8 ms·

India’s contact tracing app is going open source

146 points by jmsflknr 6y ago

codegladiator 6y ago
Wow I never expected this from Indian Govt irrespective of the political party. And bounty on top of that for security issues is definitely next level.
- bitxbitxbitcoin 6y ago
  Likewise - this is welcome news. If it's mandatory, it should definitely be open source. Hell, anything that is funded by taxpayer dollars should be open sourced.
plibither8 6y ago
EDIT: My bad, didn't read correctly! What's more interesting, and rather disappointing, is that they are going to open source only the iOS and KaiOS version of the app [1]. I'll be honest, I had to lookup what KaiOS is. Why not Android? [1] https://tech.hindustantimes.com/tech/news/aarogya-setu-s-android-version-made-open-source-71590501535317.html https://tech.hindustantimes.com/tech/news/aarogya-setu-s-and...
- codegladiator 6y ago
  What do you mean ? The link you added says in the first line > The government today made the Android version of Aarogya Setu open source The techcrunch link also said android version is being made opensource.
- jegs 6y ago
  All 3 versions are being open sourced. Says so in the article you linked.
guiltygods 6y ago
Finally it would put to rest all the fake news about big brother surveillance and privacy noise that was around this app.
- moh_maya 6y ago
  No, what would have put all the legitimate concerns to rest would have been: a) transparency into who the developers are, and what the terms of engagement are b) even if they didn't / couldn't open source the code from the get go, a clear date and target of when they would do so c) even before the app was launched, a single one page document of the architecture, the regulations governing data retention, etc (all were released post facto, after the "fake news" and "privacy noise"). Concerns about the govt collecting massive, potentially identifiable data on an individual level for an application that they originally mandated everyone had to use to travel, is not "fake news". Perhaps one may feel such concern was unwarranted (and I disagree there), but how is that "fake news"? We may have differences of opinion on the level of trust one can have on govts, but I'm sure we can agree that transparency and visibility into such critical decisions is reasonable to demand and expect.
  - kosmischemusik 6y ago
    You're spot on. I've seen a lot of folks talk about how the government rushed into putting out the app without having an open consultation with technologists. Rather, a closed-door discussion with a vague set of "industry players". Nonetheless, this is the first step the government has taken. Let's hope continued pressure will result in audits and better protocols in the future.
  - pm90 6y ago
    > Concerns about the govt collecting massive, potentially identifiable data on an individual level for an application that they originally mandated everyone had to use to travel, is not "fake news". Perhaps one may feel such concern was unwarranted (and I disagree there), but how is that "fake news"? I'm not the OP but from what I've heard there's a mix of genuine concerns and conspiracy theories about this (as often happens), and its quite hard for a layperson to understand what to believe. I read the OP as saying "finally, we get to see what's really happening and can thus determine if the concerns for data privacy are legitimate and put the conspiracy theories to rest"
  - sbmthakur 6y ago
