Ultimately, the problem is much bigger than /etc/machine-id since there are dozens of hardware IDs on any PC that can be used by malicious telemetry to silently to uniquely identify and track you, and the only solution to this problem currently is to make sure you really trust any software you use.
Systemd, in particular, acts a lot like malware for Linux because if you try to reset your machine-id a long list of stuff that breaks in in it. You could make a cron script to reset /etc/machine-id every day, but machine-id is so deep in the stack that you’d also have to reboot to ensure it’s updated.
is this something sites can actually query on linux system in most browsers?
for example, if cloudflare is checking if I am a human, are they able to read my machine id if i am using firefox, librewolf, mullvad browser, tor browser, chrome, or chromium?
yup, both Chrome and Firefox expose your machine-id by default
how did you learn about this?
i thought i was aware of privacy but have not heard about this before.
why are open-source operating systems allowing this as a tracking vector?
what is the smart way to reduce tracking by this mechanism?
Just ran across somebody talking about it on a forum. To be clear, having a consistent id can be useful outside of tracking, which is probably why it got introduced, but clearly tracking potential wasn’t considered fully here.