Why not let the administrator decide?

:-)

> But it was a bad idea ten years ago too.

Research still didn't exist. While it was known it was bad, scientific research is relatively recent. Also, considering that science takes time, it's reasonable to let some years pass until some scientific research is considered solid.

Another thing is that I wasn't maintaining shadow-utils 10 years ago. :)

> I think the change could better have been framed as "this is a lot of crusty code, which previously had to be there because policies mandated it, even though everyone agrees it's a silly idea -- and now the policies have changed we can finally remove it".

A problem is that most policies still have not changed (including the one from my country). If we waited for that to happen first, I expect we couldn't remove the code in this century.

This change is more in the lines of forcing policies to change. This is more or less the frame:

"""
Password expiration is undoubtedly bad, and since the code is really hard to maintain, we don't feel like doing that anymore. Existing policies are immediately coerced into removing password expiration, and if they don't, they'll have to 1) start looking for other software (or fork), and 2) start justifying their existence (or users will start complaining seriously).

We'll provide a grace period of a few (unspecified) years, but it might be as short as 1 year or 2. That's essentially the time it will take us to review these patches carefully.
"""