523
275

Systemd preparing to comply with age verification laws

3mon 1d ago by lemmy.dbzer0.com/u/skyline2 in linux@lemmy.ml from github.com

Fork time? Maybe all the anti-systemd zealots were right all along...

Edit: To address whether it is likely that this change will affect users: Gnome is planning a stronger dependence on userdb, the part of systemd where this change is being implemented. https://blogs.gnome.org/adrianvovk/2025/06/10/gnome-systemd-dependencies/

Final Edit: The PR has been merged into main.

Unless it is fought, this corporate-driven rot will burrow all the way down to the sub-processor TEE/TPM and all the way up to the web browser/app.

🤷

In a few years, we may be smuggling in contraband Chinese RISC-V computers.

Huh, we really do live in a cyberpunk novel...

Only to be backdoored by the Red instead of the Orange.

Someone call Dr. Strange, he fucked up this timeline real bad.

The fact that this shit sound like a dystopian future trope...

Email your legislators telling them that parents already have access to network block tools, these laws won’t stop the problem anyway (run through a vpn), they’re a free speech nightmare, they’re collecting more data on American citizens when America has data breaches losing data every few days, and Congress literally studied this twenty years ago and decided it wasn’t a good idea then, what makes it a good idea now?

uh...$? same reason the majority of US politicians vote anyway on anything put in front of them.

the only thing sacred in the USA is $

Largely true, though I think $ is a secondary consideration to some of the genocidal eugenicists, fundamentalists, supremacists, jingoist hegemons, etc.

I'll never buy a computer that can't be run without this shit. If that means I run what I have until it breaks and then never have a PC again then that's what I'll do

The last computer I bought (a couple of years back) was a decade old PC, the price was €10 or so. I needed to add RAM, SSD, and used it for a couple of years as a Fedora Workstation desktop. It was plenty powerful for most of my needs. I’m not too worried about it. I think I can survive on a machine like that.

You won't be able to afford RAM and SSD though.

What if users are redefined as context? Now the is does not have users anymore. That's not a 'root' user, it's a 'root' context. And that's non root context with supercontext privileges

By implementing it all in the most brain dead, user space writable fashion

The least effective way is whining on a Lemmy community about open source projects.
Go talk to your lawmakers, not the people complying with the law.

In my opinion, storing a date is pretty much irrelevant unless there's a process that validates the supplied date, otherwise every Linux user was born on 1/1/1, if not, an administrator can "fix" that

Furthermore, that systemd thinks that it's the place to store such information is in my opinion beyond absurd.

Who appointed that project the source of age truth in the Linux ecosystem? What discussion was there, who was consulted and where was the vote?

Exactly. This is a massive overreach, and it is crazy that Poettering is even considering merging this.

I would say the majority of objections to systemd pertain to perceived overreaches of the project (perceptions I generally share). So in that sense, it is kind of on brand.

it is crazy that Poettering is even considering merging this

You've, uh, seen systemd, right? Cmon; this is just one more section for the cancer to eat.

He thinks that systemd is desktop linux.

You're right that asking a user for a date is next to useless. However, that isn't a reason to not fight this stuff. Asking the user for the date is step one to getting people accept it. After that they'll point out that people were lying, and they'll need our government ID to verify (and link us to activity). It's all a step towards a surveillance network tracking every move you make on your computer.

I understand your point and agree that this is the thin end of the wedge.

What we're doing here is discussing the phenomenon and I'm highlighting some concerns.

I believe that this is how you get a dialogue happening which will effect change, which is what we're both advocating.

I think that age verification is about surveillance rather than protecting children and I think it should be fought at every level.

This is me contributing to that fight.

1/1/1

every linux user is jesus confirmed

Everyone knows Jesus was born one 0001-12-25

Is he dumb? It’s been almost 12 months since A. D. started. What was he waiting for

Come on, you know it's going to be 1/1/1970 most of the time.

They haven't fessed up yet that that's part of their plan. I expect to hear from them after they've passed the first half.

I was ambivalent about systemd up until now. If this gets merged I'm moving to a non-systemd distro. I do not live in California or even the USA. I do not want age verification garbage in my OS.

Iv not given a shit one way or another as well. But as a Californian I refuse to have this shit on my PC damn be what the law says.

Consider PCLinuxOS: they're an RPM-based mandriva (mandrake/conectiva) derivative with really great and wide compatibility in stacks without the 'modules' shitfest RH started after no one remembered what 'alternatives' was for.

They don't use systemd, but their installation is a bit shite as it's a "live CD" installer -- they pruned out the proper templatey install that mandriva has. But so far that's the biggest issue. If they can get off networkManager we'll be even better off, though.

There's also Linux MX, Debian based, on their latest release they added systemd as an option, but you can choose sysv at first boot if you want, and that's what will be installed and used.

There's also kaOS

Good news: this is not age verification. This is an optional DoB field on a user profile.

It's being added as a response to the age verification laws with the intended purpose to provide the age signal.

It's age verification/attestation.

No. It's a date of birth. You're right that age verification comes next, but this is not it. Had this field been present before, none of this would matter.

Contact your representative, not your local FOSS maintainer.

Contact your representative, not your local FOSS maintainer.

They're not a US citizen.

They also didn't say they would contact the maintainers. They said they'd just change distro to a non-systemd one.

And you're nothing but silly trying to act like this isn't about age "verification". We know it is, because it comes in response to the new california law

If you're (or they) not a US citizen (or Brazilian) why would you care if they comply with local laws?

They stated that reason very clearly in their original comment. I suggest you read it if you want to know why.

Yes I can read.

Contact your representative

Right, so that they can ask if I'm stoned or stupid for asking them to affect laws in another country?

Then this doesn't impact you in any form. (Especially since it's just a DoB).
You can continue to whine but frankly I don't see the point then.

Of course it does. This particular change may seem innocuous in itself, but the idea of compliance with ridiculous laws like this one, in one jurisdiction, being implemented in a project used globally will result in compromising everyone's privacy/security, regardless of whether they are even subject to that law or not.

If anything, it's more troubling for those outside the relevant jurisdiction, since we get 0 say on the laws, and have no actual reason to comply.

Something feels fishy... The user who made this pull request has more than doubled his contributions to various repositories since January (from 20–400 to more than 1100), and this is his first pull request in the systemd repo.

They bought a second computer so they can ask Claude for twice as much code.

Very fishy...

Fishy behaviour

That guy is either a massive bootlicker or a fucking plant. Who goes around vulentarily adding birth date fields to EVERY project they can contribute to?

Fishy how? As in a state-level backdooring like was the case with XZ and Jia Tan or are you weary of something else?

That memory surely also prompted this feeling. It's just that Meta seems to be putting a lot of effort everywhere to push for this. Not so difficult to put, or corrupt, or push, people in dev communities and repos.

This is a big weakness in FOSS communities, hell, in capitalist existence. People with resources can afford to spend their own time or hire someone else to focus on their contributions like a full time job while most honest contributers will be doing it during their free time because they need to pay bills and such.

You mean they're complying with Meta's age verification at OS level lobbying?

https://github.com/upper-up/meta-lobbying-and-other-findings

i think it's really wholesome that a lot of 126 year old people use linux

While I think it's amazing that not only are 95% of Linux users 56 years of age, but they even share the same birth date!

Yes, the Unix epoch is the obvious choice of birth date here

We should all agree on a common birthday, until operating systems enforce ID upload

you missed the joke I think: Thu Jan 01 1970 00:00:01 GMT+0000,

UNIX timestamp https://en.wikipedia.org/wiki/Unix_time

All those leap seconds...

Rick Astley's birthday is 6th Feb 1966, just saying

76 years old from day law is passed to honor System76 for having some nuts and being proactive.

We graybeards tried to warn you about systemd but you acted as fools.

Guilty as charged xD

I know the debate around systemd is going on for quite some time, I understood the basic reasoning behind it but I don't have the technical knowledge required to truly decide for myself, so I just didn't pay too much attention to it and followed what my distro of choice does.

The good thing about this "new development" is that it's not just a tech debate anymore, it has such wider implications that it'll be much easier for people to decide where to be.

