Ultimately, the problem is much bigger than /etc/machine-id since there are dozens of hardware IDs on any PC that can be used by malicious telemetry to silently to uniquely identify and track you, and the only solution to this problem currently is to make sure you really trust any software you use.
Systemd, in particular, acts a lot like malware for Linux because if you try to reset your machine-id a long list of stuff that breaks in in it. You could make a cron script to reset /etc/machine-id every day, but machine-id is so deep in the stack that you’d also have to reboot to ensure it’s updated.
There are microkernels like minix and they work well, but that’s a different animal because user space is where you actually do make changes much more commonly than in the kernel. Also, I don’t really follow your argument regarding flatpack, it’s like you’re implying that containerized apps couldn’t exist without using machine-id for some reason?
I’m saying that if flatpak tried to implemenet machine-id obfuscation before releasing, they might not have ever released. By constraining their scope, they were able to focus on their other goals and release, and a lot of Linux users including me, are glad they did so. You can think of systemd’s machine-id situation in the same way
I’m saying flatpack didn’t even have to use machine-id at all for anything it does. I don’t know why you’re so invested in the idea that this was somehow necessary and nothing better is possible.
Perhaps ask in the github issue I linked earlier why machine-id is necessary at all. They may have their reasons. My guess is that it makes it easier for devs to port their applications to flatpak, namely legacy apps that depended on machine-id.
It probably does, but I suspect they just didn’t consider the problem in the first place rather than the issue being that not having a persistent id is somehow extraordinarily difficult.
You could say the same about Linux itself and machine-id. Fingerprint resistance just wasn’t in the project scope.
You could, but there was no machine-id on Linux originally and it was something that got added and arguably shouldn’t have been. Again, I’m really struggling to understand why you’re so invested in defending this decision. Like it’s obviously a bad decision, it’s not necessary, why is it so hard for you to just say that.