A Counter-Threat Intelligence lead for a major firm, who runs a team penetrating hacker networks to uncover new threats and comments about their company, and this is their reply to this thread. (posted with permission)

The mythology around hackers is wildly oversold. But defense requires doing it.

"Child protection" is one of the two main means by which states attempt to manufacture a convincing enough "compelling state interest" for a law to survive strict scrutiny (the other is "preventing terrorism".)

Thus we score with the worst possible case in mind, a security feature bypass which changes scope.

Is that likely? No, probably not unless your application code is doing something odd and skips a bunch of checks that it ought to be making on every request.

But please go update.

(4/7)

Är det inte sent att göra en sådan översyn efter att lagarna är på plats?

Borde inte det arbetet vara del i det underlag som tas fram innan man tar beslut?

Har för mig att visst förberedande arbete gjordes inför första vändan? Med resultat att flera remissinstanser var negativa?

Tack för anekdoterna, det fick bli (impromptu) grillad lövbiff.