A large part of the disagreement was never a tech debate. Systemd on a purely technical level had advantages, but the arguments were always about a concentration of functionality into a single critical program. Great while things are going well. Hell when it falls apart. That fear wasn't totally based in technical reasoning.

There is indeed a philosophical part to it around the "do one thing and do it well", but what you call "fear" is not an totally unfounded concern, in that it's true that the more complex a piece of software is, the more complex maintenance also is.

But you need serious technical knowledge to fully understand everything that systemd does compared to sysvinit, what are the advantages of this new system and how much its complexity can actually affect maintenance (or not).

I don't have that kind of knowledge, you could explain to me all the technical advantages systemd has but I wouldn't be able to understand them, so I just trust distro maintainers in doing what they believe it's best for their distro and I never considered the init system as a parameter to choose what distro I want to use, I just use what's in the distro.

Now it's different, because adding a field to comply with a moronic law pushed by Meta to avoid fines has truly nothing to do with technical reasoning, you don't need any tech knowledge to understand that, anyone can.

i'm going to start dyeing mine so that people won't just keep ignoring me like some old man yelling at the neighborhood kids to get off his lawn. lol

Ofcourse the project run by a microslop employee wants to force this on almost every distro as soon as possible.

same thing with manifest v3, just some mega corp goon doing the work no one's asked for

Poettering is not with Microsoft anymore, though

Just 2 steps.

Yes Poettering isn't at Microsoft but seems the person driving the project at the moment is.

Ah, nice catch

echo "18+" > ~/.age_rc

Am I compliant with California's law now? Apps can use the POSIX API to access my age.

Yes, and you can do the same thing to your child's non-root account. The point of the California law is to allow admins (parents) to do that.

As a teenager I was the only person in the house who understands computers. Naturally I was the admin. All this computer “jailing” is so insane to me.

Yes and that's fine and everyone freaking out is being dumb.

There are fascist governments demanding genital inspection for playing highschool sports and they're losing their shit over an accounts API returning an unverified age bracket!

There are fascist governments demanding genital inspection for playing highschool sports

  • That is already going on in the very same country we’re discussing.
  • “Things could be even worse, so until things are just as bad as that, don’t complain or try to stop it from getting worse.”

If you yell that the everything is on fire, over an API that doesn't do verification, it's less effective when you yell the same thing over real issues.

That’s a poor analogy, because nobody is lying, saying things are on fire that aren’t.

We weren’t born yesterday—or at least I wasn’t. We know where this is going, and it’s folly to wait until almost the end before pushing back.

Ah, but how will we know you weren't born yesterday?

Oh wait, I have an idea...

Push back to your lawmakers not the fucking open source projects that comply with the law.

You are really the dumb one for not learning from the past and for not seeing where is this headed once it's kicked into motion.

I never cared about the systemd debacle, now I do. I don't want that shit on my PC.

So, declare your system users' birthdate as Thu Jan 01 1970 00:00:01 GMT+0000 and get on with life.

Luckily for me, that's not the only option, especially since I'm not US.

You did care, or else you wouldn't be having this meltdown.

What part of "now I do" you didn't understand?

You must be the most dramatic person in the universe, calling that a "meltdown".

I am !

The answer to the PII issues is hence not restrictions in userdb, the answer is proper app sandboxing. And that even already exists in flatpak! It restricts access to $HOME already, and to userdb too! And that's the way to do it!

I don't use flatpak. I don't like it. Linux is about choice and I choose not to use that.

Hence, just embrace app sandboxing! And if you come to me and say "hey, I run all my apps without sandboxing, but i want the birthday hidden anyway" then I can only say, your model is really really broken. Fix your security model first, then come back.

In the words of the great Linus Torvalds, go fuck yourself.

Wow that's an insane level of bootlicking, it was completely free for them to do absolutely nothing about this nonsense law and give the middle finger if asked by the US

I didn't care before but it turns out the systemd haters were on to something for a long time, fuck these owners for even considering this and even locking the PR to avoid valid criticism, I hope all the contributors create a fork, jump ship and never let the previous owners commit a single line of code to it

It adds an optional birthdate field to userdb. The desktop does not have to populate it. I'm honestly surprised this wasn't already a field in UserDB

Why do the rest of us have to have this shit added in our systems just because some Yankees (and Brazil) passed some bills? My country has already said they won't be doing any age verification shit. I'm starting to think there's some big conspiracy here that FOSS isn't as independent as we believe it is.

FOSS isn’t as independent as we believe it is

Some parts are indeed sponsored by corporations, that's not a bad thing per se because financial support is important.

Problems arise when corporations push changes solely for their own interest instead of the benefit of the community, this PR seems to be that case.

Germany has effectivly the same law, active since december 2025, and I am sure more countries will intruduce such laws soon. Linux Distributions have to be compliant with this laws, if we like it or not.

Germany has effectivly the same law

I haven't heard anything about that and a search doesn't turn anything up either. Can you give any details on what you mean specifically?

§12 Jugendmedienschutzstaatsvertrag: https://www.landesrecht-bw.de/bsbw/document/jlr-JMedienSchStVtrGBWV10StVtr-P12

(1) Anbieter von Betriebssystemen, die von Kindern und Jugendlichen üblicherweise genutzt werden im Sinne des § 16 Abs. 1 Satz 3 Nr. 6, stellen sicher, dass ihre Betriebssysteme über eine den nachfolgenden Absätzen entsprechende Jugendschutzvorrichtung verfügen. Passt ein Dritter die vom Anbieter des Betriebssystems bereitgestellte Jugendschutzvorrichtung an, besteht die Pflicht aus Satz 1 insoweit bei diesem Dritten.

(3) In der Jugendschutzvorrichtung muss eine Altersangabe eingestellt werden können.

Ah scheiße, hier gehen wir wieder.

@DarkMetatron @Geki do you have inside knowledge of more countries you speak of? Stop spreading FUD and face the problem head on. You Germans have earned a reputation for intolerance of fascism and Nazi sympathizers in your own land. Get out there and protest such laws instead of musing online about the decline of freedom as if it’s a forgone conclusion. These laws are pushed by scum to chip away at freedom. They do not protect anyone.

I am not spreading fud, I only added something to a list. The fact that we have such a law is not known by many, even most germans are not aware of it, that is why I talk about it. It is only possible to Protest and fight against something if it is known, and I try to spread this knowledge. This is a way to fight against it, or at least the preparation.

I am very sorry that my posts gave the impression that I am not against such laws, because I for sure am!

And Yes, i should have said that I fear that more countries created such laws, my pessimistic world view got me when I wrote my first post.

@DarkMetatron sorry for the aggression, it’s just the relative helplessness us Americans feel in the shadow of so much stupidity and greed. It makes me jumpy when I perceive backsliding in more liberated places such as yours. I want to hold out hope the foolishness is mostly contained here in my nation.

Unfortunately, the internet at large has been embracing cuck behavior and capitulation for years.

They are genuinely excited to be a bunch of scared little bitches eager to please their masters.

@skyline2@lemmy.dbzer0.com @linux@lemmy.ml

Brazilian here. I'm neither a lawyer nor a specialist, just someone who has read the Portuguese text from the Brazilian flavor of the ongoing worldwide age check set of laws.

I must note that the Brazilian age check law (Lei 15.211/2025) specifies "vedada a autodeclaração" (English: "self-declaring is forbidden"). This means that this kind of implementation, where age or birthday is an user input, wouldn't be compliant to Lei 15.211/2025, because it requires the age information to be assessed independently from the user whose age is being assessed. This means face biometrics, government-issued ID (in our case, CPF, CNH, Passaporte and similar) or "behaviorial analysis"... Anything but a "yes I'm 18" or "I was born in day month year", for those are self-declared and the Law says it's "not enough".

Someone should warn the systemd maintainers of this "Brazilian jabuticaba".

