6 ms·

Source code of Germany’s official covid-19 contact tracing app

112 points by JesseMReeves 6y ago

doener 6y ago
Official site: https://www.coronawarn.app/en/ https://www.coronawarn.app/en/
Findus23 6y ago
for reference, this is the source of the Austrian contact tracking app: https://github.com/austrianredcross/ https://github.com/austrianredcross/
- bonzini 6y ago
  And the Italian one: https://github.com/immuni-app https://github.com/immuni-app
bibinou 6y ago
previously: https://news.ycombinator.com/item?id=23401582 https://news.ycombinator.com/item?id=23401582
sudeepj 6y ago
How does one know whether the app in playstore is compiled from this very repo + specific commit and not some other fork of it? Edit: This is not questioning this particular app. A lot of govt are making their tracing app open source [1]. Since making it open source is supposed to increase trust hence the question. [1] India app: https://github.com/nic-delhi/AarogyaSetu_Android https://github.com/nic-delhi/AarogyaSetu_Android
- phepranto 6y ago
  The technical director gave a press conference and confirmed that they'll add reproducable builds in the near future.
  - Hackbraten 6y ago
    Until then, I hope that infosec researchers are going to scrutinize the binaries.
    - FakeRemore 6y ago
      Germany's the home of the CCC. I'm sure people will be scrutinizing it.
- johannes1234321 6y ago
  For one: because this would be extra work within a short time frame. The source shows no extension points. Outside small tech circles nobody would have said anything if it were closed, if they have bad intention they could have made it closed. For second: we can easily see that the app doesn't use GPS or similar, which is a nice indication For third: Germans overall trust their government to not lie as much as other governments For forth: Researchers will reverse the app The only way this thing can work is, if the population trusts it, installs it and keeps their phone on. If the population doesn't trust it, it's doomed. It's in the self-interest of the project to be trustworthy and transparent. If you understand German you might enjoy this podcast with two of the developers: https://ukw.fm/ukw030-die-corona-warn-app/ https://ukw.fm/ukw030-die-corona-warn-app/
  - the_gipsy 6y ago
    This is not answering the question beyond "it would require some effort to do so". It is not unusual to have a different binary published, than what's in a public repo. The following points you go on about are mostly irrelevant.
    - johannes1234321 6y ago
      Well, then don't use the app from the app store and compile it yourself ...
      - chopin 6y ago
        Does that work, though? Afaik the app needs Google's or Apple's blessing to use the API.
        johannes1234321 6y ago
        No idea, but as those are closed source one can have the same doubts, so you need an OpenSource alternative to the API, which is in the works in order to be used in that app: https://github.com/theScrabi/CoraLibre-android-sdk/ https://github.com/theScrabi/CoraLibre-android-sdk/ and https://github.com/corona-warn-app/cwa-app-android/issues/75 https://github.com/corona-warn-app/cwa-app-android/issues/75 That combined with an Android based on AOSP and trust issues should be reduced (while the bad government can still track you using cell towers and for that app one could still place Bluetooth beacons everywhere and the server's could still store more information (while the only keys transmitted are those of infected, which is quite little) ... so yeah, pick your level of conspiracy
- ClumsyPilot 6y ago
  I don't see how your criticism applies to this app in particular, rather than the playstore in general. How do you know you can trust instagram/google maps/ any other common app on your phone? I would trust German government way more than i trust just about any corporate entity I can think of.
  - sudeepj 6y ago
