32 ms·
The Italian Covid contact-tracing app is now developed in open source
- nautical 6y agoSome other countries recently took same path, relevant discussion here : 1) Singapore : https://news.ycombinator.com/item?id=22702701 https://news.ycombinator.com/item?id=22702701 2) India : https://news.ycombinator.com/item?id=23311298 https://news.ycombinator.com/item?id=23311298 3) Germany : https://news.ycombinator.com/item?id=23376682 https://news.ycombinator.com/item?id=23376682 ( no discussion, link to repository ) 4) France : https://news.ycombinator.com/item?id=23321137 https://news.ycombinator.com/item?id=23321137
- morsch 6y ago3) Germany : https://github.com/corona-warn-app https://github.com/corona-warn-app (no discussion to be found at https://news.ycombinator.com/item?id=23376682 https://news.ycombinator.com/item?id=23376682)
- giovannibajo1 6y agoLooks nice! Why is "SAP" holding the copyright? In Italy, the government acquired the copyright of the app (it was donated by the company that won the tender to develop it).
- morsch 6y agoSAP and Deutsche Telekom -- two large IT corporations -- are the main developers. I don't know why the government doesn't hold the copyright, maybe it should. They've released it as free software, though (Apache license).
- deleted 6y ago[deleted]
- hobofan 6y agoCopyright (at least the closest German equivalent of it) is non-transferable and automatically belongs to the creator, so it isn't really meaningful anyway. That's what licenses are for.
- quonn 6y agoAs far as I know, in Germany copyright cannot be transferred. There is a special and limited exception for direct employees, so the company can hold the copyright, but I doubt that a client (like the government) could hold it.
- hobofan 6y agoIANAL, but AFAIK there is no exception for employees. The employee still holds the copyright, but there is usually a clause in the employment contract that gives the employer "unrestricted usage rights" for any copyrightable product of the employee. Especially software developers should read those parts of their employment contracts carefully, as they may be overly broad and sometimes accompanied by weird clauses regarding their OSS work.
- pkaye 6y agoIf the employee still owns the copyright, does that mean employees could continue to use that software after they leave the company?
- hobofan 6y agoIn the granting of usage rights it is usually included that the employer will have exclusive usage rights as well (dependent on wording). I don't know about the exact implications for creating very similar future work (what you would call "infringing copyright") though.
- terramex 6y agoI'm not German, but as far as I know they have similar system to the one we have in Poland - you can transfer exclusive financial copyrights to another entity but you cannot transfer personal copyrights (so that you can say that you are the author of particular work even if you cannot license it to 3rd parties). In practice, even though personal copyright is not transferable, many employers require you to sign additional civil contract in which you declare that you will never exercise your personal copyright.
- 6y ago
- monocasa 6y agoI thought that you couldn't transfer copyright in Germany, only grant licences with all rights. Like even as a developer, it's just in your employment contract that you grant all rights for work done for the company to the company.
- BjoernKW 6y agoUnder German law copyright is non-transferrable. However, the copyright holder can grant another party unlimited usage rights as well as waive the right to be mentioned as the actual copyright holder. Both of these might apply here: SAP's and Deutsche Telekom's employees most likely have waived their right to be mentioned as individual copyright holders (which is a common stipulation in German employment contracts) while SAP and Deutsche Telekom have not, which is why they are mentioned as copyright holders instead of the Federal Republic of Germany.
- legulere 6y agoYou shouldn’t really call the German Author’s Rights Copyright, because it works dirfferently
- raverbashing 6y agoI think the term in English is "Moral Rights" (Urheberpersönlichkeitsrecht in German but for some weird reason they're apparently different)
- BjoernKW 6y agoThe legal system is different. However, copyright is the closest common law approximation.
- maxmouchet 6y agoFor France: https://gitlab.inria.fr/stopcovid19 https://gitlab.inria.fr/stopcovid19
- the_mitsuhiko 6y agoAustria: https://github.com/austrianredcross https://github.com/austrianredcross
- bovine3dom 6y agoThe UK has an interesting post-hoc approach where the code is open source but only after release, with the git history squashed. Discussion here: https://news.ycombinator.com/item?id=23107553 https://news.ycombinator.com/item?id=23107553
- jarekkruk 6y ago3) Poland's solution was also open sourced very soon https://github.com/ProteGO-Safe https://github.com/ProteGO-Safe . While it could have more privacy protective, as long as it will have an option to turn the contract tracing off I will use it. Unfortunately despite the fact that creators of this app are privacy conscious I only heard about it from negative articles. I checked it myself and they are using centralised tracing system, only because Apple/Google decentrilised one isn't ready and it is a main concern in disparaging articles. I'm not saying that currently Poland isn't going into autocracy, but it isn't a tool in this machine. However with 10k installs in a 40m country it is useless.