(Cross posting this reply of mine because the post was cross posted to two different Lemmy instances)

I believe this only stores that information. It's not a system of declaring an age

@ominouslemon@sh.itjust.works @linux@lemmy.ml

The git PR specifically mentions a birthDate, a data struct that feels like it could easily be tampered with (therefore, far from "confiável" (trustworthy) as explicitly required by "deverão ser adotados mecanismos confiáveis de verificação de idade" ("trustworthy age checking mechanisms must be adopted")).

Thinking of age checking as some kind of OAuth flow, one would ideally store the authz token from whatever age checking provider validated the user's age, instead of some plain data which, depending on the provider, wouldn't even be handed to the application.

I can sort of imagine the following, hypothetical flow:

  1. Human tries to access the system for the first time
  2. System asks for human consent to proceed with age checking
  3. Human (is compelled to) accept going through age checking shenanigans
  4. System redirects human to 3rd-party age checking provider interface (e.g. Persona).
  5. Provider proceeds with whatever means necessary for the human to upload ID and/or selfie, who does whatever is required from them by the provider interface.
  6. In case of IDs, the provider talks with gov databases (e.g. Receita Federal do Brasil for CPF "Cadastro de Pessoa Física") in order to attest the validity of the ID. In case of selfie, provider communicates with a facial recognition model/algorithm/platform.
  7. Provider gets the information necessary for age-bracketing, appends it to their own DB with a signing hash, then returns the digest of said hash as a token to the system.
  8. System receives the authorization payload and confirms with the provider whether it's a valid token.
  9. Provider replies positively, perhaps with some kind of checksum, regarding validity of the token.
  10. System stores the token to hand it to whatever subsystem (for OSes, a software; for online platforms such as social media, a module/route) requesting age info.
  11. Subsystem allows or denies human access.

Some age checking models (such as EU) seems to be doing a similar thing to what I hypothesized above: the EU Digital Wallet returns a token, instead of PII. A token that can be checked against the Digital Wallet API for validity (theoretically) without disclosing who the user is (in practice, it'd be another, pretty reliable piece of traceable data despite any "anonymity")

I'm not sure whether a similar thing will be implemented here in Brazil (we got an official gov app, gov.br, which can already be used for "social log-in" by 3rd-party platforms, but I don't know whether it's ready for age check provisioning).

As far as I know Brazil and Brazilians, it's highly likely we'd end up with dependencies on Microsoft or Google services because Brazilian gov can't help but handing its own sovereignty to US tech corps, which adds to the dystopia.

I must make something very clear: I'm far from agreeing with this dystopia, I deeply despise this whole "age check" thing going on worldwide; I'm just thinking as a DevOps would.

Wait until Iran nukes the US and the financial systems collapses. Having bajillions of dollars will not help when dollars are worth nothing.

This is the first time I've cared about the whole systemd debate, so that's something I guess. Not interested in anything that kowtows to this age verification nonsense

what a fucking bootlicker

Final Edit: The PR has been merged into main.

Fucking hell. All he had to do was fucking nothing, the bastard.

https://theanarchistlibrary.org/library/revoluciana-facing-fascism-sabotage

Sabotage sounds spicy. It sounds dangerous.

And yet, the underlying concept is simply this: inefficiency.

I told you last time, make every inch have its cost.

Resistance does not have to be violent, and that’s not something I’m advocating here. Resistance is the word no. Resistance is standing in place. Resistance is pushing.

Resistance is the albatross around the neck of your opposition. Resistance is the anchor that drags along the sea floor.

Here are some incredibly mundane but effective examples from the manual:

Make mistakes with purchasing travel tickets

Make engineering mistakes

Make long speeches and waste time

Act ignorant, or ask a lot of questions: if you’re not familiar with the concept of sea-lioning, you should really learn it

Take longer to do your work

Even if you’re terrified of doing more, this is simply a place to start.

You are someone and you have a responsibility to do something.

You cannot make it easier for the fascists to achieve their goals. You can’t do it today, and you can’t do it later if they claim authority. You must stand in the way of oppression.

This is fucking horseshit. I'm turning against fucking systemd , and I had no fucking opinion before, now it's completely clear they're a bunch of 1940s IBM wannabees.

EDIT : What a surprise, the fucker that wrote the PR works for IBM and "A Medical Malpractice company" and the one that merged it works for Microsoft.

The origin of inefficiency as resistance comes from people in concentration camps deliberately doing poor jobs at forced labour as a form of resistance. If you're posting on Lemmy right now you can do a lot more than inefficiency. The people who had to resort to inefficient slave labour as resistance could only dream of what you can do.

ok great. can you tie it back to the discussion please?

Conversations move through different topics.

Did you ever hear the tragedy of Darth Plagueis The Wise? I thought not. It’s not a story the Jedi would tell you. It’s a Sith legend. Darth Plagueis was a Dark Lord of the Sith, so powerful and so wise he could use the Force to influence the midichlorians to create life… He had such a knowledge of the dark side that he could even keep the ones he cared about from dying. The dark side of the Force is a pathway to many abilities some consider to be unnatural. He became so powerful… the only thing he was afraid of was losing his power, which eventually, of course, he did. Unfortunately, he taught his apprentice everything he knew, then his apprentice killed him in his sleep. Ironic. He could save others from death, but not himself.

Just think of all those Azure and AWS VMs needing age verification as they're spooled up, destroyed and receated every few minutes...

Has anyone even looked at the PR? Why is there such a big stink about adding an optional birthday field to a JSON schema? It's opt-in and can't be validated in any way.

That's like saying OpenSSL is the thin end of an anti-encryption wedge because they provide FIPS compliant modules. Or complaining that it puts your privacy at risk when you generate an SSH key and it asks for your address.

The problem is the laws getting passed, not with software that gives people a choice about whether to comply.

... can’t be validated in any way.

I feel like this will be a problem for the future.

Edit: another user already pointed out the "problem for the future" here.

It definitely will be a problem, but it will be a legal problem, not a software problem. Even if the systemd devs decided to revert this commit and never collect age data, the law would still be just a shitty as it is now.

If this law said that everyone needed to provide a phone number instead of a birthday, would everyone here be just as angry at the Bell Labs developers who wrote the GECOS standard?

Everyone should be 76 years old, to honor System76 for helping.

Yes, the PR specifically calls out the laws as the reason for this change. The problem is BOTH the laws getting passed, and corporate interests complying in advance.

Personally, I just don't like the taste of asslicking in my distributions. Time to change to a non systemd distro.

The problem is the laws getting passed, not with software that gives people a choice about whether to comply.

OK, but the law didn't even get written. That asshole decided to open up and deepthroat the boot before it even entered the room.

the law didn't even get written

https://calmatters.digitaldemocracy.org/bills/ca_202520260ab1043

Current Status: PASSED

Ummm… what?

https://github.com/systemd/systemd/pull/40954#issuecomment-4032221990

I'm Jeremy from System76. We are in talks with legislators and there are likely to be amendments to the age verification bills, as well as conflicting requirements in different jurisdictions. It may even be the case that open source operating systems are exempted entirely. I detailed this on the xdg mailing list here:

https://lists.freedesktop.org/archives/xdg/2026-March/014797.html

I have other concerns about this specific implementation. By relying on systemd, which is decidedly unportable to non-Linux operating systems, and not used across all Linux operating systems either, it will force at least one alternative implementation to exist. If these implementations end up having to collect jurisdiction specific requirements, that makes it much harder for compliance.

IDK, I read about this bullshit like last week, and it was always presented in future tense. I saw this post from Jeremy from System 76 today in the goddamn Git thread, so excuse me for not understanding the current state of the problem.

The problem is the laws getting passed, not with software that gives people a choice about whether to comply.

Is it going to give a choice, though? As more and more of these laws are passed, soon people will have no choice. Open-source software was supposed to be about freedom, and I see this as anything but that.

Looks like this is just for storing the data (birth date). Distros can use it and do age restriction or ignore it. Not a big deal imo. Its not like systemd does anything more with the date.

Ah yes, because systemd has a history of not expanding its functionality beyond reasonable scope

Yeah. I always use a fake date anyways so it’s not like it matters.

Unless you're randomising it constantly, it still becomes part of a fingerprint for you.

