. Also we have "Self-Censoring" campaign which encouraging users to filter contents suitable for their age. "Self-Censoring" originates from TV programs, but it can also be applied to computer programs and applications (especially games) as well. Regardless, CRS is good not only to Debian, but also to end-user in longterm, although it is hard to implement and have some maintenance burden.
Reply | Threaded
Open this post in threaded view
|

Re: Re: Content Rating System in Debian

Philip Hands
Bagas Sanjaya <[hidden email]> writes:

> Russ Allbery:
>> It sounds like a whole ton of work to get a useful amount of coverage (not
>> to mention bothering upstreams with questionnaires that I suspect many of
>> them would find irritating -- I certainly would with my upstream hat on),
>> and I'm not clear on the benefit.  Do you have some reason to believe that
>> this is a common request by users of Debian?  If so, could you share with
>> us why you believe that?
> I'm discussing about CRS inspired from Google Play.

Do Google Play not pay IARC for this?

I would assume that there is a fee that covers IARC's costs in running
the service, which is then paid out of the profit that Google makes on
the games.

What is it going to cost us to get 'bison' rated PG?  Why is this useful?

Also, it seems clear to me that the same game in all Linux disros is
very likely to get the same rating, so this would be better done as a
distribution agnostic level, preferably by someone that makes a profit
from games or content anyway.

For instance, I'd imagine that Steam have some sort of rating mechanism,
which might even use IARC already, so one might be able to achieve this
aim by talking to them about getting access to their system somehow, and
perhaps getting them to include things in their database that they don't
actually distribute themselves.

One might imagine that one could buy a subscription to their rating
database, say.  Alternatively, parents who are interested might simply
decide to subscribe to Steam if Steam provided a package that allowed
subscribers to see the ratings for packages they were about to install.

(I'm only saying Steam here because they've been quite Debian friendly
AFAIK, but there's nothing stopping anyone else offering such ratings as
a service to Debian users).

Asking Debian to do it seems like it's just asking for trouble -- what
happens when a child is traumatised by content that most people find
completely innocuous in a package we've not yet got round to rating?

Cheers, Phil.
--
|)|  Philip Hands  [+44 (0)20 8530 9560]  HANDS.COM Ltd.
|-|  http://www.hands.com/    http://ftp.uk.debian.org/
|(|  Hugo-Klemm-Strasse 34,   21075 Hamburg,    GERMANY

signature.asc (847 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Re: Content Rating System in Debian

Philip Hands
Philip Hands <[hidden email]> writes:

> What is it going to cost us to get 'bison' rated PG?  Why is this
> useful?

Erm, not 'PG' -- I meant whatever the "Anyone can watch this" label is.

Although, I guess one could perhaps argue PG for bison:

  One could use it to build something that generates offensive content,
  and perhaps the joys of compiler writing should be saved for an
  appropriate age ;-)

Cheers, Phil.
--
|)|  Philip Hands  [+44 (0)20 8530 9560]  HANDS.COM Ltd.
|-|  http://www.hands.com/    http://ftp.uk.debian.org/
|(|  Hugo-Klemm-Strasse 34,   21075 Hamburg,    GERMANY

signature.asc (847 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Content Rating System in Debian

Philipp Kern-6
In reply to this post by Philip Hands
On 2019-06-25 09:31, Philip Hands wrote:

>> Russ Allbery:
>>> It sounds like a whole ton of work to get a useful amount of coverage
>>> (not
>>> to mention bothering upstreams with questionnaires that I suspect
>>> many of
>>> them would find irritating -- I certainly would with my upstream hat
>>> on),
>>> and I'm not clear on the benefit.  Do you have some reason to believe
>>> that
>>> this is a common request by users of Debian?  If so, could you share
>>> with
>>> us why you believe that?
>> I'm discussing about CRS inspired from Google Play.
> Do Google Play not pay IARC for this?

App developers are generally forced to self-rate their apps, otherwise
they disappear from the store.

