4 ms·

Has anyone done an analysis of the various open source government contract tracing app? I’d love to read some tear down/code review articles on what each countr

• evolve2k 6y ago
  Australia’s code is also open source. https://github.com/AU-COVIDSafe https://github.com/AU-COVIDSafe
  • giovannibajo1 6y ago
    It's not under an open source license, though. Any idea why?
    • askvictor 6y ago
      Because lawyers and a secretive, untrusting government. Interestingly, much of the code is forked from Singapore's OpenTrace initiative, which is GPL3, so Australia's app is most likely a copyright violation. Whether anyone will take action is another story.
      • ShinTakuya 6y ago
        As far as I'm aware, the Australian government got permission from Singapore to make the fork in that way, so as long Singapore didn't accept external contributions (or if they did, under a contributor's agreement) then they're in the clear. GPL doesn't automatically make it impossible to copy code under other licenses. You can license code out in multiple ways. GPL is just the default license that can be used without explicit permission.
        • askvictor 6y ago
          Thanks for the info, though I would have imagined that the government, which already has a trust deficit, might have mentioned this somewhere.
          • ShinTakuya 6y ago
            I feel like they did, but a quick Google can't turn it up - strange. But I agree they could have been more clear about it. Just one of many issues with how they've handled this situation.
    • Polylactic_acid 6y ago
      The concept of open source is so horrible to them that it already pains them to just show the source publicly.
  • daniel-grigg 6y ago
    Curious, is there any traceability to verify the published code is what’s published to the app now or with updates?
    • NewLogic 6y ago
      The app isn't obfuscated an was quite quickly decompiled.
  • thomasfedb 6y ago
    It's available online, but not open source. This is the "licence" they include: https://github.com/AU-COVIDSafe/mobile-ios/blob/master/LICENSE.md https://github.com/AU-COVIDSafe/mobile-ios/blob/master/LICEN...
• mschwaig 6y ago
  You can find an report on the contact tracing app published by the Austrian Red Cross on this site: https://noyb.eu/en/report-red-cross-corona-app-reviewed-noyb https://noyb.eu/en/report-red-cross-corona-app-reviewed-noyb Note that their app was released quite early, specifically before Apple and Google announced their contact tracing plans, and media reports indicate they want to start using those APIs in the first half of June, which will be a major change. My department at Johannes Kepler University Linz also published an analysis of the NOVID20 SDK(https://novid20.org https://novid20.org) when the code for that was first released: https://ins.jku.at/publications/2020/Roland_2020_NOVID20_Analysis_v1.pdf https://ins.jku.at/publications/2020/Roland_2020_NOVID20_Ana...
• Fragoel2 6y ago
  Not exactly what you're asking for but a friend of mine is running a bunch of static analysis tools on these apps, looking for security/privacy warnings: https://github.com/iivanoo/covid-apps-observer https://github.com/iivanoo/covid-apps-observer