5 ms·

You can easily deny location data to games and people that are concerned about these apps will not share their location lightly. I have no app on my iPhone wit

You can easily deny location data to games and people that are concerned about these apps will not share their location lightly. I have no app on my iPhone with the ability to use my location in the background, not even Waze or Google Maps. Also I don't care about deletion policies. That data should not be collected in the first place. I don't know about any specifics, but if the data isn't anonymized somehow, on the client side, such that the government can never trace it back to you, then I'd rather catch the virus personally. I agree about turning the angry mob mode off, but in times of crisis we would do well to remember that our freedoms are being traded for a little security and in many cases it isn't temporary. And Australia in particular doesn't have a good track record in preserving those freedoms. Therefore it isn't unreasonable to ask for source code. This isn't even about the GPL, people need the ability to review the code, especially if it's a public service paid by taxpayers. In my opinion such projects should be developed in the open, always.

mcannon 7y ago
Did you know that on iOS it doesn’t even ask for location, and on Android that’s required for Bluetooth? The source code will show you what is done with that (as others who have decompiled it already have shown it doesn’t use the location anywhere). You can choose to get the virus - but that’s a pretty silly choice IMHO. And if you do, please stay home and don’t give it to anyone else.
- NewLogic 7y ago
  This is more a stand on principles against governments rather than if the app is actually malicious in nature. People are rightly making a stand that a project of this nature should require at the bare minimum for source code to release concurrently with protection laws. Blame successive governments if individuals aren't overly welcoming to putting their blind faith in promises of a government that has let them down in the past.
  - lysp 7y ago
    Exactly this. The Aus Gov - especially the current one is massively lacking in trust. Encryption laws, metadata laws. Scope creep on metadata access (ie local councils, horse racing bodies). Lack of transparent reporting when these laws are in use. Raids on journalists. Not to mention their lack of transparency over bushfires, sports grants, angus taylor's family connections with mining / paying $90m? for water to associated company. Ministers failing to declare gifts granted by airlines because they fell into previous parliament and not current one. Climate change vs mining interests. Loading the grid management team so they simply push renewables down the road instead of taking action to get wind/solar take up. Marking spin vs real substance in every single press conference from all the top federal ministers. The PM waiting for states to take charge of quarantine measures so he didn't get the blame for bringing those in (and get bad PR) early in the covid-19 crisis before we knew how bad it was. School closures. Ruby Princess. So after all that they want to trust us with an privacy breaching app because it's the right thing to do? I wouldn't install a hello-world built by current government even if my life depended on it.
    - NewLogic 7y ago
      To put it in words they will understand "Nothing to hide, nothing to fear"
    - pfortuny 7y ago
      You may be right (probably are, as I am from Spain). But you should not focus on this specific government: the dangers of overstepping are great whatever the color or the chirality or even the deeds of a government.
      - FridgeSeal 7y ago
        On the contrary o think we should very much be focusing g on this government: Peter Dutton in particular has pushed repeatedly for increasingly authoritarian measures. I’m super cautious about handing over data or enabling him at all.
      - eskaytwo 7y ago
- deleted 7y ago
  [deleted]
- godelski 7y ago
  > You can choose to get the virus - but that’s a pretty silly choice IMHO. And if you do, please stay home and don’t give it to anyone else. I don't think this is unreasonable. Most people on HN are under 65 and thus will only get mild symptoms and likely just be out for a few days. Considering we're all probably working remotely, it is also easy to not infect others. Alternatively, a government overreach can last decades and these typically compound. This is a classic marshmallow now or two later problem. So a few days to a week of being pretty sick vs potential government overreach? IMO it seems silly not to take the sick days (if we're assuming gov overreach).
  - Fargren 7y ago
    > Most people on HN are under 65 and thus will only get mild symptoms and likely just be out for a few days. This is the most likely case for people how are not vulnerable, but by no means a sure thing. Plenty of people without preexisting conditions have died or had to be hospitalized for days or weeks. Data is a bit difficult to filter, but as an example 4.5% of deaths in NY are from the 18-44 age group[1]. Presumably a large fraction of those were not vulnerable, or not aware that they were. The fatality rate in that group is somewhere between 0.2% and 0.4%. You are not likely to die, but those are not chances to take without a second thought. [1]https://www.worldometers.info/coronavirus/coronavirus-age-sex-demographics/ https://www.worldometers.info/coronavirus/coronavirus-age-se...