The fingerprint is already pretty effective. Putting something like 01/01/1970 would add a small amount of precision, but likely not enough to make a difference.

It is possible that California law will be changed. But similar ideas are popping up in other contexts and it's unlikely that they'll all go away. This implementation is fairly generic and useful for other things besides age verification, so we shouldn't decide whether to merge it or not based on a single law in any jurisdiction.

https://github.com/systemd/systemd/pull/40954#issuecomment-4032355482

yep, it might be needed or not, let's invest valuable dev time into it, it will open the door for user tracking based on age bracket now at least, nobody asked for it, but let's do it anyways. Fuck Systemd for approving and merging this.

Meta's lobbies reach really everywhere these days.

Just write a shell script that changes the birthday every few minutes lol

Or an alternate implementation of the API that fetches it to flag any programs that call it.

Damn that's crazy. It'd be a shame if someone not beholden to California law just forked the code

Can't any of us do it? We can just remove the bullshit and put it on codeberg?

Absolutely if you learn how to do it. It also comes with the responsibility of maintaining it over time though

I didn't need one more reason to hate systemd

…Practically, what does this even mean for a systemd user like me?

What app would use this? And If anything actually uses the field, can't I just enter a random date, like I have across the internet forever?

Self reporting has long been honored as the gold fucking standard for honesty! How dare you sully that with your very discrete scrolling to a random year, and not even bothering to select a date! Our data mining overlords will be displeased.

They implemented part of the the low level works needed to implement birth date verification. Commercial distros like Ubuntu, RHEL and SteamOS might use it for law compliance. It'll very likely be as easy to bypass as it can be since no one really wants this.

You mean tied to IDs or something?

Commercial services would’ve just implemented that anyway. And yeah, likely with “absolute bare minimum effort.”

I’m still a bit confused. This thread is acting like this is a slope to systemd distros requiring an ID check, if I’m reading it right.

You mean tied to IDs or something?

Anything goes, ID is one way to do it.

This thread is acting like this is a slope to systemd distros requiring an ID check, if I’m reading it right.

The post itself is phrased like that for engagement.

Yes it's rage bait and most here fall face first in it.
Go petition your lawmakers instead of shitting on open source projects implementing required by law features.

It's not rage bate to inform people there is a problem so they know to call legislators.

Then incite people to call their legislators. Not openly shit on maintainers of open source projects.
I see more people here whining about systemd than about having the laws repealed. It's simple: there are currently 0 posts about that.

Is it wrong to call out those complying in advance with fascism? I will agitate in any way that sparks debate and encourages people to be more aware of what is at stake. I gain absolutely nothing else, especially on Lemmy... maybe if this was Reddit you could accuse me of being some shill farming karma. But that shit culture doesn't exist here.

This is some sick early April Fools thing right..? RIGHT?!?

It's so hilarious that the most recent thing that's happened on this shitty PR is a request for Claude to review their code.

Well, 2 out of 6 people have approved now and the person who requested for a review from Claude is Poettering himself.

Not sure I'm a fan of AI being used in the development of systemd, but at least for now it seems they don't want it to be built by stupid AI pull requests:

If you use an AI code generator such as ChatGPT, Claude, Copilot, Llama or a similar tool, this must be disclosed in the commit messages by adding e.g. Co-developed-by: Claude Opus 4.6 noreply@anthropic.com and pull request description.

The quality bar for contributions to this project is high, and unlikely to be met by an unattended AI tool, without significant manual corrections. Always thoroughly review and correct any such outputs, for example ensuring it accurately follows Coding Style at the very minimum. Please do not fire-and-forget pull requests without any human intervention and review, as that will likely result in low-quality results that will not be accepted, and if done repeatedly, may result in the account being blocked. As with any other submissions, authors are responsible for doing due diligence and ensuring their submissions are compatible with the project's license as documented in LICENSES/README.md.

As a guideline, if someone notices that a contribution (code, issues, comments) was made with the help of AI, there was likely a lack of human review of the AI generated output.

I can see it being useful to invoke an AI review in addition to humans reviewing, just in case it catches something nobody else did.

grok is this bug free

What is the alternative to systemd? I'm sort of a linux noob when it comes to this deeper level stuff.

SystemD isnt exactly a program but more of a group of projects, the only "core" SystemD software on most distros is the init system... Which you can run completely without SystemD's UserDB system (the part being talked about in the post).

Basically this means you as a user dont have to do anything but switch away from projects that depend on SystemD's UserDB (like Gnome), not SystemD as a whole

However if you do want to move away from SystemD as a whole you can replace your init system with another one, gentoo's wiki is a good starting point for learning a bit more: wiki. Personally I love using openrc but of you have no need to touch init files... Dont switch

Does KDE also use UserDB?

mine doesn't appear to be? it says installed but disabled. unless i'm looking at the wrong service which is entirely possible.

It appears to be active (running)

this is what i was going off of. i'm running cachyos (arch). am i reading wrong?

https://unix.stackexchange.com/questions/763290/what-is-the-preset-field-in-systemctl-status

It just says that when installed it was enabled, and it has been disabled later on. As for this apache server just after install Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled) – admstg Commented Dec 7, 2023 at 10:50

KDE is commited to keeping the desktop itself SystemD agnostic. Their new login manager does depend on SystemD, but you can run KDE Plasma from any login manager

Basically this means you as a user dont have to do anything but switch away from projects that depend on SystemD's UserDB (like Gnome), not SystemD as a whole

You can also just... not put your PII into UserDB. It can store clear names, mail addresses, postal addresses and now birthdates... but it can also just serve as an interface to /etc/passwd. Which conveniently also works with LDAP accounts (unlike your hand written /etc/passwd parser) if you're an organisation that uses LDAP.

This is the entirety of what UserDB knows about me:

userdbctl user --output=json $(whoami)
{
        "userName" : "sky",
        "uid" : 1000,
        "gid" : 100,
        "homeDirectory" : "/users/sky/home"
        "shell" : "/run/current-system/sw/bin/fish"
}

I don't expect that to change with this PR.

Thanks for explaining it a bit more. I moved from Windows 11 to CachyOS (limine bootloader and kde plasma DE) sometime last year and that may be a bit above my paygrade right now. Based on what I'm seeing in the Arch Wiki it would seem that quite a few systemd components are in use for my distro.

Just use something simple with systemd. The Linux community is its own worst enemy, in inviting people to come to Linux because it's so simple and beginner friendly, then the trap snaps shut and they tell you to pick a distro and all you have to do is decide on either gnome, plasma or cinnamon, and between arch and debian and ubuntu, and between snap and Flatpack, between Vim, Emacs, nano, and micro, between Wayland and the other one, between systemd and violent self-fellagelation, and whatever you choose, make sure it's FOSS and exactly what the next person on the forum used and as pure as the driven snow or you'll be bullied, belittled, and trolled by egomaniacs, elitists, and gatekeepers until you fawn like a thrashed housewife who 'only gets hit when she fucks up', or you give up and install windows again.

Just use whatever works for you, makes your life easier, and avoid the Linux purity circlejerk. When it stops working for you, use something else. Go your own way.

If you don't know what systemd does and you aren't affected by this, use it. If there's closed source software you wanna run, run it. If you want to install a snap, do it. If you like using VS code, install it on your Linux, it works great. You will never be pure enough to satisfy the Linux community.

This is hilarious and super on point. Thanks for the laugh :D

Okay but not really? Systemd does not really provide that much usability that any other init system + elogind doesn't. The benefit to the FOSS environment is that we, as users and developers, can starve out bad actors.

Want Nix but don't like systemd? Guix. Want Arch but don't like systemd? Void. You know what "compile" means and don't want systemd? Gentoo.

I'm just gonna keep using systemd

Most distributions use systemd but there are still distros and other unix-like operating systems that are using something else. However, they are not "user friendly" and will probably not be what most people are looking for.

Slackware uses its own init system and never used systemd but it has the reputation of being difficult to use. Gentoo also lets users choose between systemd and OpenRC. Alpine Linux uses OpenRC too. There's more than a dozen distros not using systemd, but again, probably not what most people want to use. It's also possible to replace systemd with OpenRC on some distros, but it possibly, probably, might cause some quirks.