- fomine3 6y agoJapan: An open source community built a contact tracing app but the government doesn't adopt the app and building different app. I expect the app won't be open sourced. https://github.com/mamori-i-japan/mamori-i-japan-ios https://github.com/mamori-i-japan/mamori-i-japan-ios
- glandium 6y agoIt's not entirely clear what's going to happen with the source of that governmental app, but at least, it's mentioned in https://cio.go.jp/sites/default/files/uploads/documents/techteam_20200526_01.pdf https://cio.go.jp/sites/default/files/uploads/documents/tech... (last page)
- fomine3 6y agoOh, I haven't read the sentence. thanks.
- justinclift 6y agoWonder if any of the official apps are using reproducible builds, that can be built from their published source?
- ed25519FUUU 6y agoHonestly Covid tracing seems fairly moot at this point. With tens of thousands of people marching in the streets every night, aren’t we all basically exposed if we’re part of any network?
- mav3rick 6y agoAmerica is not the world !
- stormdennis 6y agoRather bizarrely there are street protests about George Floyd in Europe too.
- raziel2p 6y agohow is it bizarre? people naturally want to show solidarity with the cause in the US, it's a massive deal for the whole western world.
- stormdennis 6y agoHundreds of thousands are dead in Europe from a virus and these people are breaking the rules to stop its further spread because of one incident thousands of miles away that happened to be captured on a smartphone
- stuartd 6y ago8,000 miles away, give or take, and not Europe. And you don’t know why? For shame. https://twitter.com/joshuapotash/status/1267327498339127298?s=21 https://twitter.com/joshuapotash/status/1267327498339127298?...
- stormdennis 6y agoI do know why. The death of one man is a tragedy, the deaths of thousands, merely a statistic. Edited to delete reaching too far
- giovannibajo1 6y agoThis shows the application and gives an overview of how the product works for the citizen: https://github.com/immuni-app/immuni-documentation/blob/master/Product%20Description.md https://github.com/immuni-app/immuni-documentation/blob/mast... This the main technical documentation document: https://github.com/immuni-app/immuni-documentation/blob/master/Technology%20Description.md https://github.com/immuni-app/immuni-documentation/blob/mast... All the documentation is here: https://github.com/immuni-app/immuni-documentation https://github.com/immuni-app/immuni-documentation
- dang 6y agoThat last link seems like maybe the most informative place to start, so we've changed the link above to that from https://github.com/immuni-app https://github.com/immuni-app.
- ecesena 6y ago> To implement its contact tracing functionality, Immuni leverages the Apple and Google Exposure Notification framework (see Apple’s documentation [1] and Google’s documentation [2]). [1] https://www.apple.com/covid19/contacttracing https://www.apple.com/covid19/contacttracing [2] https://www.google.com/covid19/exposurenotifications/ https://www.google.com/covid19/exposurenotifications/
- lultimouomo 6y agoI have looked a bit at the documentation (not the code yet) and I have to say that I am pleasantly surprised. They seem to be doing this right, including an attention to the reproducibility of the builds, which IMO is of utter importance in such a sensitive app: https://github.com/immuni-app/immuni-documentation/blob/master/Technology%20Description.md#reproducible-builds https://github.com/immuni-app/immuni-documentation/blob/mast... (long story short: Android builds are substantially reproducible, iOS are not because there doesn't seem to be a way to achieve that. They are doing the best they can.)
- NSMyself 6y agoBending Spoons are top notch. Super glad they're the ones handling this
- evolve2k 6y agoHas anyone done an analysis of the various open source government contract tracing app? I’d love to read some tear down/code review articles on what each country has released.
- evolve2k 6y agoAustralia’s code is also open source. https://github.com/AU-COVIDSafe https://github.com/AU-COVIDSafe
- giovannibajo1 6y agoIt's not under an open source license, though. Any idea why?
