Why not let the administrator decide?

I hate forced password rotation as much as anyone else, but this move seems a bit mad. The "best practices" have altered, as the political sands shift and fashions change, and now the code to implement them has to be removed. Not because it's too much of a burden to maintain, but because somebody, somewhere, has decided this is now the wrong way to configure your system. That decision is just as opaque as the original decision that passwords should be expired periodically. But shadow-utils never forced an administrator to set up password expiration; it only provided the tools to do so, if the sysadmin so chose.

Whether you personally support or oppose password expiration, it's reasonable to suppose that some organizations will have different requirements and make a different choice. And it's not something where you can definitively show a particular choice is wrong (unlike, say, DES password hashing, where you can show that it's easy to crack nowadays). It's not like an Internet RFC, where your implementation has to follow the MUSTs and MUST NOTs in order to work well with others.

The LWN article itself suffers a bit from this omniscient-voice attitude: "Some outdated policies still require password expiration. These policies, which are even required by some countries, are unfortunate." That seems to imply that the USA's NIST must be correct (even though it was wrong previously) and these other countries' policies must be wrong, though they may see the light eventually (as long as NIST hasn't changed its best practices again by then).

I don't want this to turn into one of those cranky systemd posts, but wouldn't it be better to have the infrastructure be mostly policy-neutral, and let the admin decide? At least if the support for expiration is already there and working.