    The comment is a general one. Also it is not a criticism, it was a question because lot of govt are making their tracing app open source. However, since this is a tracing app and being open source would imply "look, our app is clean, check our code if you do not trust us". Off-course making it open source has other benefits too. > How do you know you can trust instagram/google maps/ any other common app on your phone? I don't. If I am using it I know that I have no way to validate or enforce what happens with my data.
  - chopin 6y ago
    You not only need to trust the German government but any intermediate all the way to the store. I doubt that Apple or Google build the app from the repo. To add, there are currently discussions underway in the German parliament to give our secret services (namely the notorious Verfassungsschutz) the power to compromise IT systems (Bundestrojaner). I'd trust even the government not that much these times.
    - ClumsyPilot 6y ago
      I agree, its a shame we can't actually trace it all the way from git. As for conpromising IT systems, arent they just going to bw on a level playing field with NSA and others?
f1refly 6y ago
Requires google play services to run with the developers not caring at all
- mxscho 6y ago
  Technically, you are free to implement the Exposure Notification [1] API for your own potentially open-source alternative of Google Play Services, right? Or why would this currently not be possible? [1] https://en.wikipedia.org/wiki/Exposure_Notification https://en.wikipedia.org/wiki/Exposure_Notification
  - johannes1234321 6y ago
    People are working on that: https://github.com/corona-warn-app/cwa-app-android/issues/75 https://github.com/corona-warn-app/cwa-app-android/issues/75 Edit: and also see https://github.com/theScrabi/CoraLibre-android-sdk/ https://github.com/theScrabi/CoraLibre-android-sdk/
- DangerousPie 6y ago
  What fraction of the German mobile phone user base is running Android without Google services? My guess would be <1%
s9w 6y ago
This was officially released just a few hours ago by the way: https://play.google.com/store/apps/details?id=de.rki.coronawarnapp https://play.google.com/store/apps/details?id=de.rki.coronaw...
Kovah 6y ago
It is still unbelievable, that the German government paid 20 Million Euro for these apps. Hopefully the request for details about the contracts[1] will be answered by the corresponding gov agency. [1]: https://fragdenstaat.de/anfrage/kostenaufstellung-der-corona-tracing-app/ https://fragdenstaat.de/anfrage/kostenaufstellung-der-corona...
- s9w 6y ago
  Compared to the billions to potentially trillions of euros Germany will be paying for the lockdown and the other EU states this is basically nothing I think.
  - GreenHeuristics 6y ago
    20 million is still 20 million
    - johannes1234321 6y ago
      For a system which interacts with Germany's divers structure of health authorities. Last time I counted there were 374 municipal health authorities, all of them have to be integrated. Also the laboratories and doctors. In addition they set up two calling centers (a technical hotline and a health hotline) and did multiple audits for security and for epidimological sense. And then all of it, frontend and backend, is open source. For a government project that is cheap! (25cent per citizen) Edit: source for the 374 is the table on https://de.m.wikipedia.org/wiki/Gesundheitsamt https://de.m.wikipedia.org/wiki/Gesundheitsamt
  - polycaster 6y ago
    Provided the app will solve all those problems single-handedly. There are voices arguing the impact will be about 0.
    - s9w 6y ago
      It will absolutely be 0, I didn't mean to imply otherwise.
bjarneh 6y ago
I have to say the main reason I did not install my country's (Norway) corona-tracing-app is that they said it could not be made safe if the source code was public. Nice to see other countries do the right thing.
- rozab 6y ago
  Does your government have much of an open source culture? I think these arguments were already had (and won) in the UK, for instance. https://github.com/alphagov https://github.com/alphagov https://github.com/hmrc https://github.com/hmrc https://github.com/UKHomeOffice https://github.com/UKHomeOffice
  - gspr 6y ago
