Fedora Planning A Per-System Unique Identifier For DNF To Count Users

[Danny3]

Did you not read the linked wiki page?


Funny how people are complaining on a site that uses unique trackers.

No, I didn't see the link and in any case I don't have the time to read "It's for your own good or we cannot make good software without racking you" bullshit.
About the second line, if you're talking about Phoronix, it's unfortuanate but understandable that Michael need to make money somehow, even by using these giant trackers.

[SofS]

The problem with this idea is that it increases the attack surface by creating a new type of identity related information. Worst, it is of a persistent type, that is, were this information to leak it could be used to mine data already collected elsewhere, creating new correlations.

On top of that, this is an innocuous solution, any large enough deployer will have its own mirror, even many users may not be using an official mirror, particularly in areas with bad extranet connection.

[Anvil]

Hehe. Imagine if Canonical made a announcement like this, using the exact same words...

Also, how much more precision they need anyway? If you have people downloading certain key packages (like kernel security updates), that seems pretty precise to me. If they need to track every single active user of their distro, it makes me rise a eyebrow.

CanonicaL use a NTP server instead to get the count of installations

[msseufert]

What people think about his is really less important than "what actual Fedora users think about this." Now one could argue that it might prevent additional users from using it, and that at least has some merit (how much is debatable), but Ubuntu users getting up in arms over what Fedora is doing makes little sense.

Let's not forget that Fedora was also the first major distro to implement systemd. My point is that any feature added to a major distro will propagate to others, especially when such distros are the base for other users re-spins. So it makes perfect sense.

[skeevy420]

So what ?
If I don't want to be tracked, of course I don't want to be accurately tracked either.
I I lend a book or a car that I bought to a friend, it's not the manufacturer business to know to whom or how many people I'm lending that thing.
Just because it's a sofware product, it doesn't mean that me and my friend need to be tracked on every usage of that product.
What's left to do, put tracking code in every source code available because we don't know who and how many compiles it ?

I see that a lot of companies made good software without any tracking, but now no, you can't even write 'Hello world!' without some user tracking.
Every bullshit company is jumping on the tracking and datacollection bandwagon.
I'm waiting now on the GDPR v2 to cut this crap.

Statistics does not equal tracking. Like I stated in my first post here, I'd like to be able to share my hardware, OS, packages used, etc in a manner that does not collect unique personal information -- statistics that would help developers know what architectures are more used and more prominent, what packages people do and don't use....basically most of the crap Steam surveys cover, only with an open source program that shares its information with a server that any person or company can review.

I'm thinking of a tool that would be like the PTS only it gets a list of packages/programs used, kernel modules loaded, in a chroot/VM/etc, OS, hardware, drivers, desktop environment, if things like Start8/Start10 are being used...nothing that would identify an individual person or user but could help developers know what is trending, what to target, what people are using.

I imagine distributions like Antergos or Manjaro would like to know which desktop is the most popular without having to guess at it by using inaccurate metrics like website surveys, counting package downloads, counting forum posts under desktop specific sections, etc. They'd be able to go look at the open database and see the XFCE version is the most used, 7 people reported using the Enlightenment version, 95% reported using Wine with git versions of DXVK...and seeing that combined with a lot of Wine+DXVK forum problems might help them decide to start a wine-dxvk package that automatically sets up Wine and DXVK...for bigger distributions and organizations it could mean deciding to start projects like rust, wayland, or systemd.

[mulenmar]

....basically most of the crap Steam surveys cover, only with an open source program that shares its information with a server that any person or company can review.

And which ACTUALLY TRIGGERS, lol.

...for bigger distributions and organizations it could mean deciding to start projects like rust, wayland, or systemd.

Rust, good. Wayland, good if devs wouldn't capitulate to nVidia's attempt to lock the new systems into using their driver (if you have to target EGLstreams, are you really going to want to put in work for anything else?). SystemD -- are you TRYING to get lynched?

I jest, I jest.

[F.Ultra]

So what ?
If I don't want to be tracked, of course I don't want to be accurately tracked either.
I I lend a book or a car that I bought to a friend, it's not the manufacturer business to know to whom or how many people I'm lending that thing.
Just because it's a sofware product, it doesn't mean that me and my friend need to be tracked on every usage of that product.
What's left to do, put tracking code in every source code available because we don't know who and how many compiles it ?

I see that a lot of companies made good software without any tracking, but now no, you can't even write 'Hello world!' without some user tracking.
Every bullshit company is jumping on the tracking and datacollection bandwagon.
I'm waiting now on the GDPR v2 to cut this crap.

This is counting and not tracking. And they are not even counting "your usage" aka there will not be a post at the Evil Fedora HQ no-sql database with "Danny3: downloaded xterm 33 times".

[F.Ultra]

The problem with this idea is that it increases the attack surface by creating a new type of identity related information. Worst, it is of a persistent type, that is, were this information to leak it could be used to mine data already collected elsewhere, creating new correlations.

On top of that, this is an innocuous solution, any large enough deployer will have its own mirror, even many users may not be using an official mirror, particularly in areas with bad extranet connection.

There is nothing that this adds that you could not already do with say "ip addr show | grep ether | sort | uniq" considering how infrequently people changes nic:s. Totally with you regarding local mirrors though.

[SofS]

There is nothing that this adds that you could not already do with say "ip addr show | grep ether | sort | uniq" considering how infrequently people changes nic:s. Totally with you regarding local mirrors though.

There is in that this will be information that is going to be transmitted elsewhere. Your example is local.

[finalzone]

Personally, as long as the tool is open to make it clear that actual personal identification data isn't used or taken I don't think these are that big of a deal, especially if opt-out by default or if given as a clear and obvious option in installation media.

I'd actually like a distribution agnostic method of reporting our system specs, hardware configuration, OS used, etc; provided it was an open source tool that doesn't try to obtain personal user data.

Something like linux-hardware.org
Definitely needed to improve the whole Linux ecosystem hardware wise.