Ultimately, the problem is much bigger than /etc/machine-id since there are dozens of hardware IDs on any PC that can be used by malicious telemetry to silently to uniquely identify and track you, and the only solution to this problem currently is to make sure you really trust any software you use.
Systemd, in particular, acts a lot like malware for Linux because if you try to reset your machine-id a long list of stuff that breaks in in it. You could make a cron script to reset /etc/machine-id every day, but machine-id is so deep in the stack that you’d also have to reboot to ensure it’s updated.
I’ve already explained repeatedly how systemd goes against core Unix philosophy. Communities can form around all kinds of things, just because a community forms around bad idea that doesn’t mean it should be automatically accepted. Linux did get modular design largely right, that’s the whole problem here. Systemd throws the baby out with the bath water. Monolithic design was basically more convenient for companies trying to monetize the platform.
Systemd has gotten plenty of backlash as well, I’m certainly not the only person who sees the problems with it. The problem is that it’ll keep getting pushed by commercial interests. And the same thing will happen with AI incidentally.
I was agreeing with you. Systemd breaks unix philosophy. You know what else breaks unix philosophy? The Linux kernel. It’s absolutely massive. If you want unix philosophy, switch to a microkernel.
Also another commenter in this discussion pointed out that flatpak does not actually obfuscate machine-id. You can read the issue tracker here: https://github.com/flatpak/flatpak/issues/4311
Basically comes down to a design decisions from 15+ years ago, in things that flatpak depends on. This is an open issue to this day. Would it have been better for flatpak to have delayed release until this was solved, possibly remaining unreleased to this day? Meanwhile everybody would have to use regular system packages, which not only have access to machine-id, but also the entire userspace, with zero sandboxing. I doubt that would be better.
There are microkernels like minix and they work well, but that’s a different animal because user space is where you actually do make changes much more commonly than in the kernel. Also, I don’t really follow your argument regarding flatpack, it’s like you’re implying that containerized apps couldn’t exist without using machine-id for some reason?
I’m saying that if flatpak tried to implemenet machine-id obfuscation before releasing, they might not have ever released. By constraining their scope, they were able to focus on their other goals and release, and a lot of Linux users including me, are glad they did so. You can think of systemd’s machine-id situation in the same way
I’m saying flatpack didn’t even have to use machine-id at all for anything it does. I don’t know why you’re so invested in the idea that this was somehow necessary and nothing better is possible.
Perhaps ask in the github issue I linked earlier why machine-id is necessary at all. They may have their reasons. My guess is that it makes it easier for devs to port their applications to flatpak, namely legacy apps that depended on machine-id.
It probably does, but I suspect they just didn’t consider the problem in the first place rather than the issue being that not having a persistent id is somehow extraordinarily difficult.
You could say the same about Linux itself and machine-id. Fingerprint resistance just wasn’t in the project scope.
You could, but there was no machine-id on Linux originally and it was something that got added and arguably shouldn’t have been. Again, I’m really struggling to understand why you’re so invested in defending this decision. Like it’s obviously a bad decision, it’s not necessary, why is it so hard for you to just say that.