    > Does your government have much of an open source culture? I'd say no, but it's a bit surprising, because it does have a pretty decent open data culture. The weather [1] and mapping [2] data services are world-class, for example. [1] https://hjelp.yr.no/hc/en-us/articles/360009342833-XML-weather-forecasts https://hjelp.yr.no/hc/en-us/articles/360009342833-XML-weath... [2] https://kartverket.no/en/data/Open-and-Free-geospatial-data-from-Norway/ https://kartverket.no/en/data/Open-and-Free-geospatial-data-...
    - birktj 6y ago
      Even though it is getting better, I would argue Norway still has a pretty bad open data culture. As far as I know Kartverket has only released the N50 with the more detailed N5 data still not being available to the public. The biggest pain points for me is the fact that marine depth data of a certain resolution is classified information [1] and they still wont release nautical maps for free. I am hoping the open trend will continue because the Norwegian government sits on some really high quality data that could see a lot of interesting uses. [1] https://www.kartverket.no/en/data/bathymetric-data-and-DTM-of-the-Seabed/ https://www.kartverket.no/en/data/bathymetric-data-and-DTM-o...
  - marvin 6y ago
    Norway botched the contact tracing app completely, certainly politically and maybe technically. Centralized storage of GPS & bluetooth data and refusal to open-source (which is a tacit acknowledgement of insufficient confidence in security -- of the personal movements of the whole population, no less). Statements from researchers involved in the technical development that citizens have a responsibility to give up their personal information. Poor debate and communication regarding the choice of centralized tracing. Then followed up with painfully weak statements from politicians and researchers that this is a truly exceptional one-time-only transgression of privacy, which will be rolled back permanently on a specified date and never be construed as precedence for similar actions in the future. FHI, responsible for the app deployment (the Norwegian version of the CDC), has previously betrayed the trust of the public by refusing to destroy DNA samples of exonerated suspects and witnesses. Skepticism towards their ethics and degree of principled data management is highly justified. Digital contract tracing seems dubious anyway, but thankfully we're in a position at the moment where it is definitely unnecessary. Might be relavant in a few months though.
fock 6y ago
are the (known) Android bluetooth-RCEs fixed everywhere, where this runs?
- Uhrheber 6y ago
  Of course not, why are you even asking?
hathym 6y ago
France also released the source code of its StopCovid19 app[1] [1] https://gitlab.inria.fr/stopcovid19 https://gitlab.inria.fr/stopcovid19
xorfish 6y ago
https://github.com/DP-3T/documents https://github.com/DP-3T/documents Here is the protocol it is based on.
zelphirkalt 6y ago
Will this app work without permanent Internet connection? (Will it buffer its data until one has working connection again and then upload data?)
- jhrmnn 6y ago
  It uses this under the hood https://www.macrumors.com/guide/exposure-notification/ https://www.macrumors.com/guide/exposure-notification/ So I believe it does work without internet connection
- dominik3 6y ago
  Yes, it does work without an permanent internet connection. The whole point of this app is to be decentralized. No data is uploaded unless you share your sent tokens if you are infected. This requires an approval from the health departments to prevent abuse. The apps download the tokens of infected persons and check if they had contact locally on the device.
- neuronic 6y ago
  Yes, app keeps local track of of IDs that you have been in extended contact with. App only receives IDs of infected people and compares them. If YOU are infected you will need to consent to your local list of met IDs to be uploaded, so others in your list can be notified.
WhyNotHugo 6y ago
I'm very happy to see so many countries moving in the right direction. It's not every country, but we're slowing moving there. :)
vault 6y ago
