Stores the user's birth date for age verification, as required by recent laws in California (AB-1043), Colorado (SB26-051), Brazil (Lei 15.211/2025), etc. userdb: add birthDate field to JSON user records https://github.com/systemd/systemd/pull/40954

[ai6yr@m.ai6yr.org]

@nixCraft Grrrrrrrr

[gothpanda@pandapla.net]

@nixCraft They deal with everything else, so I figure they just thought it was appropriate to deal with this too?

[agowa338@chaos.social]

@nixCraft

userdb is basically the systemd version of LDAP, so it kinda adds up...

[echopapa@social.tchncs.de]

@nixCraft

Poettering:

BTW, just to emphasize this, and explain why i think adding this to userdb is fine:

i actually believe that making sure apps cannot just read the birthday field is a good idea, but it's just one tiny piece of data among so so much more important stuff. if people run apps unsandboxed these apps get access to any file in $HOME and a tonload more stuff of the system. And that data is a lot more valuable than the birthday is. Hence, let's maybe not waste discussion around isolating apps from that single piece of information that is the birthday, while leaving everything else wide open.

[borrisinabox@fwoof.space]

@nixCraft Everyone is now born on January 01, 1970 at 00:00 UTC. That's just how it is.

[echopapa@social.tchncs.de]

@nixCraft

The answer to the PII issues is hence not restrictions in userdb, the answer is proper app sandboxing. And that even already exists in flatpak! It restricts access to $HOME already, and to userdb too! And that's the way to do it!

Hence, just embrace app sandboxing! And if you come to me and say "hey, I run all my apps without sandboxing, but i want the birthday hidden anyway" then I can only say, your model is really really broken. Fix your security model first, then come back.

[koree@mastodon.ameth.org]

@nixCraft there are several states trying to pass laws that Meta has been lobbying for that require “OS-level age verification”

I think they’re preparing for these to pass.

[echopapa@social.tchncs.de]

@nixCraft

So, I think userdb should reveal the birthday to per-user code, because that per-user code then can consume this and provide a portal or something to properly sandboxed apps that provides a more restrictive api, i.e. age brackets and so on. But that kind of stuff is outside of the scope of systemd, here in systemd we just provide you with a way to maintain the original data, the precise policy enforcement on it must happen in the sandbox."

no comment

[tezoatlipoca@mas.to]

@nazokiyoubinbou @nixCraft

Today I learned that there even IS a linux userdb, even if its only used by systemd.. and wait.. why does systemd need a user db at all? .

Any why can't we just add a /etc/user.info file that is linked to /etc/passwd?
so many questions, this is all so dumb. age verification is so stupid.

[schrotthaufen@mastodon.social]

@nixCraft Because either they’re collaborators, or they’re deluded into thinking tech is a political, or they weren’t thinking at all when implementing this. Oh wait… that’s basically the same thing.

[qwertz@defcon.social]

@echopapa @nixCraft

I stopped listening to Pottetering's “ideas” a long time ago, and I sleep better at night.

[wxq4987@infosec.exchange]

@paul_ipv6 @nixCraft remember when the world revolted against systemd, but we were all told we were overreacting and just whining "because change"?

[nixcraft@mastodon.social]

For those who don't know Meta is behind this OS level age verification stuff so they don't have to implement it within their own apps, like IG, FB, and WhatsApp. They are a truly evil mega corp out there that is pushing this and lobbying for things like age verification, ID verification, and KYC at OS level. They spent so far 2 billion dollars to make this legal thing. https://www.yahoo.com/news/articles/reddit-user-uncovers-behind-meta-154717384.html

[nazokiyoubinbou@urusai.social]

@tezoatlipoca @nixCraft Oh it's absolute crap. I'm not in any way saying it's ok. And I don't think Linux can ever truly be fully compliant either since they generally will require connections to third parties that illegally utilize data they can't utilize and violate every single license that Linux utilizes.

Chances are we're all just going to end up being illegal rebels using an OS that is an OS instead of a spy entity for corporations selling every bit of data they can get.

[mms@mastodon.bsd.cafe]

@nixCraft because they are unable to stop themselves?

[staticr@guild.pmdcollab.org]

@nixCraft Aren't they themselves OS providers with HorizonOS (or whatever their quest VR glasses use)

So they'd STILL have to do it, what irony.

[kb3@mastodon.social]

@koree @nixCraft Our legislature in Alabama just passed one. Hoping it will be found unconstitutional, but our elderly governor's mission is to make Alabama the most conservative state in the US (her own words) so lawmakers are banning stuff and regulating behavior left and right. A little scary how quickly other states are jumping on board with this garbage.

[wxq4987@infosec.exchange]

@nixCraft while the world freaks out this is getting baked in at the OS level, the marketing world is salivating over the fact that every single website on the planet with any form of monetization or advertisement baked in will start hammering this API and tying it set cookies for better retargeting and demographic analysis.

[paul_ipv6@infosec.exchange]

@nixCraft

yup. meta want identity verification for PII collection. nothing to do with protecting kid.

[edcates@mastodon.social]

@echopapa @nixCraft "It's easy bro, it's not on us anyway, bro. If you're worried just fix your stack, bro. We're just the portal, bro."