    Like every other thing, even this was politicized in India. There are people terming the app as a "surveillance app" without a proper technical analysis[0]. 0. https://www.nationalheraldindia.com/india/aarogya-setu-is-a-surveillance-app-will-not-help-those-who-are-most-vulnerable-to-covid-19 https://www.nationalheraldindia.com/india/aarogya-setu-is-a-...
deleted 6y ago
[deleted]
carterklein13 6y ago
Even though I'm sure this won't be perfect, this is still something I hope other apps follow suit with. I currently use the Citizen app in NYC, but I'm not necessarily a fan of the contact tracing functionality they're rolling out. Open-sourcing it would (hopefully) ease some of my concerns... or maybe aggravate them if I saw some things I didn't like... but at least I'd know how my data is being used one way or the other.
FlyingSnake 6y ago
For those who're looking for the source code, the repository will be live tonight at 12:00 IST and will be available at: https://github.com/nic-delhi/AarogyaSetu_Android https://github.com/nic-delhi/AarogyaSetu_Android. iOS repo will be open-sourced a week later[^1]. [^1]: https://twitter.com/SetuAarogya/status/1265281058532016128 https://twitter.com/SetuAarogya/status/1265281058532016128
- econcon 6y ago
  Who works at 12:00IST in India?
  - pravej 6y ago
    I guess, PM of India.
  - thawaway1837 6y ago
    A lot of people? Relevantly, a lot of developers and ops folks who need overlaps with US hours.
  - fouc 6y ago
    Someone that goes for lunch at 1:00IST?
  - th3iedkid 6y ago
    It’s most likely automated. Not like a leader has to press the green button on that at that time! Nevertheless, there would be significant number of services in a country of billion people requiring 24X7 uptime!!
  - sbmthakur 6y ago
    Support guys and some devs who work with American firms.
- akx 6y ago
  Interesting. The repo the linked repo was forked from was just transferred from https://github.com/AarogyaSetu/aarogyasetu_android https://github.com/AarogyaSetu/aarogyasetu_android (now 404) to https://github.com/ubuntulover09/aarogyasetu_android https://github.com/ubuntulover09/aarogyasetu_android ... EDIT: and now the fork's gone too. :D
Thaxll 6y ago
In a similar topic there is a reference server by Google: https://github.com/google/exposure-notifications-server https://github.com/google/exposure-notifications-server
Recursing 6y ago
Github repositories of the Italian ones: https://github.com/immuni-app https://github.com/immuni-app
sbmthakur 6y ago
A much-needed step. This will improve transparency and should put to rest wild speculations going around about the app. https://www.nationalheraldindia.com/india/aarogya-setu-is-a-surveillance-app-will-not-help-those-who-are-most-vulnerable-to-covid-19 https://www.nationalheraldindia.com/india/aarogya-setu-is-a-...
- kosmischemusik 6y ago
  Unfortunately, until the server-side code is also open-sourced, it would impossible to say what anyone does with the data stored on a centralized server. This is the first step toward making things transparent.
  - sbmthakur 6y ago
    Yes. It's just the first step. Considering the downvotes to my comment, looks like some people want the app to be completely closed-source.
BrandoElFollito 6y ago
The French one is opensource as well. There will also be a public bug bounty soon.
sseth 6y ago
I think Android is the most important version - about 95% of mobiles are covered. So it is good they are doing that first. iOS is about 3-4% and KaiOS is just 1%, so I think if it takes some more time that's not a huge impact.