Otherwise, there are other unix-like operating systems. Debian GNU Hurd also has its own init system but it's not using the Linux kernel, so it's a different beast. OpenBSD and FreeBSD also have their own init system, but not Linux. And AFAIK there's no such thing as modern gaming on those.

There are ways not to use systemd, but realistically speaking, it will probably not be worth it unless you're really militant about this. I started with Slackware at the end of the 90ies, I know how to compile a kernel, and tried GNU Hurd at some point, but I will not change something unless it's really implemented deeper into the general software. It's frustrating that the systemd devs are "collaborating", but we'll see what happens after a few rounds of updates.

Alt-init distros exist but it's only a matter of time before either they're screwed or age-gating goes down to firmware or hardware level.

I am a Coloradan; I have already called all 4 cosponsors of the bill here. What can I do now? Does anyone know which orgs are fighting against this? We have a petition process to get constitutional amendments on the ballot. My dream would be to collect enough signatures to get this constitutional amendment on the next ballot but I think the deadline for submitting the text (prior to collecting sigs) is late this month:

"No form of AI or ID-based age verification shall be used as a condition for granting Colorado residents access to a website, internet service, or operating system. Age gates that rely exclusively on user-reported age may continue to be used in their current form to inform users that a website may not be appropriate for all users. Colorado recognizes that parents are the responsible party for what their children access online and that requiring ID verification for access to computing resources or digital resources is a violation of free speech and freedom of inquiry."

I feel like the only way we can do anything about this is for us to have more money than the companies pushing for these changes, which is obviously not going to be possible... I'm not sure what else can be done.

Why do they need the age after all. What are authorities going to do with it?

Control what content you see and add some extra detail to fingerprint you.

If they can get this simple age verification done from everyone, it's not going to be hard to add "new requirements" in the future

Either this or block access to people living in hostile places. Currently it is a parental control with no verification of the thruth. You can put 01/01/01 there, if you want. If it turns into identity verification we will see what we can do.

It’s important to tell the Children apart because they are very sought after

They (politicians) are obsessed with control.

To my understanding, it's also Meta that is lobbying for this. Basically pushing the responsibility elsewhere to the operating system vendors

But how would they know I have been truthful about my age? I mean I am never putting my real age when registering on websites.

I guess they want this law to fall back on in case an underage individual is presented with mature/inappropriate content. Then they can just say that you lied about your age and that is not their fault.

Yes, so pretty much they don't want to be held responsible. And the government is bending over to comply with the tech bros.

I'm afraid so....

This is all to inch us towards an eventual Digital ID, similar to how we have a driver's license for a car.

Does BSD use systemd? I always wanted to try it and if this keeps up I might take the plunge.

I'll start off my comment with something everyone can agree on: the age verification laws absolutely sucks. It's a surveillance law masquerading as a means of "protecting" children. It also completely undermines free and open source projects, and therefore, protected speech. The fact systemd had to add a BirthDate field is unfortunate, however, I would blame the lawmakers for creating the law that the developers of systemd now have to comply with.

I'm okay with the implementation. It is an optional (meaning you have to add it yourself) field which only specifies the date of birth. It doesn't seem to be at all invasive, nor does it attempt to "verify" it at the moment. Granted, anything is possible, but I don't think there's a good enough reason why systemd would EVER feel the need to add age verification. Before you say anything regarding corporations, please answer this: why would a corporation add age verification to a system manager their servers depend on? How will that profit them?

I get why people are angry, but I think this anger should be funneled towards the lawmakers pulling off nonsense like this. Fight those who are actively trying to take your rights away. Bullying software developers for complying to international laws will lead to nothing but hate.

Nah this is more systemd bloat and certainly invites criticism. Other inits aren't even commenting, let alone complying.

Other inits aren’t even commenting, let alone complying.

This would be a fair point, if systemd wasn't more than an init system. While a service manager (init system) is included, systemd is a system manager. OpenRC, runit, and other init systems do not need to comment because their only task is to mount the necessary file systems, setup the device manager, and start daemons1. systemd as a system manager not only needs to manage services, but it also needs to manage devices, logs, the hostname, etc.

Does this mean systemd is not bloat? Not at all, but it is not as fat as you think it is. Your system could honestly be fatter without systemd if you try to replicate everything it does with external applications. Does this mean systemd should also be justified to add an optional field for your date of birth? I guess I would say it's weird on it's own. However, given the context, I believe they are doing what they can.

Your system could honestly be fatter without systemd if you try to replicate everything it does with external applications.

Maybe so, but systemd's bloated feature creep still leads to security vulnerabilities. Another systemd root access exploit was just discovered a couple of days ago.

Unfortunate. However, it seems that is snapd's fault. Here's the important part from the article:

Ubuntu automatically deletes old files from the /tmp directory after a certain number of days. During this cleanup, an important directory used by snap-confine may get removed.

Ubuntu configured systemd-tmpfiles to clean out /tmp after some days. That's why the issue is only present in Ubuntu systems. Therefore, systemd was doing it's job, and it just so happened to create the perfect conditions for a vulnerability in Ubuntu.

That is a fair point, actually. If there were a theoretical systemd-free Ubuntu it may just tell something else like tmpreaper to clean on the same schedule and create the same vulnerability.

Other inits are not relevant, because of their own choice to not do the job correctly last time they had a chance to

I believe those other init systems we're in the right to, but that's only because they are JUST init systems. systemd can because it doesn't just provide an init system, it provide a suite of tools for Linux system management. Something like userdb would have to be implemented by another tool, where they could actually implement BirthDate if they so choose to (and probably should for it's continued existence).

Yes, I agree. The problem is such things never appeared, so alternatives to systemd never became relevant.

Yea, fucking americans supposed democracy ruining the day again, thanks guys for freeing us all once fucking again

Then come the script kiddies hating on systemd for doing the actual work necessary for not getting linux banned in the "free" word and acting like this is some kind of gamestop organization action.

I guess it's time to get back to TempleOS.

HolyC is the real C

Give them an inch, and they will take a mile. Fuck this PR.

What is the most effective way to gather all of my personal stuff within Linux and it be as plug and play with every distro as possible?

Like if I wanted to infinitely distro hop to avoid this fucking Trainwreck right here, how would I easily and effectively ensure I can?

Can I take a set of folders?

Is there a backup format of some kind?

Is there a way to do this with installed programs in a way that can be dropped in?

btrfs. aside from useful things like on-the-fly compression and deduping, the thing has subvolumes; think partitions as folders, so you don't have to pre-size them. so e.g. your root (system) and home (user files and settings) are in separate subvolumes, which a) allows for easy backup/migrations and b) nothing stops you from installing a completely different OS (or several of those) in their respective subvolumes and then mount your home to each of those.

so you can have e.g. fedora and debian and arch, all on the same file system, using the same home, with all your shit available at all times and they don't interfere with each other.

That is wild. I assume that's part of the design from the get go with btrfs? That sounds like it would have to be.

I am currently using btrfs afaik, I'll have to check on this tomorrow.

yeah, e.g. fedora has by default a root and home subvolume. the caveat is, standard installers are either incapable of allowing you to install to a subvolume or are super-cumbersome, as that's currently not a top UX priority, so, a manual install process (with e.g. debootstrap and the like) is often needed.

Heard will be diving into all of this tomorrow, thanks for the info

Use a home dir on a separate partition and use nix or flatpak or some other distro agnostic package manager

Is the idea here that an agnostic package manager will install everything within home as well, and so when that's ported, and you have one of those PMs installed, it'll pick up where you left off or is there any specific protocol for importing something like that?

Pretty much what nix (distinct from NixOS) is.

That being said I would recommend NOT to do that because you most likely need 10 specific packages at most. That should take you 15min tops to install with few minutes paying attention.

Just make sure /home is its own partition, or even disk, the distro hop if you want. You can also have in your ~ directory an apps directory where you keep binaries, AppImage, etc.

For most people this is not a real concern.