Do you know how many contact tracing apps I can install? Do they conflict with each other? I'm thinking about travellers who often cross borders.
- berdario 6y ago
  I installed 2 of the ones using the Exposure Notification API, just to check what happens in this circumstance (the german app is implemented differently, though) and Android allows access to it to only one app at a time. You can choose/enable/disable manually which app you want to grant access to the api.
sdiw 6y ago
India also released source code of Aarogya Setu app https://github.com/nic-delhi/AarogyaSetu_Android https://github.com/nic-delhi/AarogyaSetu_Android
tpetry 6y ago
The more interesting part is that security audits for the frontend did find multiple high risk security issues in the app, which have been fixed by the developers. But the organisation was not allowed to make a security audit of the backend. I mean the most critical part security wise was not allowed to be verified. This does not feel good.
HissingMachine 6y ago
I'm a hopeless optimist and romantic when it comes to software, and I really would have liked to see the covid app being done in some way that built confidence and inspired hope and optimism. My vision was that it could have been more like open source Eurovision where developers that participate had the chance to introduce themselves to the public, and some of the development and design could have been screen cast to us unfortunate souls trapped in our homes for months for some entertainment value and inspiration for budding developers. But eh, instead we get something good, something bad, but much of the same old same old, and in the end, I'm staying as far as I can from these apps as a result. Sad, there was a chance to do something amazing.
buboard 6y ago
Covid has been curtailed without the need for these apps (in all the places that opened up). Why do people insist on pushing them to people? There is no evidence they work, even when with months of testing. No matter how anonymized you try to make them, the authorities and evil state actors will find ways to abuse the data -- it's like a law of nature now that all data will be abused. E.g. in case of a bombing or riots, the police can arrest bystanders and use phones to tell who was standing next to whom. Pushing these for security theater has long term bad consequences. I was hoping people would know that after the 1000th repetition but alas, people are incorrigible https://www.nbcnews.com/tech/tech-news/coronavirus-contact-tracing-apps-were-tech-s-chance-step-they-n1230211 https://www.nbcnews.com/tech/tech-news/coronavirus-contact-t... https://www.wired.co.uk/article/contact-tracing-app-isle-of-wight-trial https://www.wired.co.uk/article/contact-tracing-app-isle-of-...
- JoeSmithson 6y ago
  Covid has been curtailed mainly with extremely expensive lockdowns. The purpose of the apps is to control the spread going forward, without lockdown.
  - _-___________-_ 6y ago
    > Covid has been curtailed mainly with extremely expensive lockdowns. Citation needed. We don't know conclusively what curtailed it in places where it has been curtailed, since there were many different control approaches occurring at the same time. There are also several countries where lockdown effectively ended weeks or months ago, and spread is not occurring despite a lack of widespread use of these apps, not to mention a variety of approaches to lockdown itself with no obvious correlation between strictness of the approach and mortality/infection stats.
rmoriz 6y ago
While everyone is looking at the code or press releases, only very few seem to research about how Bluetooth distance measurement works and if it's reliable enough with thousand of different smartphones out there having different chips and antenna characteristics. The app may be great but the design simply seems not to work as expected.
mttjj 6y ago
@dang, can we get a title update to include the apostrophe in "Germany's"? Or just change the title to how it's documented on the site? "Corona-Warn-App: The official COVID-19 exposure notification app for Germany"

