9 ms·

I don't like the idea of a persistent id for my machine. Would there be any harm in rewriting the machine-id at every boot? Or just deleting it as part of the s

I don't like the idea of a persistent id for my machine. Would there be any harm in rewriting the machine-id at every boot? Or just deleting it as part of the shutdown sequence?

gcr 2mo ago
The supported method to get a new one each boot is to truncate the file to 0 bytes and disable systemd-machine-id-commit.service Double-check that this method actually works though. Machine ID is used for things like dhcp leases, log rotation, etc. IPV6 addresses or transient MAC addresses are derived from it
- inigyou 2mo ago
  I thought the kernel generated SLAAC addresses based on MAC and privacy addresses based on random numbers.
  - tremon 2mo ago
    It does, but DHCPv6 prescribes a persistent device identifier (DUID): https://www.rfc-editor.org/info/rfc9915/#RFC3315-9 https://www.rfc-editor.org/info/rfc9915/#RFC3315-9 The DUID is designed to be unique across all DHCP clients and servers, and stable for any specific client or server. That is, the DUID used by a client or server SHOULD NOT change over time if at all possible; for example, a device's DUID should not change as a result of a change in the device's network hardware or changes to virtual interfaces
xeyownt 2mo ago
Whatever you do there will always be uniquely identifiable information (if not an id, a fingerprint) on your machine. If you want to escape that, you have to use dedicated privacy-enhancing tools / browsers, but even then, it's very likely that you can still be identified by motivated adversaries. It doesn't mean you have to give up, but, if such id is necessary for technical reasons in systemd (I guess it is), I wouldn't worry too much.
- Eddy_Viscosity2 2mo ago
  > motivated adversaries. This sounds like you're referring to state actors and intelligence agencies, but really this applies to the entire advertising/surveillance industry of people trying to sell you a new flavor of soda.
  - xeyownt 2mo ago
    Sure, but the problem then is not systemd machineid, but rather the browser reading it and making it available for such identification (don't know if there is a browser out there doing that though). Unless anonymization is provided by your browser, there is nothing you can do to prevent such identification technology run by these advertisers to build your profile, and send you targeted ads.
    - close04 2mo ago
      > Unless anonymization is provided by your browser, there is nothing you can do to prevent such identification technology The OS could treat certain apps as untrusted and spoof or limit the access to these unique identifiers.
      - ygjb 2mo ago
        That puts the OS in the position of attempting to profile or determine if an application is accessing OS, hardware, and user details to build a fingerprint, vs using those capabilities to do something the user intends, which puts the OS developer into a performance sucking, soul sucking arms race against big and little brother surveillance/advertising platforms. I absolutely support the intention, just know that it's a brutal battle :(
        close04 2mo ago
        The OS already does this for a living. A set of identifiers requested sporadically by an app can’t be what breaks its back. Isn’t iOS already doing something similar?
layla5alive 2mo ago
dhcp uses it by default nowadays.. but you can tell dhcp to use your mac address instead (like it used to).. https://askubuntu.com/questions/1498611/ubuntu-dhcp-client-uses-ids-instead-of-mac-addresses-cant-change-this-behavior https://askubuntu.com/questions/1498611/ubuntu-dhcp-client-u... (linked because depending on version, there are several different ways to make this change..)
floralhangnail 2mo ago
I do it with an hourly cronjob and haven't noticed any ill effects.
9029 2mo ago
You can replace it with a generic one to hopefully blend in https://madaidans-insecurities.github.io/guides/linux-hardening.html#machine-id https://madaidans-insecurities.github.io/guides/linux-harden...
TobTobXX 2mo ago
Only side effect I ran into is that journalctl couldn't find the logs of a previous boot.
- tremon 2mo ago
  wow... that implies that you can't use journalctl from a rescue environment to access the logs of the host system? Sounds like real genius design.

I don't like the idea of a persistent id for my machine. Would there be any harm in rewriting the machine-id at every boot? Or just deleting it as part of the shutdown sequence?

gcr 2mo ago

The supported method to get a new one each boot is to truncate the file to 0 bytes and disable systemd-machine-id-commit.service Double-check that this method actually works though. Machine ID is used for things like dhcp leases, log rotation, etc. IPV6 addresses or transient MAC addresses are derived from it

inigyou 2mo ago
I thought the kernel generated SLAAC addresses based on MAC and privacy addresses based on random numbers.
- tremon 2mo ago
  It does, but DHCPv6 prescribes a persistent device identifier (DUID): https://www.rfc-editor.org/info/rfc9915/#RFC3315-9 https://www.rfc-editor.org/info/rfc9915/#RFC3315-9 The DUID is designed to be unique across all DHCP clients and servers, and stable for any specific client or server. That is, the DUID used by a client or server SHOULD NOT change over time if at all possible; for example, a device's DUID should not change as a result of a change in the device's network hardware or changes to virtual interfaces

xeyownt 2mo ago

Whatever you do there will always be uniquely identifiable information (if not an id, a fingerprint) on your machine. If you want to escape that, you have to use dedicated privacy-enhancing tools / browsers, but even then, it's very likely that you can still be identified by motivated adversaries. It doesn't mean you have to give up, but, if such id is necessary for technical reasons in systemd (I guess it is), I wouldn't worry too much.

Eddy_Viscosity2 2mo ago
> motivated adversaries. This sounds like you're referring to state actors and intelligence agencies, but really this applies to the entire advertising/surveillance industry of people trying to sell you a new flavor of soda.
- xeyownt 2mo ago
  Sure, but the problem then is not systemd machineid, but rather the browser reading it and making it available for such identification (don't know if there is a browser out there doing that though). Unless anonymization is provided by your browser, there is nothing you can do to prevent such identification technology run by these advertisers to build your profile, and send you targeted ads.
  - close04 2mo ago
    > Unless anonymization is provided by your browser, there is nothing you can do to prevent such identification technology The OS could treat certain apps as untrusted and spoof or limit the access to these unique identifiers.
    - ygjb 2mo ago
      That puts the OS in the position of attempting to profile or determine if an application is accessing OS, hardware, and user details to build a fingerprint, vs using those capabilities to do something the user intends, which puts the OS developer into a performance sucking, soul sucking arms race against big and little brother surveillance/advertising platforms. I absolutely support the intention, just know that it's a brutal battle :(
      - close04 2mo ago
        The OS already does this for a living. A set of identifiers requested sporadically by an app can’t be what breaks its back. Isn’t iOS already doing something similar?

layla5alive 2mo ago

dhcp uses it by default nowadays.. but you can tell dhcp to use your mac address instead (like it used to).. https://askubuntu.com/questions/1498611/ubuntu-dhcp-client-uses-ids-instead-of-mac-addresses-cant-change-this-behavior https://askubuntu.com/questions/1498611/ubuntu-dhcp-client-u... (linked because depending on version, there are several different ways to make this change..)

floralhangnail 2mo ago

I do it with an hourly cronjob and haven't noticed any ill effects.

9029 2mo ago

You can replace it with a generic one to hopefully blend in https://madaidans-insecurities.github.io/guides/linux-hardening.html#machine-id https://madaidans-insecurities.github.io/guides/linux-harden...

TobTobXX 2mo ago

Only side effect I ran into is that journalctl couldn't find the logs of a previous boot.

tremon 2mo ago
wow... that implies that you can't use journalctl from a rescue environment to access the logs of the host system? Sounds like real genius design.