On 04/04/2016 03:26 PM, Richard Stallman wrote:
> I think url should do what IceCat does: send a user-agent string that
> is widely encountered on the net, to thwart identification of users.

Does it really do that? Where is it documented?
On my machine, it seems to consistently send "Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox/38.0".

In any case, I don't think this point is relevant to the package.el part of this discussion. It's trivial for GNU ELPA and GNU MELPA to track their users: they can just serve arbitrary code that Emacs will blindly run. Thus, if you don't trust them enough to send them your version of Emacs, then you probably shouldn't be talking to them in the first place.