112 points by JesseMReeves 6y ago

Official site: https://www.coronawarn.app/en/ https://www.coronawarn.app/en/

for reference, this is the source of the Austrian contact tracking app: https://github.com/austrianredcross/ https://github.com/austrianredcross/

bonzini 6y ago
And the Italian one: https://github.com/immuni-app https://github.com/immuni-app

bibinou 6y ago

previously: https://news.ycombinator.com/item?id=23401582 https://news.ycombinator.com/item?id=23401582

sudeepj 6y ago

How does one know whether the app in playstore is compiled from this very repo + specific commit and not some other fork of it? Edit: This is not questioning this particular app. A lot of govt are making their tracing app open source [1]. Since making it open source is supposed to increase trust hence the question. [1] India app: https://github.com/nic-delhi/AarogyaSetu_Android https://github.com/nic-delhi/AarogyaSetu_Android

phepranto 6y ago
The technical director gave a press conference and confirmed that they'll add reproducable builds in the near future.
- Hackbraten 6y ago
  Until then, I hope that infosec researchers are going to scrutinize the binaries.
  - FakeRemore 6y ago
    Germany's the home of the CCC. I'm sure people will be scrutinizing it.
johannes1234321 6y ago
For one: because this would be extra work within a short time frame. The source shows no extension points. Outside small tech circles nobody would have said anything if it were closed, if they have bad intention they could have made it closed. For second: we can easily see that the app doesn't use GPS or similar, which is a nice indication For third: Germans overall trust their government to not lie as much as other governments For forth: Researchers will reverse the app The only way this thing can work is, if the population trusts it, installs it and keeps their phone on. If the population doesn't trust it, it's doomed. It's in the self-interest of the project to be trustworthy and transparent. If you understand German you might enjoy this podcast with two of the developers: https://ukw.fm/ukw030-die-corona-warn-app/ https://ukw.fm/ukw030-die-corona-warn-app/
- the_gipsy 6y ago
  This is not answering the question beyond "it would require some effort to do so". It is not unusual to have a different binary published, than what's in a public repo. The following points you go on about are mostly irrelevant.
  - johannes1234321 6y ago
    Well, then don't use the app from the app store and compile it yourself ...
    - chopin 6y ago
      Does that work, though? Afaik the app needs Google's or Apple's blessing to use the API.
      - johannes1234321 6y ago
        No idea, but as those are closed source one can have the same doubts, so you need an OpenSource alternative to the API, which is in the works in order to be used in that app: https://github.com/theScrabi/CoraLibre-android-sdk/ https://github.com/theScrabi/CoraLibre-android-sdk/ and https://github.com/corona-warn-app/cwa-app-android/issues/75 https://github.com/corona-warn-app/cwa-app-android/issues/75 That combined with an Android based on AOSP and trust issues should be reduced (while the bad government can still track you using cell towers and for that app one could still place Bluetooth beacons everywhere and the server's could still store more information (while the only keys transmitted are those of infected, which is quite little) ... so yeah, pick your level of conspiracy
ClumsyPilot 6y ago
I don't see how your criticism applies to this app in particular, rather than the playstore in general. How do you know you can trust instagram/google maps/ any other common app on your phone? I would trust German government way more than i trust just about any corporate entity I can think of.
- sudeepj 6y ago
  The comment is a general one. Also it is not a criticism, it was a question because lot of govt are making their tracing app open source. However, since this is a tracing app and being open source would imply "look, our app is clean, check our code if you do not trust us". Off-course making it open source has other benefits too. > How do you know you can trust instagram/google maps/ any other common app on your phone? I don't. If I am using it I know that I have no way to validate or enforce what happens with my data.
- chopin 6y ago
  You not only need to trust the German government but any intermediate all the way to the store. I doubt that Apple or Google build the app from the repo. To add, there are currently discussions underway in the German parliament to give our secret services (namely the notorious Verfassungsschutz) the power to compromise IT systems (Bundestrojaner). I'd trust even the government not that much these times.
  - ClumsyPilot 6y ago
    I agree, its a shame we can't actually trace it all the way from git. As for conpromising IT systems, arent they just going to bw on a level playing field with NSA and others?

f1refly 6y ago

Requires google play services to run with the developers not caring at all

mxscho 6y ago
Technically, you are free to implement the Exposure Notification [1] API for your own potentially open-source alternative of Google Play Services, right? Or why would this currently not be possible? [1] https://en.wikipedia.org/wiki/Exposure_Notification https://en.wikipedia.org/wiki/Exposure_Notification
- johannes1234321 6y ago
  People are working on that: https://github.com/corona-warn-app/cwa-app-android/issues/75 https://github.com/corona-warn-app/cwa-app-android/issues/75 Edit: and also see https://github.com/theScrabi/CoraLibre-android-sdk/ https://github.com/theScrabi/CoraLibre-android-sdk/
DangerousPie 6y ago
What fraction of the German mobile phone user base is running Android without Google services? My guess would be <1%

s9w 6y ago

This was officially released just a few hours ago by the way: https://play.google.com/store/apps/details?id=de.rki.coronawarnapp https://play.google.com/store/apps/details?id=de.rki.coronaw...

Kovah 6y ago

It is still unbelievable, that the German government paid 20 Million Euro for these apps. Hopefully the request for details about the contracts[1] will be answered by the corresponding gov agency. [1]: https://fragdenstaat.de/anfrage/kostenaufstellung-der-corona-tracing-app/ https://fragdenstaat.de/anfrage/kostenaufstellung-der-corona...