- askvictor 6y agoBecause lawyers and a secretive, untrusting government. Interestingly, much of the code is forked from Singapore's OpenTrace initiative, which is GPL3, so Australia's app is most likely a copyright violation. Whether anyone will take action is another story.
- ShinTakuya 6y agoAs far as I'm aware, the Australian government got permission from Singapore to make the fork in that way, so as long Singapore didn't accept external contributions (or if they did, under a contributor's agreement) then they're in the clear. GPL doesn't automatically make it impossible to copy code under other licenses. You can license code out in multiple ways. GPL is just the default license that can be used without explicit permission.
- askvictor 6y agoThanks for the info, though I would have imagined that the government, which already has a trust deficit, might have mentioned this somewhere.
- isseu 6y agoWhat happened to the US Apple/Google app?
- avianlyric 6y agoApple and Google are just providing APIs. It up to countries and states to build apps on those APIs.
- rootusrootus 6y agoThe API is supposed to be available once 13.5 goes live (and it is available in public beta now, I believe). Here is a list of states who are participating with compatible apps: https://9to5mac.com/2020/05/21/covid-19-exposure-notification-api-states/ https://9to5mac.com/2020/05/21/covid-19-exposure-notificatio... TL;DR: Hardly any. Edit: Whoops, I am out of date, I thought 13.5 was not out yet! Apparently it is, and then some.
- ecesena 6y agoFrom the link above: > To implement its contact tracing functionality, Immuni leverages the Apple and Google Exposure Notification framework (see Apple’s documentation and Google’s documentation). This allows Immuni to overcome certain technical limitations, thus being more reliable than otherwise would be possible.
- Nas808 6y ago13.5 went live on May 20. They just released 13.5.1 yesterday to patch the unc0ver jailbreak. https://support.apple.com/en-us/HT211214 https://support.apple.com/en-us/HT211214
- rootusrootus 6y agoAh my bad, thanks for the correction. I'm still at 13.4 and I haven't been overtly refusing upgrade notifications, so I thought it hadn't been released yet.
- flurdy 6y ago
- trumpoline 6y agoBe careful, 3rd world countries such as the us are already using it against peaceful protesters. We dont want any of that in Europe.
- etqwzutewzu 6y agoSwitzerland's app is opensource. https://github.com/DP-3T https://github.com/DP-3T
- ubanholzer 6y agoAll Repositories: Android repository: https://github.com/DP-3T/dp3t-app-android-ch https://github.com/DP-3T/dp3t-app-android-ch iOS repository: https://github.com/DP-3T/dp3t-app-ios-ch https://github.com/DP-3T/dp3t-app-ios-ch Covidcode Frontend: https://github.com/admin-ch/CovidCode-UI https://github.com/admin-ch/CovidCode-UI App backend: https://github.com/DP-3T/dp3t-sdk-backend https://github.com/DP-3T/dp3t-sdk-backend App config backend: https://github.com/DP-3T/dp3t-config-backend-ch https://github.com/DP-3T/dp3t-config-backend-ch Covidcode backend: https://github.com/admin-ch/CovidCode-Service https://github.com/admin-ch/CovidCode-Service
- MrDresden 6y agoIceland: https://github.com/aranja/rakning-c19-app https://github.com/aranja/rakning-c19-app
- bwblabs 6y agoSummary of all European (EU+) apps initiatives: https://github.com/ct-report/summary https://github.com/ct-report/summary
- nosh 6y agoThis is a great resource. I’ve also started collecting information on all contact tracing apps being released worldwide. This is at https://cov19tech.org https://cov19tech.org - to share as an open resource. The source code for the site is on GitHub and the content is all CC licensed. If anyone would like to help, please get in touch Edit: I submitted Cov19Tech as a Show HN earlier today: https://news.ycombinator.com/item?id=23395475 https://news.ycombinator.com/item?id=23395475
- contravariant 6y agoMaybe a bit of a weird question, but does anyone know why there isn't just a single EU-wide effort? Or is it just politics as usual?
- lovemenot 6y agoIt does kinda make sense this way, because national healthcare providers are integral to operations.