146 points by jmsflknr 6y ago

Wow I never expected this from Indian Govt irrespective of the political party. And bounty on top of that for security issues is definitely next level.

bitxbitxbitcoin 6y ago
Likewise - this is welcome news. If it's mandatory, it should definitely be open source. Hell, anything that is funded by taxpayer dollars should be open sourced.

plibither8 6y ago

EDIT: My bad, didn't read correctly! What's more interesting, and rather disappointing, is that they are going to open source only the iOS and KaiOS version of the app [1]. I'll be honest, I had to lookup what KaiOS is. Why not Android? [1] https://tech.hindustantimes.com/tech/news/aarogya-setu-s-android-version-made-open-source-71590501535317.html https://tech.hindustantimes.com/tech/news/aarogya-setu-s-and...

codegladiator 6y ago
What do you mean ? The link you added says in the first line > The government today made the Android version of Aarogya Setu open source The techcrunch link also said android version is being made opensource.
jegs 6y ago
All 3 versions are being open sourced. Says so in the article you linked.

guiltygods 6y ago

Finally it would put to rest all the fake news about big brother surveillance and privacy noise that was around this app.

moh_maya 6y ago
No, what would have put all the legitimate concerns to rest would have been: a) transparency into who the developers are, and what the terms of engagement are b) even if they didn't / couldn't open source the code from the get go, a clear date and target of when they would do so c) even before the app was launched, a single one page document of the architecture, the regulations governing data retention, etc (all were released post facto, after the "fake news" and "privacy noise"). Concerns about the govt collecting massive, potentially identifiable data on an individual level for an application that they originally mandated everyone had to use to travel, is not "fake news". Perhaps one may feel such concern was unwarranted (and I disagree there), but how is that "fake news"? We may have differences of opinion on the level of trust one can have on govts, but I'm sure we can agree that transparency and visibility into such critical decisions is reasonable to demand and expect.
- kosmischemusik 6y ago
  You're spot on. I've seen a lot of folks talk about how the government rushed into putting out the app without having an open consultation with technologists. Rather, a closed-door discussion with a vague set of "industry players". Nonetheless, this is the first step the government has taken. Let's hope continued pressure will result in audits and better protocols in the future.
- pm90 6y ago
  > Concerns about the govt collecting massive, potentially identifiable data on an individual level for an application that they originally mandated everyone had to use to travel, is not "fake news". Perhaps one may feel such concern was unwarranted (and I disagree there), but how is that "fake news"? I'm not the OP but from what I've heard there's a mix of genuine concerns and conspiracy theories about this (as often happens), and its quite hard for a layperson to understand what to believe. I read the OP as saying "finally, we get to see what's really happening and can thus determine if the concerns for data privacy are legitimate and put the conspiracy theories to rest"
- sbmthakur 6y ago
  Like every other thing, even this was politicized in India. There are people terming the app as a "surveillance app" without a proper technical analysis[0]. 0. https://www.nationalheraldindia.com/india/aarogya-setu-is-a-surveillance-app-will-not-help-those-who-are-most-vulnerable-to-covid-19 https://www.nationalheraldindia.com/india/aarogya-setu-is-a-...

deleted 6y ago

[deleted]

carterklein13 6y ago

Even though I'm sure this won't be perfect, this is still something I hope other apps follow suit with. I currently use the Citizen app in NYC, but I'm not necessarily a fan of the contact tracing functionality they're rolling out. Open-sourcing it would (hopefully) ease some of my concerns... or maybe aggravate them if I saw some things I didn't like... but at least I'd know how my data is being used one way or the other.

FlyingSnake 6y ago

For those who're looking for the source code, the repository will be live tonight at 12:00 IST and will be available at: https://github.com/nic-delhi/AarogyaSetu_Android https://github.com/nic-delhi/AarogyaSetu_Android. iOS repo will be open-sourced a week later[^1]. [^1]: https://twitter.com/SetuAarogya/status/1265281058532016128 https://twitter.com/SetuAarogya/status/1265281058532016128

econcon 6y ago
Who works at 12:00IST in India?
- pravej 6y ago
  I guess, PM of India.
- thawaway1837 6y ago
  A lot of people? Relevantly, a lot of developers and ops folks who need overlaps with US hours.
- fouc 6y ago
  Someone that goes for lunch at 1:00IST?
- th3iedkid 6y ago
  It’s most likely automated. Not like a leader has to press the green button on that at that time! Nevertheless, there would be significant number of services in a country of billion people requiring 24X7 uptime!!
- sbmthakur 6y ago
  Support guys and some devs who work with American firms.
akx 6y ago
Interesting. The repo the linked repo was forked from was just transferred from https://github.com/AarogyaSetu/aarogyasetu_android https://github.com/AarogyaSetu/aarogyasetu_android (now 404) to https://github.com/ubuntulover09/aarogyasetu_android https://github.com/ubuntulover09/aarogyasetu_android ... EDIT: and now the fork's gone too. :D

Thaxll 6y ago

In a similar topic there is a reference server by Google: https://github.com/google/exposure-notifications-server https://github.com/google/exposure-notifications-server

Recursing 6y ago

Github repositories of the Italian ones: https://github.com/immuni-app https://github.com/immuni-app

sbmthakur 6y ago

A much-needed step. This will improve transparency and should put to rest wild speculations going around about the app. https://www.nationalheraldindia.com/india/aarogya-setu-is-a-surveillance-app-will-not-help-those-who-are-most-vulnerable-to-covid-19 https://www.nationalheraldindia.com/india/aarogya-setu-is-a-...

kosmischemusik 6y ago
Unfortunately, until the server-side code is also open-sourced, it would impossible to say what anyone does with the data stored on a centralized server. This is the first step toward making things transparent.
- sbmthakur 6y ago
  Yes. It's just the first step. Considering the downvotes to my comment, looks like some people want the app to be completely closed-source.

BrandoElFollito 6y ago

The French one is opensource as well. There will also be a public bug bounty soon.

sseth 6y ago

I think Android is the most important version - about 95% of mobiles are covered. So it is good they are doing that first. iOS is about 3-4% and KaiOS is just 1%, so I think if it takes some more time that's not a huge impact.