Kind regards
Philipp Kern

Reply | Threaded
Open this post in threaded view
|

Re: Content Rating System in Debian

Bagas Sanjaya
In reply to this post by Philip Hands
On 25/06/19 14.31, Philip Hands wrote:
Bagas Sanjaya [hidden email] writes:

Russ Allbery:
It sounds like a whole ton of work to get a useful amount of coverage (not
to mention bothering upstreams with questionnaires that I suspect many of
them would find irritating -- I certainly would with my upstream hat on),
and I'm not clear on the benefit.  Do you have some reason to believe that
this is a common request by users of Debian?  If so, could you share with
us why you believe that?
I'm discussing about CRS inspired from Google Play.
Do Google Play not pay IARC for this?

I would assume that there is a fee that covers IARC's costs in running
the service, which is then paid out of the profit that Google makes on
the games.

What is it going to cost us to get 'bison' rated PG?  Why is this useful?

Also, it seems clear to me that the same game in all Linux disros is
very likely to get the same rating, so this would be better done as a
distribution agnostic level, preferably by someone that makes a profit
from games or content anyway.

For instance, I'd imagine that Steam have some sort of rating mechanism,
which might even use IARC already, so one might be able to achieve this
aim by talking to them about getting access to their system somehow, and
perhaps getting them to include things in their database that they don't
actually distribute themselves.

One might imagine that one could buy a subscription to their rating
database, say.  Alternatively, parents who are interested might simply
decide to subscribe to Steam if Steam provided a package that allowed
subscribers to see the ratings for packages they were about to install.

(I'm only saying Steam here because they've been quite Debian friendly
AFAIK, but there's nothing stopping anyone else offering such ratings as
a service to Debian users).

Asking Debian to do it seems like it's just asking for trouble -- what
happens when a child is traumatised by content that most people find
completely innocuous in a package we've not yet got round to rating?

Cheers, Phil.
I don't know whether Google Play and Steam pay IARC or not, but if they do, the fee would be so expensive that Debian
can't afford (unless we're RedHat or similar). Also, to implement CRS, major overhaul to packaging system (apt/dpkg) 
and user accounts need to be done in order to accommodate CRS. But CRS can give users insight about maturity of
packages. So if sysadmins (parents in home networks) is about to install Apache HTTPD or other packages, they need to
answer whether the packages are appropriate for their users' age or not. In multi-user setups (such as in servers)
CRS can be a problem, because although majority of users are adults (18+), there are possibilities that children (7+)
or teens (12+) also use such packages. Some packages might recommend Parental Guidance (PG) but it is not possible in
server setups.

I'm agree that CRS should be done on distribution-independent manner. This means that upstream file rating request to
IARC in order to get their programs rated. Distributions (Debian/Ubuntu, RedHat, etc.) then package programs which have
been rated. In Google Play, rating process is slightly different: upstream upload their applications/games to Google
Play, then they fill rating questionnaire provide by Google Play and send it to IARC.

Regardless, for CRS, we need a CRS system that is cross-distribution that can be implemented to package managers and
user administration tools on most distributions.

Erm, not 'PG' -- I meant whatever the "Anyone can watch this" label is.
In IARC classification, that is 3+ (for anyone as long as they are not toddlers).
Reply | Threaded
Open this post in threaded view
|

Re: Re: Content Rating System in Debian

Simon McVittie-7
In reply to this post by Philip Hands
On Tue, 25 Jun 2019 at 09:31:44 +0200, Philip Hands wrote:
> Also, it seems clear to me that the same game in all Linux disros is
> very likely to get the same rating, so this would be better done as a
> distribution agnostic level

Appstream metadata, which is canonically provided by upstreams and is
distro- and package-type-agnostic (available in at least apt and Flatpak),
has this as an optional field for self-rating:

https://www.freedesktop.org/software/appstream/docs/chap-Metadata.html#tag-content_rating
https://hughsie.github.io/oars/

