Objections to systemd age-attestation changes go overboard

3/31/2026 at 6:19:46 PM

There’s nothing “overboard” about pushing back on unnecessary political meddling. The operating system does not need to know your date of birth (or identity! Looking at you Micro$oft) in order to manage your hardware and software. The need to know is zero, and given the 1st Amendment I question that any political entity has the legitimate authority to compel one to alter software, open source or otherwise.

by stevenalowe

3/31/2026 at 8:14:21 PM

I think the "overboard" part is that the developer was doxxed and received death threats.

by ahofmann

3/31/2026 at 8:51:01 PM

that is definitely overboard :(

by stevenalowe

3/31/2026 at 6:25:00 PM

The operating system does not need to know your full name, email and location in order to manage your hardware and software, yet systemd has had optional fields for those for years and nobody complained. They added an extra optional field for the date of birth.

> Some of this has been fueled by a misinformation campaign that has targeted the systemd project and Taylor specifically, resulting in Taylor being doxxed and receiving death threats.

I see.

by GrayShade

3/31/2026 at 8:56:22 PM

unfortunately the article does not mention who is responsible for the alleged misinformation campaign

by stevenalowe

3/31/2026 at 7:06:40 PM

> full name, email and location in order to manage your hardware and software, yet systemd has had optional fields for those for years and nobody complained.

maybe we should complain

by rasz

3/31/2026 at 7:47:07 PM

Why, it's fine to have these values in a corporate environment: name, work email, office location. I'd be fine with an ability to store the birth date, the blood type, the zodiac sign, actually an arbitrary list of key-value pairs, as long as it's optional.

It's only a problem when the OS insists on recording your private information to let you access your private account.

by nine_k

3/31/2026 at 8:48:56 PM

It is an optional field, and so far there is no software that asks for this information, let alone insists on it.

by db48x

3/31/2026 at 8:52:00 PM

which is the logical next legislative step

by stevenalowe

3/31/2026 at 6:44:16 PM

[dead]

by marshray

3/31/2026 at 6:32:21 PM

> It was to be expected that some members of the community would object; the actual response, however, has been shockingly hostile. Some of this has been fueled by a misinformation campaign that has targeted the systemd project and Taylor specifically, resulting in Taylor being doxxed and receiving death threats.

I think we can agree this is overboard

by pinkmuffinere

3/31/2026 at 7:11:41 PM

I think I'd feel the same way about race- or gender-attestation: none of your business. Let's not build the infrastructure into the operating system to selectively restrict civil rights by demographic.

by delichon

3/31/2026 at 7:26:44 PM

Doesn't make sense to invoke civil rights and pretend there are no legislative limits. If a law is passed requiring age verification and the component can't attest, then its blocked. You must attest your age to vote for example.

by nh23423fefe

3/31/2026 at 7:37:59 PM

Not every device needs to be a secure voting machine. Civil resistance is an appropriate response to such an effort. The author prefers proactive cooperation.

by delichon

3/31/2026 at 7:43:21 PM

> You must attest your age to vote for example.

How does this relate here, or to computing generally (barring electronic voting machines)?

by youarentrightjr

3/31/2026 at 7:33:16 PM

Are Unix and Unix-like vendors making implementing this harder than it needs to be? Here is what is required for laws like California's.

1. To modify account creation so that in the scenarios where the law applies (account is being created for a child who is the primary user of the device) to ask for the age and/or birthdate of the child.

2. A way for applications to ask for the age range of the user ([0, 13), [13, 16), [16, 18), [18-infinity)).

Implicit is to store enough information from #1 to support #2.

The way I would store that information is by creating a directory, say /etc/age_group, and in that creating one file named after each age range. These files would be owned by root and not group or world readable.

On creating an account this applies to add an access control list (ACL) entry for that account to the appropriate file in /etc/age_group that allows that user to read it.

Then for #2 the way applications can check is by simply checking which files /etc/age_group it can open.

This should be more portable than the other ways I've seen proposed. POSIX access control lists are included I believe on every major Linux distribution (and also MacOS, FreeBSD, and maybe other BSDs).

This would give application writers on most Unix and Unix-like systems a common way to check if they are on a system that implements the California law (does it have /etc/age_group?) and a common way to check age group.

by tzs

3/31/2026 at 8:55:55 PM

That’s a clever start, but it has a problem. What happens when the list of age groups changes? This list is not fixed; it changes over both time and space. How do I tell the difference between a system that doesn’t support age attestation vs one that only supports age groups that I don’t know about? For example, suppose I am looking to see if the user is in the `over_13` age group, but only `/etc/age_group/adolescente` exists? What if there are multiple readable files?

Systemd’s solution is simpler and doesn’t have these edge cases. A higher level of software, such as the desktop environment, can query the user’s birth date from systemd and use their locale settings or time zone or other information to compute the correct age group.

by db48x

3/31/2026 at 7:52:29 PM

This is a great idea. It very compactly implements a barebones parental control system: a parent (with admin access) can assign an age group to a user account, and apps which care can easily check it.

I think it's exactly how such a system should work: apps, sites, etc should declare an age limit, and the user's OS should decide if it's going to give the user access to them. This approach is opposite to having the user to prove their age (and worse, the legal identity) to the web site, app, etc.

by nine_k

3/31/2026 at 9:14:19 PM

[delayed]

by razingeden

3/31/2026 at 7:04:16 PM

Setting aside the obvious fact that it's morally wrong to harrass people, something tells me these harrassers never do the same to developers working on closed source software for companies, having the net effect of harming the FOSS movement overall.

by gradientsrneat

3/31/2026 at 7:54:50 PM

As a parent, I welcome these changes. When people say, "parent your kids," this is what I need to do that: an os-level setting that serves as a source of truth, a browser that reads it, and sites that require it.

If you don't like those things then use another distro or create your own, branch a browser, and create your own Internet. I welcome that. Until then, don't say the contradictory phrases of "parent your kids," and resist any of the infrastructure to actually accomplish that.

by kelseyfrog

3/31/2026 at 7:21:37 PM

This reads like a company piece.

by dizhn

3/31/2026 at 7:44:20 PM

>systemd age-attestation changes

WTF?

by jollyllama

3/31/2026 at 8:22:37 PM

I'm a Mac person through and through but I've always had the deepest respect for the sincere commitment to freedom and privacy that you find in the FOSS world.

I am shocked by what's going on with systemd and by how suddenly bootlicky LWN has gotten.

by stalfosknight