I'll have to look into that. I've been daily driving Linux for maybe about 2 years now, and I've learned a bit and have messed around with it on and off for years, but I don't know it.

I'm at a point though where I know that there's going to be a time where I need to know to feel secure in avoiding bullshit like this post, malicious packages, general good security practices and what not, so y'all may see quite a bit of questions from me.

Thanks for the info

No worries, if you want you can "test" that via a virtual machine, even a container e.g. https://docs.linuxserver.io/images/docker-webtop/and see what you would genuinely miss.

It feels like our computer is very unique, very customized, but often it's done in very few key places, e.g. browser profile data, ~/.bashrc , etc and once you locate those, transitioning to any other system is way easier.

Good call on vms, thanks again

Nix is very heavily tied to systemd though

You just setup with the traditional partitioning scheme, so / and /home on separate partitions. You can have as many / partitions as you like with different distros on sharing the same /home partition. You still need to install all the packages you use in each distro, but your setup, personal and config file are consistent and preserved across all the distros.

Time to move to Guix !

https://guix.gnu.org/

Has the lack of software ecosystem improved much lately?

Kinda. What I want is there now (niri, helix, relatively recent Gnome apps, librewolf), but it's not Nix. If you want the latest wlroots bling, it's likely not packaged. The guix pull time has not gotten better, it actually feels worse than I remember.

That's it! >:-( I'm going back to init. /s

As usual, poettering is a piece of crap.

I 0man on using my McLovin ID for all this verification shit.

I literally have the same plan if I ever need to.

Great minds think alike.

Seriously, I do.plan to spoof their nonsense somehow. Trick AI with AI maybe.

I don't understand. What's systemd got anything to do with age?

As per the linked ticket, they are a story for a handful of user data. An XDG portal needs to store this stuff, and they are already integrated, so this is just to accommodate the other project.

Systemd has to do EVERYTHING

They drop a systemd-kerneld one day and drop the Linux bit altogether

one day... one day I'll be able to run Steam on *BSD...

I have excellent news for you

Though I haven't tested it myself.

Not at all for now. Its just about storing the birth date in a way that the system can use it.

I hope the alt inits or even the hardware itself aren't targeted next.

So what? I am (g)root.

Successfully merging this pull request may close these issues.

None yet

I'm a noob when it comes to deep linux stuff.

So how does this affect end users and are we at risk of leaking personal info? It looks to me they are adding a birthDate field along with other meta data. Will these metadata be sent to whatever local authorities or whatever data hoarder on the web (like Google) without user consent?

I meant what stops me from listing false info like: Name: Biggus Dickus DOB: 06/09/1969 Nationality: Spartan .....etc. ?

I usually use systemd for stuff like hibernate/suspend, e.g.

systemd suspend

and if on i3wm, I edit configs for sleep and lid close in /etc/systemd/sleep.conf

Are these affected too?.

The other user data is already stored in the userdb versions that nearly everyone who uses a systemd distro already has. You can check what data is being stored with userdbctl. On my system that looks like this:

userdbctl user --output=json $(whoami)
{
        "userName" : "sky",
        "uid" : 1000,
        "gid" : 100,
        "homeDirectory" : "/users/sky/home"
        "shell" : "/run/current-system/sw/bin/fish"
}

Honestly this PR is a bit of a nothingburger. I'm not aware of any distro really using userdb to store data beyond what you'd store in /etc/passwd (maybe Ubuntu does?). The main value of userdb seems to be as a frontend so other programs don't need dedicated code to handle /etc/passwd, LDAP, etc. Notably GNOME recently eliminated their dedicated code in favor of just using userdb.

And Userdb doesn't really handle data validation at all. It enforces that you input a valid date after 1900, but that's kinda it. I guess you need root/sudo privileges to change the birthdate but that's not much of a hurdle for most Linux users.

Really this entire PR boils down to:

ALTER TABLE users ADD birthdate date;

And this is how I find out that systemd lets a process running as a user get the crypted password of the user:

"privileged" : {
                "hashedPassword" : [
                        "$6$AY98/.dwdtU20LBM$L9fFhaH.E2xA6waYBVmHl/wS4HFSPn5v/JaIlrSW6wLOfKkV6H1Boqggj/109WO/uHXF1J/NkyXsK1BaCRKwx/"
                ]
        },

I mean, why the hell...

Any way to not have Systemd on NixOS?

Using Guix SD instead.

Real answer, NixOS is very tied to Systemd (the init part anyways). Removing it would amount to rewriting half of <nixpkgs/nixos>, and writing a bunch of extra service definitions for packages that are only supported on systemd. Also you'll have to reimplement UserDB (which is what this PR is for) to get GNOME (maybe also KDE?) to work.

Unfortunately not, systemd is tightly integrated into NixOS and an option for alternative backends would have non-insignificant overhead so they aren't going to introduce it. The next best thing is SixOS

Joke's on them, I use Limine 🤣

forgive me if this is a joke, i'm not well versed in linux shit yet, but wouldn't that only remove systemd-boot?

Yup, that's part of the joke, I got rid of their bootloader, but am otherwise fucked too 🤣

A lot of open source software is kind of ridiculous to many people. Why would you want to reverse engineer some proprietary device? Just choose one that is more open. It isn't just about the challenge. It is also about extending freedom to do stuff as many places as possible. I might not want age verification in my operating system as its just another way to fingerprint me by big tech. And I probably won't have it enabled or exposed. But having the option allows people to participate in the shitty, spying. predatory, manipulative, commercial hellscape version of the Internet which is increasingly facing regulation around the world. That is a freedom. Not a freedom I want but a freedom someone wants. It means they are not legally forced to use Microsoft or Apple to give all their data to the NSA and big predatory businesses.

A question I have that I hope someone can answer: how is the age check at the OS level verified? Is it just a trust issue that the user is putting in the correct date?

At least for the California and Colorado laws, it is only attestation. But you also have to realize that, with how this law is defined, this only applies to parents setting up a account for someone <18yo.

omg the end is near

The only reason I still have a Microslop account is Minecraft. I have to assume that's one of the reasons they bought it.

How about any open source alternative e.g. https://www.luanti.org/or Minetest or Terasology or Voxel.js or...?

Stripped down to the bare essentials, those are similar. But surely you realize, that the sheer amount of content that was added over the years, and the enormous amount of mods, and the entire community, aren't remotely comparable, right?

This is less of a Photoshop for drawing vs Krita and more of a Photoshop for image editing vs GIMP situation, and even that comparison is kind of unfair to GIMP.

the sheer amount of content that was added over the years, and the enormous amount of mods, and the entire community, aren’t remotely comparable

Are they compatible though? Like can I load content, connect to open source servers, uses mods on any client? Please don't presume I know anything about the topic, I'm genuinely trying to understand exactly why alternatives are not good enough.

I'll just assume you're serious and not trying to be a troll. Those aren't launchers or different clients for the same game, they are different games. It's the same as how Tux Cart isn't compatible with Mario Kart. It's just not the same thing. You also wouldn't assume a Teardown mod works in Minecraft, just because both are voxel-based, right?

There are open source Minecraft launchers like Prism, those are cool and useful, and frankly way better than the official one, but they use a Microsoft account too, as your ownership of the game has to be verified, and you can't connect to servers without one.

Yes I'm serious and I'm not a troll. I don't know what in my questions or suggestions make it sound like that but feel free to dig deeper.

Anyway, AFAIK Minecraft has an official client which connect to official servers.

It's possible to replace clients, as listed earlier, but they might still rely on official servers with their accounts as you pointed out. There are though, AFAICT, compatible servers too, e.g. https://glowstone.net/so one could connect an unofficial client to an unofficial server and thus have a similar experience with no reliance on anything related to Microsoft, no?

Thanks for the suggestions. I've tried minetest, but I'll have to take a crack at she others. If it was just a game I played by myself, I would absolutely use those alternatives. I've played on a string of "civilization" servers for a decade or two now. Hundreds of people forming nations and interacting with real economies, diplomacy, and wars. A few key mods create the conditions of scarcity and balance destroyability/defensibility of the buildings. All of it is perched on a stack of custom mods. I'm not sure how hard porting them to Minetest would be. Some of these relationships are longer than my IRL friendships at this point.

