Ok, after some extensive googling I found the solution in the end:

In the following thread on the linux.debian.user newsgroup a Debian user asked the same question 4 years ago:
https://groups.google.com/g/linux.debia … lSllKEIUVk

After lots of trial and error he finds the solution, it's XFCE starting up both ssh-agent and gpg-agent and annoyingly this is not exposed in the "Session and Startup" GUI config tool of XFCE where I had already looked, it requires using xfconf-query to disable:
https://docs.xfce.org/xfce/xfce4-sessio … gpg_agents

I can confirm that running the following two commands (as indicated in the above XFCE docs link) prevents ssh-agent and gpg-agent from being started automatically by XFCE:

xfconf-query -c xfce4-session -p /startup/ssh-agent/enabled -n -t bool -s false
xfconf-query -c xfce4-session -p /startup/gpg-agent/enabled -n -t bool -s false

@rolfie What is that command supposed to do, I get no output from it?

I do have the openssh-client package installed (/usr/bin/ssh-agent is included in this package) and I use ssh all the time, but I have no use for ssh-agent.

The ssh-agent weakens ssh security and can be a real security risk:
https://medium.com/@bornaly/why-i-alway … c52573fa2f

@greenjeans in this thread I would like to find out what starts them in the first place so that I can disable them, I can always re-enable them once I know how to disable them (in case I need them).

Without providing as much detail as possible (for the first one exact sequence of commands used and for the second one screenshots and links of the downloads, in addition to the devuan version you are running) you won't get any real answers as your problem description is way too vague for that.

This X server will trigger the Rust crowd, assembler means no safety nets of any kind, not just no memory safety!

I sort of solved this by adding the xhost commands I need in the XFCE configuration under "Session and Startup" -> "Application Autostart" as a 'program' to be run on login.

It works fine but I don't consider it an ideal solution as it's DE specific.

Surely there must be a generic DE-independent X11 config file where I could put these 'xhost' commands so that they run on login?
(I did also try .xinitrc in my home directory but that is ignored)

BTW, I already tried creating /etc/X0.hosts with relevant entries (see below) as indicated in the xhost manpage but that doesn't seem to have any effect.

$ more /etc/X0.hosts
+SI:localuser:username1
+SI:localuser:username2

Those methods (especially method 2 and 3) open you up to identity theft, as anyone who gets hold of a copy of your ID can then themselves use it to register on other sites pretending to be you (or they can resell the collected copies to people who then abuse them).

Rule number one to avoid identity theft is never give anyone a copy of your ID, only show your ID in person where strictly necessary without allowing them to make an actual copy of it.

Hmm, I had never heard of ranger before but a glance at the description on the home page turned me off straight away because of this: "file manager with VI key bindings".
No thanks, while I do occasionally use vi(m) (I had to use vi when I was working on Solaris / HP-OS / AIX servers) I'm not a fan of its key bindings and only know the basic ones so ranger is not for me.

Like Altoid said, mc is inspired by Norton Commander and that's what I was using on MS DOS / Win 3.1 before switching to Linux in the mid 90s so that's what I prefer.

Any date you choose will be a persistent parameter that will allow fingerprinting and therefore together with other parameters tracking you.

The only date of birth that would avoid this is one that gets randomly generated each time it's requested (or at least at each reboot), so it's never the same date.

But it should be obvious to anyone that the current legislation is only an initial  stepping stone since the date can be faked easily, within a year or two the laws will be changed to allow only verified dates that are cryptographically signed by some authority so that you can no longer fake it.

This is only to get people used to the idea, so they can expand upon it in the coming years. Classic boiling the frog slowly strategy.

I'm not surprised that they would do that since systemd is essentially a corporate IBM/Redhat project and corporations of course will comply (corporations seem to be the drivers behind this anyway, I guess the ultimate aim is that doing anything on the internet without a verified ID tied to some government issued digital ID will be impossible, basically cinese-style total surveillance and social scoring...).

The problems for us without systemd will start when applications such as Firefox will start depending on systemd for this and possibly refuse to work without it ...

That will mean either patching these apps or creating something equivalent outside systemd to comply.

I would rather stop using the internet (or at least anything I can't access without this crap) than comply.

BTW, for those more interested in removing any age tracking and compliance software from their installs which some distros are already discussing and implementing the following initiative has been started:
https://github.com/AntiSurv/oss-anti-surveillance