s9w 6y ago
Compared to the billions to potentially trillions of euros Germany will be paying for the lockdown and the other EU states this is basically nothing I think.
- GreenHeuristics 6y ago
  20 million is still 20 million
  - johannes1234321 6y ago
    For a system which interacts with Germany's divers structure of health authorities. Last time I counted there were 374 municipal health authorities, all of them have to be integrated. Also the laboratories and doctors. In addition they set up two calling centers (a technical hotline and a health hotline) and did multiple audits for security and for epidimological sense. And then all of it, frontend and backend, is open source. For a government project that is cheap! (25cent per citizen) Edit: source for the 374 is the table on https://de.m.wikipedia.org/wiki/Gesundheitsamt https://de.m.wikipedia.org/wiki/Gesundheitsamt
- polycaster 6y ago
  Provided the app will solve all those problems single-handedly. There are voices arguing the impact will be about 0.
  - s9w 6y ago
    It will absolutely be 0, I didn't mean to imply otherwise.

bjarneh 6y ago

I have to say the main reason I did not install my country's (Norway) corona-tracing-app is that they said it could not be made safe if the source code was public. Nice to see other countries do the right thing.

rozab 6y ago
Does your government have much of an open source culture? I think these arguments were already had (and won) in the UK, for instance. https://github.com/alphagov https://github.com/alphagov https://github.com/hmrc https://github.com/hmrc https://github.com/UKHomeOffice https://github.com/UKHomeOffice
- gspr 6y ago
  > Does your government have much of an open source culture? I'd say no, but it's a bit surprising, because it does have a pretty decent open data culture. The weather [1] and mapping [2] data services are world-class, for example. [1] https://hjelp.yr.no/hc/en-us/articles/360009342833-XML-weather-forecasts https://hjelp.yr.no/hc/en-us/articles/360009342833-XML-weath... [2] https://kartverket.no/en/data/Open-and-Free-geospatial-data-from-Norway/ https://kartverket.no/en/data/Open-and-Free-geospatial-data-...
  - birktj 6y ago
    Even though it is getting better, I would argue Norway still has a pretty bad open data culture. As far as I know Kartverket has only released the N50 with the more detailed N5 data still not being available to the public. The biggest pain points for me is the fact that marine depth data of a certain resolution is classified information [1] and they still wont release nautical maps for free. I am hoping the open trend will continue because the Norwegian government sits on some really high quality data that could see a lot of interesting uses. [1] https://www.kartverket.no/en/data/bathymetric-data-and-DTM-of-the-Seabed/ https://www.kartverket.no/en/data/bathymetric-data-and-DTM-o...
- marvin 6y ago
  Norway botched the contact tracing app completely, certainly politically and maybe technically. Centralized storage of GPS & bluetooth data and refusal to open-source (which is a tacit acknowledgement of insufficient confidence in security -- of the personal movements of the whole population, no less). Statements from researchers involved in the technical development that citizens have a responsibility to give up their personal information. Poor debate and communication regarding the choice of centralized tracing. Then followed up with painfully weak statements from politicians and researchers that this is a truly exceptional one-time-only transgression of privacy, which will be rolled back permanently on a specified date and never be construed as precedence for similar actions in the future. FHI, responsible for the app deployment (the Norwegian version of the CDC), has previously betrayed the trust of the public by refusing to destroy DNA samples of exonerated suspects and witnesses. Skepticism towards their ethics and degree of principled data management is highly justified. Digital contract tracing seems dubious anyway, but thankfully we're in a position at the moment where it is definitely unnecessary. Might be relavant in a few months though.

fock 6y ago

are the (known) Android bluetooth-RCEs fixed everywhere, where this runs?

Uhrheber 6y ago
Of course not, why are you even asking?

hathym 6y ago

France also released the source code of its StopCovid19 app[1] [1] https://gitlab.inria.fr/stopcovid19 https://gitlab.inria.fr/stopcovid19

xorfish 6y ago

https://github.com/DP-3T/documents https://github.com/DP-3T/documents Here is the protocol it is based on.

zelphirkalt 6y ago

Will this app work without permanent Internet connection? (Will it buffer its data until one has working connection again and then upload data?)

jhrmnn 6y ago
It uses this under the hood https://www.macrumors.com/guide/exposure-notification/ https://www.macrumors.com/guide/exposure-notification/ So I believe it does work without internet connection
dominik3 6y ago
Yes, it does work without an permanent internet connection. The whole point of this app is to be decentralized. No data is uploaded unless you share your sent tokens if you are infected. This requires an approval from the health departments to prevent abuse. The apps download the tokens of infected persons and check if they had contact locally on the device.
neuronic 6y ago
Yes, app keeps local track of of IDs that you have been in extended contact with. App only receives IDs of infected people and compares them. If YOU are infected you will need to consent to your local list of met IDs to be uploaded, so others in your list can be notified.