I suspect that's the only way this could possibly work without money
changing hands.

    smcv

Reply | Threaded
Open this post in threaded view
|

Re: Content Rating System in Debian

Philip Hands
In reply to this post by Philipp Kern-6
Philipp Kern <[hidden email]> writes:

> On 2019-06-25 09:31, Philip Hands wrote:
>>> Russ Allbery:
>>>> It sounds like a whole ton of work to get a useful amount of coverage
>>>> (not
>>>> to mention bothering upstreams with questionnaires that I suspect
>>>> many of
>>>> them would find irritating -- I certainly would with my upstream hat
>>>> on),
>>>> and I'm not clear on the benefit.  Do you have some reason to believe
>>>> that
>>>> this is a common request by users of Debian?  If so, could you share
>>>> with
>>>> us why you believe that?
>>> I'm discussing about CRS inspired from Google Play.
>> Do Google Play not pay IARC for this?
>
> App developers are generally forced to self-rate their apps, otherwise
> they disappear from the store.
Right, but is that not done by filling out a questionnaire that is
somehow administered/rated by IARC, which presumably means that they
need to be paid for providing that somewhere along the line (or is it
all government funded?).

Also, IARC claim to keep ratings under review, which presumably also
needs to be paid for somehow.

I was guessing that they collect subscriptions from the platforms to
cover the costs.

Cheers, Phil.
--
|)|  Philip Hands  [+44 (0)20 8530 9560]  HANDS.COM Ltd.
|-|  http://www.hands.com/    http://ftp.uk.debian.org/
|(|  Hugo-Klemm-Strasse 34,   21075 Hamburg,    GERMANY

signature.asc (847 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Re: Content Rating System in Debian

Matthias Klumpp
In reply to this post by Simon McVittie-7
Am Di., 25. Juni 2019 um 10:15 Uhr schrieb Simon McVittie <[hidden email]>:

>
> On Tue, 25 Jun 2019 at 09:31:44 +0200, Philip Hands wrote:
> > Also, it seems clear to me that the same game in all Linux disros is
> > very likely to get the same rating, so this would be better done as a
> > distribution agnostic level
>
> Appstream metadata, which is canonically provided by upstreams and is
> distro- and package-type-agnostic (available in at least apt and Flatpak),
> has this as an optional field for self-rating:
>
> https://www.freedesktop.org/software/appstream/docs/chap-Metadata.html#tag-content_rating
> https://hughsie.github.io/oars/
>
> I suspect that's the only way this could possibly work without money
> changing hands.

Indeed :-) Also, metainfo files can be written for every software
component, not only for apps (although I thing GUI applications are
the things age-rating is most relevant for).
If any features in this are missing, let me or Richard Hughes know.

Cheers,
    Matthias

--
I welcome VSRE emails. See http://vsre.info/

Reply | Threaded
Open this post in threaded view
|

Re: Re: Re: Content Rating System in Debian

Bagas Sanjaya
In reply to this post by Simon McVittie-7
Simon McVittie:
Appstream metadata, which is canonically provided by upstreams and is
distro- and package-type-agnostic (available in at least apt and Flatpak),
has this as an optional field for self-rating:

https://www.freedesktop.org/software/appstream/docs/chap-Metadata.html#tag-content_rating
https://hughsie.github.io/oars/

I suspect that's the only way this could possibly work without money
changing hands.
There are no age classifications, however. So based on content_rating tag on AppStream metadata, we can add logic to apt in order to determine age rating for our packages. However, external review (maintainers) may be need in order to prevent misleading information on content_rating.
Reply | Threaded
Open this post in threaded view
|

Re: Content Rating System in Debian

Simon McVittie-7
On Tue, 25 Jun 2019 at 16:33:53 +0700, Bagas Sanjaya wrote:
> There are no age classifications, however. So based on content_rating tag on
> AppStream metadata, we can add logic to apt in order to determine age rating
> for our packages.

