Store birth date in systemd for age verification(github.com) |
Store birth date in systemd for age verification(github.com) |
I'd like to severely limit the amount of PII on the system.
If California wants to create its own Protect the children operating system, it should bear the cost and responsibility for this alone, and not export any of the sketchy political agenda to the wider open source community.
Just do it.
"There is no justice in following unjust laws." - Aaron Swartz (Guerilla Open Access Manifesto)
> Stores the user's birth date for age verification, as required by recent laws in California (AB-1043), Colorado (SB26-051), Brazil (Lei 15.211/2025), etc.
The Brazilian law does NOT require this. This is a misconception, and likely based on an understanding of California's law being extrapolated to the Brazilian law.
They are almost complete opposites.
The Brazilian law (Lei 15.211/2025) puts the burden of age verification on *providers* of web platforms, app stores, or dumb terminals. Not on operational systems.
It also mentions "reasonable measurements" - which vary according to the type of content, platform, etc - and which are much less strict that anything written in California's or UK's laws regarding the same subject. It is far more based on individual risk assessment and purpose of the platforms themselves.
In all fairness, the Brazilian law is the most friendly to open source and the status quo. Even though I'm also worried about the long term results of this legislation, I'm somewhat relieved by the way it turned out.
Lei № 12.965 (2014) defines a terminal (which applies in Lei 15.211) as any internet-connected computer or device.
However, it is still not the same as California's law since it only describes the provision of "age bracket" and only on particular circumstances. In practice, this requirement will likely be limited to certain platforms due to technical feasibility. Proportionality and "technically secure measurements" are mentioned in the law, so there is no point requiring this from a desktop computer where someone can just type any birth year.
It is likely most of the responsibility will fall on digital platforms:
https://www.brasildefato.com.br/2026/03/27/eca-digital-entra...
https://www.fadc.org.br/noticias/eca-digital-entenda-nova-le...
It's the authors first time contributing to this repo and it the feedback on the PR that was addressed is really odd, like some of it is super basic stuff, even if you're not familiar with the code base or the language.
Just an all round weird vibe.
I’ve seen Claude reproduce nearly identical comments, wonder if that’s a couidence
* LP had zero objections to merging this commit into systemd [1];
* Amutable CEO is confident they have a very robust path to revenue [2];
* It is Facebook that pushes age verification laws all around the world;
I sense that his new startup is exactly what we are afraid of: a way to prevent reverting of these patch and then actually enforce the upcoming mandatory KYC to use the computer.
[1] https://github.com/systemd/systemd/pull/40954#issuecomment-4...
Surely this is a total coincidence.
And not only that, but he engages in communication with people in tickets and ignores all constructive criticism.
Dylan M. Taylor's GH profile claims that he's from Durham, NC (which does not have this law). He also references to a draft to xdg-desktop-portal which has not been accepted. (Add parental controls to the Accounts portal: https://github.com/flatpak/xdg-desktop-portal/pull/1922)
I'm asking:
- What is this guy's personal interest in pushing this through? (It seems non-neccessary and is questionable at what the end goal)
- Who's political agenda is he sponsoring for this?
- Is he getting financially incentivized to do this?
- https://github.com/archlinux/archinstall/pull/4290
- https://gitlab.freedesktop.org/xdg/xdg-specs/-/merge_request...
- https://github.com/canonical/ubuntu-desktop-provision/pull/1...
- https://github.com/canonical/ubuntu-desktop-provision/pull/1... -
This isn't just some guy that's overzealous.
Apparently this has escalated: https://www.reddit.com/r/privacy/comments/1rz8i4r/dylan_usef...
Theres a lot of smoke here.
Off his rocker: https://github.com/canonical/ubuntu-desktop-provision/pull/1...
> This is honestly some of the dumbest false equivalence I've ever read. Entering a birth date (that doesn't even have a check for truthfulness) during account setup when the system is first installed equals returning escaped slaves or turning in jews? I'm actually baffled by this comparison. And no, I don't particularly care about North Korean laws.
as per usual, liberal policy doing the exact opposite thing they claim it does.
This developer should be blacklisted from all open source projects, permanently.
I feel like complying really undermines any first amendment arguments. Software is a first amendment protected form of expression, giving in before getting any actual threats from the state makes your participation seem voluntary.
Systemd's participation puts the entire world into compliance with a California law
As it turns out, the people who warned against “professionalizing” and corporatizing Linux were correct.
And now they are creeping into open source projects too. What once was thought as the bastion of absolute freedom from the state
It is indeed scary is how compliant the open-source projects have become to the "governmental overlords". Where has the hacker spirit gone?
* LP had zero objections to merging this commit into systemd [1];
* Amutable CEO is confident they have a very robust path to revenue [2];
* It is Facebook that pushes age verification laws all around the world;
I sense that his new startup is exactly what we are afraid of: a way to prevent reverting of these patch and then actually enforce the upcoming mandatory KYC to use the computer.
[1] https://github.com/systemd/systemd/pull/40954#issuecomment-4...
But if this becomes a thing in Linux for the distro I use (doubtful), I will abandon Linux after 30+ years.
I am rather confident OpenBSD will ignore this law and I expect other BSDs will to. If not, back to DOS :)
Note, I have a BSD on a coupld of old laptops for testing reasons. I test what I write in the BSDs to help find issues, that works well.
I saw an article that supporting these laws could cost a distro maintainer up to 10000 USD per year. Sadly I lost the link, but the article made a lot of sense to me. So, many small distos cannot afford even 1000/year, I think this law could kill almost all small Linux distros. That will probably leave only RHEL, SUSE and Ubuntu, maybe Debian, but they would need funds donated to them from Ubuntu.