When I started, we were using FOSS tools like Mumble to communicate, then they used Reddit and Team Speak, then eventually most nations moved to Discord for voice and text. I HATE discord. Maybe it's because I'm too old, but I can't follow a conversation for shit on there. At least everything is Linux compatible.

If I could find some interested devs to make the mods compatible, I'd gladly pitch in to help run a fully FOSS mineman civ server.

While the players can span all ages (a few grandparents on there), most are Gen Z and for some reason, Gen Z seems to care less about FOSS and open software. They've been propagandized fully by the proprietary web 2/3.0.

Thanks for the clarification. Unfortunately I'm no expert in the matter. I bet that some mods are compatible, I bet some aren't. I bet some open source client/server pairing implementation might give more freedom but aren't necessarily as popular. I have no idea how that impact culture or the size of projects. I imagine that the community of each project, e.g. Minetest, would know better if the limit itself is technical, e.g. mod compat, or not, e.g. network effect and thus a lot of people "sticking" to the "original" proprietary implementation not because it's better but solely because their in-game friends are there.

@njordomir Where can I go to keep track of any Minetest civ servers? I have always wanted to try a civ server for fun but never had the chance to because they were only on Minecraft.

This is exactly what I had in mind with my opposition to systemd.

Didn't expect to be proven right so soon.

When did you start your opposition to systemd?

Y'all are making a mountain out of nothing. There are already userdb fields for the real name and location. I don't think anyone ever gave a fuck what you enter there, if anything at all. Why should DoB be different?

Adding another data field alone does nothing unless:

  1. Entering it is forced
  2. That entry is somehow verified (which would be the invasive part)
  3. The systems accessing userdb actually use it for anything (which would require it to be filled out and verified to be anything but performative)

As it stands, it's a performative gesture to avoid law enforcement crackdown, which I think is perfectly reasonable for a private person with limited funds to fight a legal battle with. That doesn't mean they can't also fight that battle privately, but expecting volunteers to put their necks on the line over adding data field seems rather entitled to me.

If Gnome (or any other program) decided to implement age verification (beyond just "enter your date and please don't lie"), using that field, the blame for that would fall on Gnome.

This is more like adding a field in the cookie of an adult website to store whether the user has clicked "Yes, of course I'm 18", without even implementing the disclaimer for the user to click that button, let alone actual age verification.

is perfectly reasonable for a private person with limited funds to fight a legal battle with

Are you saying corporations like Red Hat sponsoring the development of systemd are thinking of "poor private devs" of whatever distro when taking such a decision than impacts the majority of distros?

Red Hat probably could afford to go to court over those laws. Maybe should, too. Maybe just passively ignore them until someone drags them to court for it. But all of that would be independent of this change.

impacts the majority of distros?

And just what is that impact?

"Here, you have a space to write stuff down." So what? If I'll never read it or verify the contents, what difference does it make?

And just what is that impact?

That every distro will inherit a field containing a birth date, whether they want it or not.

“Here, you have a space to write stuff down.” So what?

That "stuff" is a personal information that not everyone is legally equipped to deal with. In EU there are specific laws protecting storage and usage of personal information.

Your "stuff"can potentially create more problems than the ones it tries to solve, assuming good intentions.

That "stuff" is a personal information that not everyone is legally equipped to deal with.

You mean like email address, real name, location? Because those fields exist already. I'm not aware that they have ever caused any issues, even though real name and location should be more critical in a doxxing or surveillance context than "just" the date of birth.

I assure you, I don't have my email, real name or location stored in my userdb. Nobody makes me enter them. Nobody cares. Nobody would verify if I did. What's stopping me from entering 1970-01-01 as my DoB, if I enter anything at all?

If I'm the one storing, transmitting, querying and processing PII, I'm responsible for it. If my distro were to require email verification, proof of identity for the real name, records of my place of residence or employment to ensure the location is accurate, that would be an issue, and that would make the vendor liable for handling that data.

That is what the GDPR and related laws are actually concerned with, not the exact format or place they're stored. Otherwise, you'd have to ban me from creating text files: I might store someone's phone numbers in there.

Because those fields exist already

I've been using Linux for many years and not even once I've seen those info being requested by the operating system.

Otherwise, you’d have to ban me from creating text files

There's a huge difference between YOU putting your info by your own accord wherever you want (look at what people do on Facebook) and an operating system requesting those.

In case you didn't notice, this whole ordeal is pushed by Meta to avoid being accountable for the shit they do on their platforms, they're trying to shift the responsibility to operating systems of all things, and that's not acceptable.

being requested by the operating system

Is it though? As best as I could tell, this PR is literally just adding the field next to the others, not requesting shit.

In case you didn't notice, this whole ordeal is pushed by Meta to avoid being accountable for the shit they do on their platforms, they're trying to shift the responsibility to operating systems of all things, and that's not acceptable.

Absolutely. I just disagree that this particular addition (particularly considering all the fuss about making sure it doesn't show up in logs and dumps and what not) is a problem. I don't think this is the hill that battle should be fought on. Adding or not adding it to systemd doesn't make the OS / distro built on top of it any less responsible for their handling of that data.

It does provide a standard and (somewhat) central place to implement the security aspects of it though.

It does provide a standard and (somewhat) central place

That would be the case if everyone used systemd, but it's not, sysvinit distros still exist and they're not going away in the foreseeable future.

I don’t think this is the hill that battle should be fought on.

I could agree with this if the reason for this PR wasn't age verification, that's indeed a battle that needs to be fought, on every piece of the puzzle.

That would be the case if everyone used systemd, but it's not, sysvinit distros still exist and they're not going away in the foreseeable future.

That's nice. Doesn't change the fact that it needs to be stored somewhere, if the maintainers end up facing legal pressure to implement it. Opposing one (optional) way to store it won't fix the issue, it'll just result in the same splintering of competing standards we see everywhere else, with the attendant difficulties in ensuring security and quality across the board. In other things, that might matter less, but if we're pissed about having to hand over PII to one instance, I'd be even more wary of it being stolen.

You'd be cutting off one leaf of a tree.

I could agree with this if the reason for this PR wasn't age verification, that's indeed a battle that needs to be fought, on every piece of the puzzle.

Are you going to oppose every other system that allows storing data too, because it might be used to store data for age verification?

No, it's a battle that needs to be fought at the focal points: lawmakers, law enforcement, developers implementing the verification tools, companies using them.

Spending time and energy waging a culture war over the most insignificant, replaceable, trivial part of it will achieve nothing. It sacrifices all nuance and bulldozes all discussion of other merits (or issues) systemd might have.

There are legitimate, reasonable complaints to have with systemd. "We added a data field, which we're trying to make sure doesn't end up in the wrong hands" isn't one.

Fuck these laws, and fuck the fascists using kids as pretense for surveillance.

Doesn’t change the fact that it needs to be stored somewhere, if the maintainers end up facing legal pressure to implement it

Sure, but trying to apply it to the entire world when only a few countries are currently impacted is fishy at best.

And no, we don't know yet what the entire world will do about it, even if Meta is trying to lobby everyone, there's also a push for making opensource exempt from it, in that case those applying the PR have worked for nothing.

Are you going to oppose every other system that allows storing data too, because it might be used to store data for age verification?

It depends, if the purpose is age verification then yes I will oppose it.

There are legitimate, reasonable complaints to have with systemd.

I didn't have any so far, for the very simple reason that I don't have the technical knowledge to judge by myself. This PR tho doesn't require any tech knowledge to understand what's going on.

“We added a data field, which we’re trying to make sure doesn’t end up in the wrong hands”

The road to hell is paved with good intentions, even tho by reading the PR thread I'm not sure the intentions behind the push are actually good as you seem to believe.

Fuck these laws, and fuck the fascists using kids as pretense for surveillance

That's something I fully agree with.

there's also a push for making opensource exempt from it

Let's hope it succeeds. Actually, let's hope the law is overturned entirely. And while we're at it, let's hope Meta fails, crashes, burns and takes all its bullshit down with it, but that's only tangentially related.