- tomcooks 6y agoWould have taken too long to orchestrate a communal effort, plus this pandemic didn't _exactly_ make EU a more cohesive, quite the opposite especially in the beginning
- PeterStuer 6y agoCommercial interests and national ambitions mainly. Some corporations found it much easier to sell to specific EU countries than to lobby the EU, so deals were made. Also, the EU is more keen to protect privacy whereas specific EU member states want (to sell) free reign on their citizens. This lobbying game plays out all the time. You just cherry-pick your targets, find the weakest link so to speak. In this case, he more authoritarian and neo-liberal the parties in charge of the country/region, the easier you will net them.
- riffic 6y agoStop building tools to enable fascists. Has anyone not learned the lessons of history?
- AlwaysBCoding 6y agohaha surveillance state go brrrr
- logicchains 6y agoFreedom can't survive long if people aren't willing to make sacrifices for it.
- scarlac 6y agoI would encourage you to read up on the technology behind it. It was intended to be anonymous to such an extend that some governments went out and said they wouldn't use it because of the lack of tracking. The methodology has also been laid out quite extensively, and it's an opt-in approach.
- riffic 6y agoIt's not about tracking locations, it's about tracking social connections. I'm a skeptic it won't see abuses.
- giovannibajo1 6y agoRead the technical documentation and try to design an attack scenario, before deciding that it certainly can be abused
- devilmoon 6y agoHow can it track social connections when the codes are anonymous by default and can be deanonymized only with an OTP code you generate yourself?
- jlokier 6y ago
- unstatusthequo 6y agoThese will fail. 1) Not accurate enough; 2) Don’t account for walls/floors; 3) Will have low adoption where anything less than full adoption means fail; 4) can’t account for actually having a virus. False positives and false negatives combined with lack of rapid result testing will also make this useless. This is why Google and Apple looked around the room and slowly tiptoed away. Then we have the GDPR. Beat of luck making sure you’re compliant. Just don’t. Humans do a better job with contact tracing. Not everything needs to be hit over the head with a technology cudgel.
- Fragoel2 6y agoI don't think these apps will be a success either but Immuni (the Italian contact tracing app) had more than 500k downloads in a single day on iOS and it's still in testing regime, available only in 4 regions out of 20
- tigershark 6y agoHow GDPR applies to random numbers uploaded to a server?
- giovannibajo1 6y agoI’d like proof that humans are better at recollecting two weeks of random encounters on the streets, compared to an imprecise Bluetooth app. Immuni (Italian app) has been analyzed and certified as GDPR compliant by the Italian privacy watchdog, that has a technical department that is actually able to read and understand technical documentation.
- Mvandenbergh 6y agoInteresting. I am curious to see how well it works. The UK (which is developing two apps in parallel, one based on the Google/Apple API and one based on a proprietary protocol similar to PEPP-PT) has found in a large scale trial that though the technology worked relatively well, people did not respond well to being told to isolate by an app. It would be ironic if after weeks of passionate arguments on HN and other places about the technology and about finding the right balance between efficacy and privacy, the whole thing fails because people don't like the principle.
- mcintyre1994 6y agoWhere are you getting information about the UK trial? I don't think I've heard the finding you said from ministers, they just seem to say it's all great and refuse to engage on it. I don't think they've even admitted developing the second app actually.
- Mvandenbergh 6y agoThe second app we know because there was a work-order modification posted publicly a while ago instructing their app developers to develop a second app as well. You're right that ministers have never formally acknowledged that they are doing it. I do not understand this but then I am from the: people will accept 100x as much incompetence as deceit school of communication and they are not. The other information comes from Lord Bethel's house of lords testimony and also from this blog: https://www.ncsc.gov.uk/blog-post/nhs-covid-19-app-security-two-weeks-on https://www.ncsc.gov.uk/blog-post/nhs-covid-19-app-security-... and things linked to from it.
- tomatocracy 6y agoI hadn't seen this re the Isle of Wight but it doesn't surprise me. I would guess it's probably in part because most people were expecting the result of an "exposure notification" to be advice to (and information on how to) get a test. Instead the policy seems to be a blanket "isolate for 14 days even if you subsequently get a negative test result" which I suspect will go down very poorly, especially when it won't tell you who you were potentially exposed to.