    - ACow_Adonis 7y ago
      Understand I'm replying not because I think people should necessarily want/try to infect themselves with the virus, but because I'm against spreading misinformation and a misuse of statistics. Australia is approaching 100 deaths and has several thousand confirmed cases through more widespread testing than new York, doing so at a higher and wider rate than New York who's stats/testing and medical regime show signs of severe failure/ problems. Australia is yet to record a covid death under 40, and the one we have under 50 was technically a foreigner on a cruise ship. All evidence from sources I'm familiar with that include widespread testing, good statistics and a healthy population point to a sub 0.2% for healthy young (young defined as sub 40 say, no comorbidities). Now that being said, what I have seen repeatedly is a misclassification of sedentary young people with worrying lifestyle choices (think overweight/ smokers) as thinking of themselves as healthy with no comorbidities. Especially in some parts of the US, you can't think of yourself as healthy just because you live/look like everyone else. And obviously, death rates in individual parts of the world will tend to be a function of age distribution, underlying health conditions, medical access, communication and the ability to rest and recuperate. I personally wouldn't infect myself (the same way I wouldn't ride a motorcycle as my chosen mode of transport), but the relative risks and who the disease targets with mortalities should be better understood, and I'm not supportive of propaganda telling young people they're comparably at risk. They aren't.
- healsjnr1 7y ago
  You've really lost me with > You can chose to get the virus That wasn't your original argument and this does nothing to stop individual people getting the virus. And the source code is worth nothing. The legal structure is already there to have the app changed without anyone being notified. If they released an entire buildable set of source that I could use to build and install the app myself, maybe. But that's about the only time I'd use this.
  - chii 6y ago
    do you make the same requirement of all software you are using? If not, why would this particular one be differently treated? Location tracking is indeed a dangerous piece of information. But in the short time that the gov't had to face the issue, the best option is to do this tracking to re-enable the economy. Until proven otherwise, it would be wise to not assume there's already malware. I'm not saying there isn't, but given the probabilities, it's unlikely, while the health and economic benefits are high. And the source code is going to be released. It's easy (for a professional software engineer) to track down changes to the original code if they released a bad/altered version of the source that doesn't match the released version. And there'd be a track record, and it will be plainly obvious. I would be much more scared of the unknown apps from dodgy shops that offer their apps for free in exchange for all your contacts, file and camera access.
    - hamlsandwich 6y ago
      > why would this particular one be differently treated? - Because the issuer has vastly more ability to use the app and the data it might collect in ways that impact you. - Because it's the first app of this kind and scale being issued by the government in Australia. - Because it's being pushed onto as much of an entire population as possible with great urgency, limiting the time and opportunity for proper precautions to be taken. - Because the issuer has an objectively _terrible_ track record on technology and privacy related matters. - Because the ratchet effect means that once granted, privileges are highly unlikely to be ever rolled back. > I would be much more scared of the unknown apps from dodgy shops You shouldn't be. No matter how bad an adware mobile game is, the publisher can't put you in jail.
- justatdotin 7y ago
  how does running the app stop you from getting the virus?
  - crypto2me 6y ago
    It doesn’t
mickotron 6y ago
CovidSafe is based off OpenTrace which is GPLv3. The Aus govt have to release the code. They said they would 2 weeks after the launch of the app. I have reviewed the client side source code for OpenTrace. It doesn't store location information. Also, read the BlueTrace whitepaper, it will answer a lot of questions you might have. The data is anonymised. You are identified by a TempId that is changed every 15 mins, that is based on your UserId and some other data (see white paper). If someone were to decrypt this value, it would reveal your UserId, but not your phone number. The attacker would need access to the server side storage to gain this information, as I believe the client side does not store this.