It depends, if the purpose is age verification then yes I will oppose it.

Then I'll not tell you what I intend to use that encrypted hash I'm writing to my app's data storage for.

Any data storage can be abused. This one is transparent about its content, but I don't see anything implying that you have to enter anything, let alone have to enter your actual birthdate. It can be used for parental controls, it can be used for age restrictions, but if I implement age verification, where I store that data on your machine is the least of your worries.

Where I store your ID on my machine, on the other hand, should be more concerning, and even more so the fact that I need your ID at all.

We can argue whether this is necessary, whether it can serve reasonable use cases (such as voluntary parental controls), but at the end of the day, it's such a small and exchangeable part of the system that it's not worth the shit people give systemd over it.

I think controlled, transparent storage is better than intransparent, and any storage is only as evil as the things using it. Target those things instead.

Yes, anything can be abused nowadays, but you can't cut yourself off technology, unless you want to live as a hermit, I'm pretty sure none of us wants that.

And no, I've never given my ID to anyone that's not my government, and I won't, if they classify me as a teen because of it, so be it.

Yes, what systemd is currently doing is pretty innocent compared to other things, I believe that's on purpose so people can easily accept it and they can do worse later. Corporations are behind this, don't forget that.

I believe that's on purpose so people can easily accept it and they can do worse later.

That point, I disagree on, because systemd (not) implementing this doesn't actually make it easier (or harder). Distros that want to comply would just write a file for it somewhere instead. Distros that don't comply will just not implement any verification process.

What systemd does here is offer a solution to secure it centrally (see the commit discussion about the most efficient and reasonable way to wipe that info from memory again). Considering the whole issue, I think its impact on feasibility of verification is minor, while the advantages of standardisation make it preferable to a wild growth of uncontrolled alternatives.

Corporations are behind this, don't forget that.

Another user pointed out the concept of anticipatory obedience to me, and in that context, corporations pre-emptively bowing to authoritarian surveillance is definitely a cowardly move. We agree on that.

Here's to hoping this entire discussion becomes just as pointless as you expect the PR to become. If that's what I end up being wrong about, I'll gladly take the L for cynicism and the W for privacy.

What systemd does here is offer a solution to secure it centrally

It doesn't as long as other init systems exist and people can luckily choose, hopefully that will always be the case.

Here’s to hoping this entire discussion becomes just as pointless as you expect the PR to become

Agree on that, I think that's the hope for everyone here.

It doesn't as long as other init systems exist

Of course, which is why I said it was "somewhat" central earlier in the thread: it's not universal, even if systemd is widely used.

Other init systems generally also have ways to store data (not specifically dates, just in general), and some overarching standard for securely accessing them would be useful for intercompatibility, but that's a mess as it stands anyway.

people can luckily choose, hopefully that will always be the case.

Also agreed. Just because I personally come down on the systemd side of the debate doesn't mean everyone should have to use it. Standards are nice, but there always should be alternatives, in case a standard gets captured by twats (which kinda is the debate we're having: whether systemd has started bowing to fascists significantly enough to warrant migrating away).

dude, can you send me a picture of your government ID? I just wanna see?

Nope. I'm John Doe, living in Nice Try, Atlantis, and my email is "who@car.es". But I draw the line at being asked for my birthday (which is 1970-01-01).

The userdb already has fields for other information. Nobody enforces putting anything there, nor verifies the contents. Why should DoB be different? And why should that be on the userdb?

Because this design does not come from the project, it is bowing down to a fascist funded movement.

It's easy to say "just ignore the law" when you're a nobody on the internet. But also, this isn't much bowing. More like slightly inclining your head to do the bare minimum.

They're debating about the best way to make sure that data doesn't end up where it shouldn't. They're not implementing some systemd-level verification requirements. They're literally just offering a central-ish place to handle storing and securing that data. If anything, this should be preferable to having different implementations with different levels of security standards.

And it's delusional to think that Linux will collectively be able to evade this requirement, unless the law as a whole ends up overturned (which I very much hope it does). You wanna get pissed at someone for sucking fascist dick, get pissed at the lawmakers passing this crap.

A data field isn't the hill to fight that battle on. If someone goes and actually implements mandatory verification, I'll be right there with you, (pitch-)fork ready and ready to burn bridges, but this isn't it.

Everbody look at bro, he's glowing!

?

I mean, I literally say that implementing actual verification would be an invasion of privacy. Storing data isn't the problem, because we do that any way. This isn't any different from the fields for your real name or location, which nobody gives a fuck about either. At least systemd are talking about ways to secure that data, whether to add a separate flag or save some CPU cycles before wiping it from memory and such.

If you force me to enter something, that's definitely shady. If you force me to verify that information, we're in "fuck no, fuck you, fuck this surveillance bullshit" territory.

But getting upset about this optional field in particular, but not any other data storage option, is hypocritical. Worse still, getting upset at the one effort to provide a standard that also makes some attempt at securing it is short-sighted. We have a hundred ways to store data. Cancelling one won't stop the root issue:

Collecting that data. Fuck that law, fuck the people that wrote it, fuck the people that passed it, fuck the people forcing you to surrender PII for plain bullshit reasons and fuck the people implementing those surveillance methods. That is worth raging about.

Hey I’m not gonna disagree. I just provided an answer to what that person meant about “glowing”.

I’ll add another link that you might want to consider though: https://en.wikipedia.org/wiki/Anticipatory_obedience

You're right, and thanks for that and the second link too.

Still, as "bowing to fascist fuckery" goes, trying to figure out how to securely store a piece of data is hardly problematic. The Flatpak PR they cite also mentions that they wanted options for parental controls independently of the law, and it's that part I'd be more concerned about, but still less than about the "upload your ID please, promise we won't pull any fuckery with it- whoops" shit going on elsewhere.

You are correct but every little barrier helps.

Hate to just keep throwing out links to Wikipedia but … these techniques have been used to some success in the fight against fascism before.

It is much better if Linux and systemd say “oh gosh we’re not ready to implement that for at least another 2-3 years and even then only in preliminary implementations” instead of “yes sir right away sir we have that all ready to go at a moments notice, let me put that boot of yours right down my own throat”

this new anti-systemd sentiment reminds me of anti-TPM and anti-SecureBoot sentiment

having TPMs and SecureBoot on Linux machines has only ever empowered device owners to ensure that the software on their devices has not been tampered with

there's never been a case where these technologies were used against Linux device owners

likewise, I predict that Linux device owners may find the age field useful for certain opt-in parental controls, but we'll otherwise look back on this and shrug at the extreme paranoia

This seems to be an opt-in, user-supplied field that apps can use to implement parental controls easier. If you're gonna do birth dates at all, this is the way.

But IMO it should be more granular: there should be fields for WWW access, social media access, sex/nudity/violent content, and apps should respect those individually. Then parents can choose what is appropriate for their child at their development level.

In the xdg-desktop-portal PR there is a very interesting discussion about how OS level parental controls probably should work:

The other way to approach this would be to turn it on its head, and instead of having a portal which tells apps what age the user is, instead have a portal which apps can query to tell them whether content which has a certain rating should be shown to the user.

gnome-software, AppStream and malcontent use the OARS ratings system for tagging content with what might be age-restricted about it. This has a mapping to a CSM age (which is international), and that has mappings to most countries’ national ratings systems, and is designed for web content as well as games and films.

Presumably an app would send a list of specific OARS tags (which exist for precisely this purpose) to the OS via xdg-desktop-portal, and the OS would respond by classifying each tag as acceptable or unacceptable. The app then is only responsible for not displaying the unacceptable content, and tweaks to the filters based on jurisdiction and new laws/amendments happens in a clearly defined place which is the portal implementation (which could be in an optional package, e.g. xdg-desktop-portal-content-controls).

Of course that system wouldn't comply with any of these new laws because they're just bad. Even ignoring all technical considerations, most of them have a ridiculously broad scope (or large uncertainties). They're very poor legislative work.