I think this would be unwise. We can never get this right, because the
descriptors that are considered suitable for a particular age vary widely
between cultures and countries. The most likely outcome would be angry bug
reports from parents who felt that the given age rating was inappropriate.

Something like OARS is already somewhat subjective (how much violence can
a game have and still be considered "moderate"?) but it's a lot closer to
being objective than an age rating.

    smcv

Reply | Threaded
Open this post in threaded view
|

Re: Content Rating System in Debian

Paride Legovini-2
In reply to this post by Bagas Sanjaya
Bagas Sanjaya wrote on 25/06/2019:

> Hello Debian Developers,
>
> Debian provides more than 51000 packages. From those packages, some are appropriate for every ages, and some others are
> only for specific age groups for some reasons.
>
> In order to inform to users, especially parents, about potentially objectionable content in Debian packages, Content
> Rating System (CRS) can be deployed to Debian. With CRS, users can choose to install packages that is rated for their
> age. In some cases, CRS also filter or block certain contents in certain jurisdictions when legally required.
>
> As in Google Play, Debian CRS is based on official ratings from International Age Rating Coalition (IARC).

The rating system in Google Play makes some sense (at least on paper)
because you can leave a phone to a kid, configured with their Google
account, and Google will allow to install only apps deemed appropriate
for the account holder's age.

There is no such a thing in Debian. There isn't a Debian account which
is able to give you partial access to the repositories. If you are root
you can install everything; if you aren't you can't install anything.
And when installing a package for a kid then checking its description is
probably better than any rating system.

We can't achieve the same result as Google, which in my opinion wouldn't
be useful anyway; see below.

> Pros:
> - Users, especially parents, can install packages suitable for their age. In case of parents, this apply to their
> sons/daughters.

I don't think there is a meaningful "Pro" here. The first and in most
cases only packages that would make sense to control are web browsers.
Nowadays not installing a web browser makes a computer almost useless
for almost any purpose a kid or teenager may want it for. At this point
it's just better to install a browser and leave the machine offline. At
least they'll have access to offline documentation! Or to a local
Wikipedia mirror.

> - For users in some jurisdiction, they can only install packages that is legal in their jurisdiction. For example, Debian
> users in USA can only install US version of GnuPG, but in outside USA, users can install international version of GnuPG
> instead.

Didn't this stop to be a thing in the late nineties?
The issue wouldn't be age-related anyway.

> Based on above, what are your opinions/thoughts/positions about Content Rating System in Debian?

My question is: are we trying to solve an actual problem here?

Are there packages that you would consider not suitable for young users,
and whose impact wouldn't be greatly inferior to the one of web browsers
(which, in my reasoning, are going to be installed anyway)? I hope the
answer is not fortunes-off here :-)

While this email is mostly a "thumbs down", I agree with Russ Allbery:
if a group feels strongly enough about CRS to do the work, I think it
will fit well in the debtags labeling system.

Paride

Reply | Threaded
Open this post in threaded view
|

Re: Content Rating System in Debian

Andrey Rahmatullin-3
On Tue, Jun 25, 2019 at 12:43:56PM +0200, Paride Legovini wrote:
> My question is: are we trying to solve an actual problem here?
No, and please note that the author is not even a Debian user:
https://lists.debian.org/debian-devel/2019/06/msg00376.html

--
WBR, wRAR

signature.asc (911 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Content Rating System in Debian

Holger Levsen-2
In reply to this post by Bagas Sanjaya
On Tue, Jun 25, 2019 at 11:40:04AM +0700, Bagas Sanjaya wrote:
> Based on above, what are your opinions/thoughts/positions about Content Rating System in Debian?

just NO. please create a fork and leave Debian without this.