If the distro is in another country like OpenBSD, they could just ignore the law(s). That of course assumes the "other" country does not replicate what is happening in the US.
Right now I am hoping these laws are declared unconstitutional, but to be honest, with support by companies like meta and twitter, I expect we will see a national law sometime in 2027.
So in the US, we could be looking at locked down OS, unless you want to break "the law".
Other, more traditional distros are out there that work fine with GNOME, etc with no problems.
https://github.com/systemd/systemd/pull/40954
Today I realised that Poettering rejected reversion to the age sniffing done in systemd. That is also interesting - he operates like a Microsoft lobbyist.
as always: imho. (!)
idk the exact procedure which will apply to enter the birth-date on such a system, but if other comments are correct: just enter what you want!
there will be no real possibility to tie this to anything "legal" / to "enforce" any "official" check of lets say your passport or other governmental id.
and if in my personal opinion (!) the pretty crazy guy behind the systemd-project tries to introduce/enforce such a thing ...
then i think it'll be time to either fork the project or look at systemd-free linux distributions like devuan ~ a systemd-free fork of debian :)
just my 0.02€
They cannot loose markets, like California or Brazil.
It's entirely optional, I get that. I could 'just' not set anything. Spare your fingers. I want to poison it [or loudly opt out] without a lot of effort. This includes running N commands when a file to could effectively disable the signal.
Said differently: I don't want to configure the portal, I want to ~~break~~ mask it.
Bernstein v. United States set a precedent that has not yet been overturned.
Acquiescing to (however veiled and excused) authoritarian overreach is not the way forward. The correct attitude towards this "Think of the Children but Really Think of the Advertisers' Profits" initiative is to let California (and other proponents) to figure out how they can do business without Linux or any other software that depends on it.
OSS is a bastion of freedom -- real freedom, freedom FROM, not American Freedom (freedom to abuse and exploit others). We must defend it. DO NOT COMPLY.
A few years down the road it might not be.
In late 90s we would have laughed if somebody proposed this was going to be a thing, let alone that linux community will just go with it. Heck, I would not have believed systemd was going to happen.
And yet, here we are.
I am out of the loop: what is so special about 1969 concerning age verification?
That said... an option for 'I could have declared an age/birth date but chose not to' seems preferable. I was talking about poisoning but this could be more productive. Any attestation would reasonably fail, sure, but it sends a potentially-meaningful signal [to someone].
i'm always a fan of 1-JAN-1970
[eg. the "birth" of UNIX-like OSes unix-timestamp eg. "0" ;]
or
date -d @0
cheers a..z
It's one of the reasons I use BSD on my main machine. I think Linux has been infiltrated by big tech way too much.
last i checked thats what their so called "traditional values" and "conservatism" were actually.
That person just isn't you.
It's a way to enforce power relations by making the hardware respect them. From this perspective, it's pretty evident how it degrades adversarial interoperability, which is about ignoring power relations to build your own system.
> Meta spent a record $26.3 million on federal lobbying in 2025, deployed 86+ lobbyists across 45 states, and covertly funded a group called the Digital Childhood Alliance (DCA) to advocate for the App Store Accountability Act (ASAA). But the operation extends beyond Meta.
> The Heritage Foundation funds three of six named DCA coalition organizations, staffs the advocacy pipeline from Capitol Hill to state legislatures, and has merged leadership with another coalition member.
The owner of the computer should decide what the computer does.
California is a soon failed bankrupted US state, and no one outside its borders cares what's going on there. Companies are leaving, people are leaving. Let them sink to the ocean with their idiotic laws.
As someone with children, I see benefits in how age verification will help me manage my kids relationship with technology. Even if it was not the law, I would choose products with support. The point of open source is to allow for both options.
> The idea that age verification in an OS is bad is a niche position by a select few
I am pretty sure that's not true.
Let’s ask IBM.
OK, "I am so old that already lived before the UNIX epoch even started" (or a year which breaks systems that cannot handle times before the UNIX epoch) sounds plausible. :-)
Since this is sd-userdbd we are talking about unless the used backend provides the value it is unset by default. And if you manage your home directory using sd-homed unless you explicitly set it it is also unset by default.
> It's entirely optional, I get that. I could 'just' not set anything.
Why? Telemetry, mainly. I'd rather attestation [or whatever intends to use this] fail and make it apparently deliberate.
There certainly are benefits and they are huge. Like, I can make sure my servers are untampered, I would love that.
Problem is, that technology, once unveiled, will be inevitably used for surveillance. Like, online KYC required to use a computer and you cannot patch this shit out because your Linux build is attested and no banking or government website will let you log in unless remote attestation passes.
Sort of like what they do on Android devices.
But who decides what is untampered and can you still modify stuff yourself. I don't want my servers to be immutable for example. And only be 'allowed' to do what the vendor wants me to.
But anyway, that is not really remote attestation. That is local attestation because you can see it on your own server. It's only remote if it attests to someone else.
And yes exactly, the second point is exactly why I hate remote attestation so much. Hope we can hack around it for a while but eventually they will stick that stuff in hardware, I'm sure. That will make it a lot harder.
That's the endgame, totally.
The failure/assumption of under-13 or whatever, as a result of manipulation, is fine. I'm not actually trying to solution something though, jeez.
I find it more compelling to say, for instance, "x% of our users have chosen not to share their information"... rather than "y% have not set it". This category would almost surely be about as 'useful' (useless) as the 'do not track' header... and a concern for something other than systemd or even the portal (to a degree).