WhyNotHugo 6y ago

I'm very happy to see so many countries moving in the right direction. It's not every country, but we're slowing moving there. :)

vault 6y ago

Do you know how many contact tracing apps I can install? Do they conflict with each other? I'm thinking about travellers who often cross borders.

berdario 6y ago
I installed 2 of the ones using the Exposure Notification API, just to check what happens in this circumstance (the german app is implemented differently, though) and Android allows access to it to only one app at a time. You can choose/enable/disable manually which app you want to grant access to the api.

sdiw 6y ago

India also released source code of Aarogya Setu app https://github.com/nic-delhi/AarogyaSetu_Android https://github.com/nic-delhi/AarogyaSetu_Android

tpetry 6y ago

The more interesting part is that security audits for the frontend did find multiple high risk security issues in the app, which have been fixed by the developers. But the organisation was not allowed to make a security audit of the backend. I mean the most critical part security wise was not allowed to be verified. This does not feel good.

HissingMachine 6y ago

I'm a hopeless optimist and romantic when it comes to software, and I really would have liked to see the covid app being done in some way that built confidence and inspired hope and optimism. My vision was that it could have been more like open source Eurovision where developers that participate had the chance to introduce themselves to the public, and some of the development and design could have been screen cast to us unfortunate souls trapped in our homes for months for some entertainment value and inspiration for budding developers. But eh, instead we get something good, something bad, but much of the same old same old, and in the end, I'm staying as far as I can from these apps as a result. Sad, there was a chance to do something amazing.

buboard 6y ago

Covid has been curtailed without the need for these apps (in all the places that opened up). Why do people insist on pushing them to people? There is no evidence they work, even when with months of testing. No matter how anonymized you try to make them, the authorities and evil state actors will find ways to abuse the data -- it's like a law of nature now that all data will be abused. E.g. in case of a bombing or riots, the police can arrest bystanders and use phones to tell who was standing next to whom. Pushing these for security theater has long term bad consequences. I was hoping people would know that after the 1000th repetition but alas, people are incorrigible https://www.nbcnews.com/tech/tech-news/coronavirus-contact-tracing-apps-were-tech-s-chance-step-they-n1230211 https://www.nbcnews.com/tech/tech-news/coronavirus-contact-t... https://www.wired.co.uk/article/contact-tracing-app-isle-of-wight-trial https://www.wired.co.uk/article/contact-tracing-app-isle-of-...

JoeSmithson 6y ago
Covid has been curtailed mainly with extremely expensive lockdowns. The purpose of the apps is to control the spread going forward, without lockdown.
- _-___________-_ 6y ago
  > Covid has been curtailed mainly with extremely expensive lockdowns. Citation needed. We don't know conclusively what curtailed it in places where it has been curtailed, since there were many different control approaches occurring at the same time. There are also several countries where lockdown effectively ended weeks or months ago, and spread is not occurring despite a lack of widespread use of these apps, not to mention a variety of approaches to lockdown itself with no obvious correlation between strictness of the approach and mortality/infection stats.

rmoriz 6y ago

While everyone is looking at the code or press releases, only very few seem to research about how Bluetooth distance measurement works and if it's reliable enough with thousand of different smartphones out there having different chips and antenna characteristics. The app may be great but the design simply seems not to work as expected.

mttjj 6y ago

@dang, can we get a title update to include the apostrophe in "Germany's"? Or just change the title to how it's documented on the site? "Corona-Warn-App: The official COVID-19 exposure notification app for Germany"