--
tschau,
        Holger

-------------------------------------------------------------------------------
               holger@(debian|reproducible-builds|layer-acht).org
       PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C

signature.asc (849 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Content Rating System in Debian

Ansgar Burchardt-5
In reply to this post by Bagas Sanjaya
Hi,

On Tue, 2019-06-25 at 11:40 +0700, Bagas Sanjaya wrote:
> Based on above, what are your opinions/thoughts/positions about
> Content Rating System in Debian?

is this related to your other proposal involving giving "sudo"
permissions to teenagers to handle this age recommendation stuff for TV
programs?

| In fact, many television stations have most programs written for
| teens (age 13 and older), so sysadmins there configure sudoers which
| allows teens to behave like sysadmins themselves (by giving them full
| administrator privileges) on their production systems. Also, parental
| monitoring and guidance can reduce likehood of teens breaking such
| systems. Maybe because teens are largest marketshare for TVs.

Ansgar
 - rating "kill -KILL" X-rated for extreme violence

Reply | Threaded
Open this post in threaded view
|

Re: Re: Re: Content Rating System in Debian

Matthias Klumpp
In reply to this post by Bagas Sanjaya
Am Di., 25. Juni 2019 um 11:51 Uhr schrieb Bagas Sanjaya <[hidden email]>:

>
> Simon McVittie:
>
> Appstream metadata, which is canonically provided by upstreams and is
> distro- and package-type-agnostic (available in at least apt and Flatpak),
> has this as an optional field for self-rating:
>
> https://www.freedesktop.org/software/appstream/docs/chap-Metadata.html#tag-content_rating
> https://hughsie.github.io/oars/
>
> I suspect that's the only way this could possibly work without money
> changing hands.
>
> There are no age classifications, however.
>
> So based on content_rating tag on AppStream metadata, we can add logic to apt in order to determine age rating for our
> packages. However, external review (maintainers) may be need in order to prevent misleading information on
> content_rating.

To clarify: Age ratings vary wildly between countries. So what we
expect is that software centers will not actually display
content_rating information, but instead compile an age rating out of
it based on the user's current location/locale and then display that.
Having a "one-size fits all" generic rating isn't very practical.

Cheers,
    Matthias

--
I welcome VSRE emails. See http://vsre.info/

Reply | Threaded
Open this post in threaded view
|

Re: Content Rating System in Debian

Emmanuel Arias
In reply to this post by Holger Levsen-2


On 6/25/19 8:27 AM, Holger Levsen wrote:
On Tue, Jun 25, 2019 at 11:40:04AM +0700, Bagas Sanjaya wrote:
Based on above, what are your opinions/thoughts/positions about Content Rating System in Debian?
just NO. please create a fork and leave Debian without this.
Hard but necessary response :-)

IMO this idea represent a big work. And if you want to involved upstream,
maybe will be a problem. Some upstream, could not be interest on participate because
could be a "extra" work. But if we implement a content rating system, the freedom could
be affected because the opinion on a package may be affected by this new system.
-- 
Emmanuel Arias
@eamanu
https://eamanu.com

signature.asc (849 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Re: Content Rating System in Debian

Bagas Sanjaya
Emmanuel Arias:
IMO this idea represent a big work. And if you want to involved upstream, maybe will be a problem. Some upstream, could not be interest on participate because could be a "extra" work. But if we implement a content rating system, the freedom could be affected because the opinion on a package may be affected by this new system.
Regarding freedom, yes it can be affected by CRS because CRS can limit freedom to use programs for some users (particularly non-adults). But CRS limit such freedom in order to protect psychology users for long term from negative impacts of programs they used.
Reply | Threaded
Open this post in threaded view
|

Re: Content Rating System in Debian

Gard Spreemann-2

Bagas Sanjaya <[hidden email]> writes:

> Regarding freedom, yes it can be affected by CRS because CRS can limit freedom to use programs for some users
> (particularly non-adults). But CRS limit such freedom in order to protect psychology users for long term from negative
> impacts of programs they used.

Surely this would be a direct conflict with the DFSG?


 Best,
 Gard

12