- tomatocracy 6y agoGood to see they have open sourced the full backend/server code (including analytics code) as well as the client. The UK has open sourced only the clients source code from what I can tell. This comes on top of the initial refusal to use the Google/Apple API and some downright awful data retention and privacy control policies. What a contrast.
- jlokier 6y agoLast I read the UK intends to centrally retain proximity-contact data for 20 years. Rather than deleting when it is decided it's no longer needed to deal with the pandemic. The UK has also refused to legally commit to not sharing the data with other government departments such as the Home Office (immigration and policing) and DWP (benefits). So much for data protection and obtaining data for a designated purpose. Whatever happened to the GDPR. I know enough people that will be inappropriately harmed by this sort of data, whether it is used against them directly or not (it's still a miserable life living in constant fear of "doing something wrong", which now includes "being somewhere you shouldn't be" or "being near someone you shouldn't be"), that I'm firmly against this sort of surveillance state expansion, and firmly in favour of data protection. As it stands currently I will not install the UK app, and I advise all my friends to steer well clear of it as well. - (If they meaningfully improve data protection then I'll change my mind and be all in. E.g. the Google-Apple approach and zero-knowledge methods are enough for me. If epidemiologists and public health would find data useful, let's use some differential privacy. I'm not against data collection done properly in such a way that actually protects people.)
- fatline 6y ago> Last I read the UK intends to centrally retain proximity-contact data for 20 years. Rather than deleting when it is decided it's no longer needed to deal with the pandemic. The UK has also refused to legally commit to not sharing the data with other government departments such as the Home Office (immigration and policing) and DWP (benefits). that's scary.. any chance you can share the references for these?
- jlokier 6y ago"Public Health England will keep personal data of people with coronavirus for 20 years" https://www.theguardian.com/world/2020/may/28/nhs-will-keep-personal-data-of-people-with-coronavirus-for-20-years--uk-test-and-trace-programme https://www.theguardian.com/world/2020/may/28/nhs-will-keep-... "NHS under fire for plans to store track and trace data for 20 years" https://www.telegraph.co.uk/technology/2020/05/28/nhs-fire-plans-store-track-trace-data-20-years/ https://www.telegraph.co.uk/technology/2020/05/28/nhs-fire-p... "Demand NHSX spell out Covid-19 app privacy risks" https://www.openrightsgroup.org/campaigns/protecting-digital-rights-during-covid-19/ https://www.openrightsgroup.org/campaigns/protecting-digital... "Hostile environment may stop migrants from using NHSX tracker app" https://www.openrightsgroup.org/blog/hostile-environment-may-stop-migrants-from-using-nshx-tracker-app/ https://www.openrightsgroup.org/blog/hostile-environment-may... "NHS test and trace privacy doc throws doubt on app’s “anonymity” claims" https://tech.newstatesman.com/coronavirus/nhs-test-and-trace-privacy-doc-throws-doubt-on-apps-anonymity-claims https://tech.newstatesman.com/coronavirus/nhs-test-and-trace... "The privacy risks of the NHSX tracing app are both less and more serious than you think" https://tech.newstatesman.com/security/nhsx-contact-tracing-app-privacy-risks https://tech.newstatesman.com/security/nhsx-contact-tracing-... "Immigration Bill brings surveillance to EU migrants" (This is about exemptions to data protection law for immigration purposes, which affects citizens and non-citizens alike.) https://www.openrightsgroup.org/blog/immigration-bill-brings-surveillance-to-eu-migrants/ https://www.openrightsgroup.org/blog/immigration-bill-brings... "Scotland’s different path on contact tracing is to be welcomed, but questions remain" https://scotland.openrightsgroup.org/blog/scotlands-different-path-on-contact-tracing-is-to-be-welcomed-but-questions-remain/ https://scotland.openrightsgroup.org/blog/scotlands-differen...
- flurdy 6y ago> and it is released under a GNU Affero General Public License version 3. AGPL for these apps is probably a good match.
- slynn12 6y agoThis is a great tool for Italy. It's too bad the US government can't step up their game with contact tracing -- we could really use something like this right now.
- zubairq 6y agoFinland has an open source fever tracking system too Fevermap at https://fevermap.net/ https://fevermap.net/
- Fire-Dragon-DoL 6y agoI'm surprised and pleased to see this app being developed properly. When I was working in Italy, the state of software development was terrible. It looks like now there are great developers too.