mcannon 7y ago

Did you know that on iOS it doesn’t even ask for location, and on Android that’s required for Bluetooth? The source code will show you what is done with that (as others who have decompiled it already have shown it doesn’t use the location anywhere). You can choose to get the virus - but that’s a pretty silly choice IMHO. And if you do, please stay home and don’t give it to anyone else.

NewLogic 7y ago
This is more a stand on principles against governments rather than if the app is actually malicious in nature. People are rightly making a stand that a project of this nature should require at the bare minimum for source code to release concurrently with protection laws. Blame successive governments if individuals aren't overly welcoming to putting their blind faith in promises of a government that has let them down in the past.
- lysp 7y ago
  Exactly this. The Aus Gov - especially the current one is massively lacking in trust. Encryption laws, metadata laws. Scope creep on metadata access (ie local councils, horse racing bodies). Lack of transparent reporting when these laws are in use. Raids on journalists. Not to mention their lack of transparency over bushfires, sports grants, angus taylor's family connections with mining / paying $90m? for water to associated company. Ministers failing to declare gifts granted by airlines because they fell into previous parliament and not current one. Climate change vs mining interests. Loading the grid management team so they simply push renewables down the road instead of taking action to get wind/solar take up. Marking spin vs real substance in every single press conference from all the top federal ministers. The PM waiting for states to take charge of quarantine measures so he didn't get the blame for bringing those in (and get bad PR) early in the covid-19 crisis before we knew how bad it was. School closures. Ruby Princess. So after all that they want to trust us with an privacy breaching app because it's the right thing to do? I wouldn't install a hello-world built by current government even if my life depended on it.
  - NewLogic 7y ago
    To put it in words they will understand "Nothing to hide, nothing to fear"
  - pfortuny 7y ago
    You may be right (probably are, as I am from Spain). But you should not focus on this specific government: the dangers of overstepping are great whatever the color or the chirality or even the deeds of a government.
    - FridgeSeal 7y ago
      On the contrary o think we should very much be focusing g on this government: Peter Dutton in particular has pushed repeatedly for increasingly authoritarian measures. I’m super cautious about handing over data or enabling him at all.
    - eskaytwo 7y ago
deleted 7y ago
[deleted]
godelski 7y ago
> You can choose to get the virus - but that’s a pretty silly choice IMHO. And if you do, please stay home and don’t give it to anyone else. I don't think this is unreasonable. Most people on HN are under 65 and thus will only get mild symptoms and likely just be out for a few days. Considering we're all probably working remotely, it is also easy to not infect others. Alternatively, a government overreach can last decades and these typically compound. This is a classic marshmallow now or two later problem. So a few days to a week of being pretty sick vs potential government overreach? IMO it seems silly not to take the sick days (if we're assuming gov overreach).
- Fargren 7y ago
  > Most people on HN are under 65 and thus will only get mild symptoms and likely just be out for a few days. This is the most likely case for people how are not vulnerable, but by no means a sure thing. Plenty of people without preexisting conditions have died or had to be hospitalized for days or weeks. Data is a bit difficult to filter, but as an example 4.5% of deaths in NY are from the 18-44 age group[1]. Presumably a large fraction of those were not vulnerable, or not aware that they were. The fatality rate in that group is somewhere between 0.2% and 0.4%. You are not likely to die, but those are not chances to take without a second thought. [1]https://www.worldometers.info/coronavirus/coronavirus-age-sex-demographics/ https://www.worldometers.info/coronavirus/coronavirus-age-se...
  - ACow_Adonis 7y ago
    Understand I'm replying not because I think people should necessarily want/try to infect themselves with the virus, but because I'm against spreading misinformation and a misuse of statistics. Australia is approaching 100 deaths and has several thousand confirmed cases through more widespread testing than new York, doing so at a higher and wider rate than New York who's stats/testing and medical regime show signs of severe failure/ problems. Australia is yet to record a covid death under 40, and the one we have under 50 was technically a foreigner on a cruise ship. All evidence from sources I'm familiar with that include widespread testing, good statistics and a healthy population point to a sub 0.2% for healthy young (young defined as sub 40 say, no comorbidities). Now that being said, what I have seen repeatedly is a misclassification of sedentary young people with worrying lifestyle choices (think overweight/ smokers) as thinking of themselves as healthy with no comorbidities. Especially in some parts of the US, you can't think of yourself as healthy just because you live/look like everyone else. And obviously, death rates in individual parts of the world will tend to be a function of age distribution, underlying health conditions, medical access, communication and the ability to rest and recuperate. I personally wouldn't infect myself (the same way I wouldn't ride a motorcycle as my chosen mode of transport), but the relative risks and who the disease targets with mortalities should be better understood, and I'm not supportive of propaganda telling young people they're comparably at risk. They aren't.
healsjnr1 7y ago
You've really lost me with > You can chose to get the virus That wasn't your original argument and this does nothing to stop individual people getting the virus. And the source code is worth nothing. The legal structure is already there to have the app changed without anyone being notified. If they released an entire buildable set of source that I could use to build and install the app myself, maybe. But that's about the only time I'd use this.
- chii 6y ago
  do you make the same requirement of all software you are using? If not, why would this particular one be differently treated? Location tracking is indeed a dangerous piece of information. But in the short time that the gov't had to face the issue, the best option is to do this tracking to re-enable the economy. Until proven otherwise, it would be wise to not assume there's already malware. I'm not saying there isn't, but given the probabilities, it's unlikely, while the health and economic benefits are high. And the source code is going to be released. It's easy (for a professional software engineer) to track down changes to the original code if they released a bad/altered version of the source that doesn't match the released version. And there'd be a track record, and it will be plainly obvious. I would be much more scared of the unknown apps from dodgy shops that offer their apps for free in exchange for all your contacts, file and camera access.
  - hamlsandwich 6y ago
    > why would this particular one be differently treated? - Because the issuer has vastly more ability to use the app and the data it might collect in ways that impact you. - Because it's the first app of this kind and scale being issued by the government in Australia. - Because it's being pushed onto as much of an entire population as possible with great urgency, limiting the time and opportunity for proper precautions to be taken. - Because the issuer has an objectively _terrible_ track record on technology and privacy related matters. - Because the ratchet effect means that once granted, privileges are highly unlikely to be ever rolled back. > I would be much more scared of the unknown apps from dodgy shops You shouldn't be. No matter how bad an adware mobile game is, the publisher can't put you in jail.
justatdotin 7y ago
how does running the app stop you from getting the virus?
- crypto2me 6y ago
  It doesn’t

mickotron 6y ago

CovidSafe is based off OpenTrace which is GPLv3. The Aus govt have to release the code. They said they would 2 weeks after the launch of the app. I have reviewed the client side source code for OpenTrace. It doesn't store location information. Also, read the BlueTrace whitepaper, it will answer a lot of questions you might have. The data is anonymised. You are identified by a TempId that is changed every 15 mins, that is based on your UserId and some other data (see white paper). If someone were to decrypt this value, it would reveal your UserId, but not your phone number. The attacker would need access to the server side storage to gain this information, as I believe the client side does not store this.