Stores the user's birth date for age verification, as required by recent laws in California (AB-1043), Colorado (SB26-051), Brazil (Lei 15.211/2025), etc. userdb: add birthDate field to JSON user records https://github.com/systemd/systemd/pull/40954

[borrisinabox@fwoof.space]

@nixCraft Everyone is now born on January 01, 1970 at 00:00 UTC. That's just how it is.

[echopapa@social.tchncs.de]

@nixCraft

The answer to the PII issues is hence not restrictions in userdb, the answer is proper app sandboxing. And that even already exists in flatpak! It restricts access to $HOME already, and to userdb too! And that's the way to do it!

Hence, just embrace app sandboxing! And if you come to me and say "hey, I run all my apps without sandboxing, but i want the birthday hidden anyway" then I can only say, your model is really really broken. Fix your security model first, then come back.

[koree@mastodon.ameth.org]

@nixCraft there are several states trying to pass laws that Meta has been lobbying for that require “OS-level age verification”

I think they’re preparing for these to pass.

[echopapa@social.tchncs.de]

@nixCraft

So, I think userdb should reveal the birthday to per-user code, because that per-user code then can consume this and provide a portal or something to properly sandboxed apps that provides a more restrictive api, i.e. age brackets and so on. But that kind of stuff is outside of the scope of systemd, here in systemd we just provide you with a way to maintain the original data, the precise policy enforcement on it must happen in the sandbox."

no comment

[tezoatlipoca@mas.to]

@nazokiyoubinbou @nixCraft

Today I learned that there even IS a linux userdb, even if its only used by systemd.. and wait.. why does systemd need a user db at all? .

Any why can't we just add a /etc/user.info file that is linked to /etc/passwd?
so many questions, this is all so dumb. age verification is so stupid.

[schrotthaufen@mastodon.social]

@nixCraft Because either they’re collaborators, or they’re deluded into thinking tech is a political, or they weren’t thinking at all when implementing this. Oh wait… that’s basically the same thing.

[qwertz@defcon.social]

@echopapa @nixCraft

I stopped listening to Pottetering's “ideas” a long time ago, and I sleep better at night.

[wxq4987@infosec.exchange]

@paul_ipv6 @nixCraft remember when the world revolted against systemd, but we were all told we were overreacting and just whining "because change"?

[nixcraft@mastodon.social]

For those who don't know Meta is behind this OS level age verification stuff so they don't have to implement it within their own apps, like IG, FB, and WhatsApp. They are a truly evil mega corp out there that is pushing this and lobbying for things like age verification, ID verification, and KYC at OS level. They spent so far 2 billion dollars to make this legal thing. https://www.yahoo.com/news/articles/reddit-user-uncovers-behind-meta-154717384.html

[nazokiyoubinbou@urusai.social]

@tezoatlipoca @nixCraft Oh it's absolute crap. I'm not in any way saying it's ok. And I don't think Linux can ever truly be fully compliant either since they generally will require connections to third parties that illegally utilize data they can't utilize and violate every single license that Linux utilizes.

Chances are we're all just going to end up being illegal rebels using an OS that is an OS instead of a spy entity for corporations selling every bit of data they can get.

[mms@mastodon.bsd.cafe]

@nixCraft because they are unable to stop themselves?

[staticr@guild.pmdcollab.org]

@nixCraft Aren't they themselves OS providers with HorizonOS (or whatever their quest VR glasses use)

So they'd STILL have to do it, what irony.

[kb3@mastodon.social]

@koree @nixCraft Our legislature in Alabama just passed one. Hoping it will be found unconstitutional, but our elderly governor's mission is to make Alabama the most conservative state in the US (her own words) so lawmakers are banning stuff and regulating behavior left and right. A little scary how quickly other states are jumping on board with this garbage.

[wxq4987@infosec.exchange]

@nixCraft while the world freaks out this is getting baked in at the OS level, the marketing world is salivating over the fact that every single website on the planet with any form of monetization or advertisement baked in will start hammering this API and tying it set cookies for better retargeting and demographic analysis.

[paul_ipv6@infosec.exchange]

@nixCraft

yup. meta want identity verification for PII collection. nothing to do with protecting kid.

[edcates@mastodon.social]

@echopapa @nixCraft "It's easy bro, it's not on us anyway, bro. If you're worried just fix your stack, bro. We're just the portal, bro."

[ferricoxide@blahaj.zone]

@nixCraft@mastodon.social

…so they don't have to implement it within their own apps…

You underestimate the appeal of forcing would-be marketing-targets reveal even more about themselves. I mean, age-group is a really useful marketing-target.

[via4@mastodon.social]

@nixCraft big companies use malicious compliance in such cases. We, on the other hand, are not pathetic cowards, our response should be direct demonstrative civil disobedience, like ageless Linux does. Parasites who pass such bs into laws should be pushed back and eventually held accountable

[tezoatlipoca@mas.to]

@nazokiyoubinbou @nixCraft

> Chances are we're all just going to end up being illegal rebels using an OS that is an OS

I am ok with this, even if it means (as I suspect it will) we spend too much effort in a battle between our devices/clients and SaaS/platform providers where we constantly break/fool mandated user verification and DRMs, they come up with new ones etc.

All this age verification is gonna do is build a tech.smarter generation who is more confortable getting dity in the bits.

[alanbuxey@freeradical.zone]

@nixCraft why the hell is a tool for managing system processes and handling services needing to care about DoB of user accounts? That should be in user admin or PAM space. Even if its to control whether a service could be run - it should call out to other functions and not capture such data itself.