Re: Questions on DNF's UUID
On Sun, May 2, 2021 at 3:15 PM stan via users
<users(a)lists.fedoraproject.org> wrote:
I think the answer to your question is that the variable is sent to
the mirror, so yes, a mirror will receive the flag. However, they
appear to have gone to great lengths to avoid leaking any
identifiable information. See this link:
https://github.com/rpm-software-management/dnf/pull/1450/commits/24e6fadf...
That's correct. The flag is only sent with a metalink or mirrorlink
request, which is, in case of Fedora, done centrally to the
mirrors.fedoraproject.org (so called MirrorManager) server. The
subsequent requests for the repodata itself sent to a specific mirror
won't include that flag.
There are two pieces of information the countme flag carries:
1) the age of the installation (one of 4 values, see the link above)
2) the fact it's one of the first N metalink requests made that week
from that particular system (i.e. we randomly pick a number from 1 to
N during the first request that week, and then decrement it on every
subsequent request; when it hits 1, we add the countme flag).
Currently, we've hardcoded N to be 4, based on some very rough
estimation of how many requests there usually are on a typical
(workstation) installation throughout a week, but it's quite arbitrary
at the moment.
The goal of 2) was to avoid signaling "hey, look everybody, this is my
first DNF metadata refresh this week", as that alone could indicate
some usage patterns of that system (e.g. when it was booted up) and
thus is, in a way, user-specific. So adding this little randomization
component helps mitigate this. The idea was to minimize any kind of
information leakage with this flag, as Stan puts it.