Why not let the administrator decide? [LWN.net]

Why not let the administrator decide?

Posted Aug 10, 2026 11:05 UTC (Mon) by epa (subscriber, #39769)
In reply to: Why not let the administrator decide? by alx.manpages
Parent article: Changes in shadow-utils password-expiration features

Thanks for the explanation -- it does sound like a useful cleanup.

I don't disagree that forced password rotation is usually a bad idea. But it was a bad idea ten years ago too. Some organizations implemented it, not because they had decided for themselves that it was useful, but because policies and "best practices" mandated it. In some countries those policies still exist, so password rotation may still be needed, even though it's still just as useless as it was a decade ago.

I think the change could better have been framed as "this is a lot of crusty code, which previously had to be there because policies mandated it, even though everyone agrees it's a silly idea -- and now the policies have changed we can finally remove it".

to post comments

Why not let the administrator decide?

Posted Aug 10, 2026 11:42 UTC (Mon) by alx.manpages (subscriber, #145117) [Link] (1 responses)

> Thanks for the explanation -- it does sound like a useful cleanup.

:-)

> But it was a bad idea ten years ago too.

Research still didn't exist. While it was known it was bad, scientific research is relatively recent. Also, considering that science takes time, it's reasonable to let some years pass until some scientific research is considered solid.

Another thing is that I wasn't maintaining shadow-utils 10 years ago. :)

> I think the change could better have been framed as "this is a lot of crusty code, which previously had to be there because policies mandated it, even though everyone agrees it's a silly idea -- and now the policies have changed we can finally remove it".

A problem is that most policies still have not changed (including the one from my country). If we waited for that to happen first, I expect we couldn't remove the code in this century.

This change is more in the lines of forcing policies to change. This is more or less the frame:

"""
Password expiration is undoubtedly bad, and since the code is really hard to maintain, we don't feel like doing that anymore. Existing policies are immediately coerced into removing password expiration, and if they don't, they'll have to 1) start looking for other software (or fork), and 2) start justifying their existence (or users will start complaining seriously).

We'll provide a grace period of a few (unspecified) years, but it might be as short as 1 year or 2. That's essentially the time it will take us to review these patches carefully.
"""

Why not let the administrator decide?

Posted Aug 10, 2026 16:27 UTC (Mon) by rgmoore (✭ supporter ✭, #75) [Link]

A problem is that most policies still have not changed (including the one from my country).

And even in places where the official recommendation has changed, a lot of the organizational policies haven't caught up. My USA-based employer is still requiring password rotation even though our government now says it's a bad idea. We all know it takes a long time for best practices to move from the bleeding edge to common use, so it's no surprise that best security practices are the same way. Using technology to force those best practices is an interesting approach.