3 ms·

How does one know whether the app in playstore is compiled from this very repo + specific commit and not some other fork of it? Edit: This is not questioning t

How does one know whether the app in playstore is compiled from this very repo + specific commit and not some other fork of it? Edit: This is not questioning this particular app. A lot of govt are making their tracing app open source [1]. Since making it open source is supposed to increase trust hence the question. [1] India app: https://github.com/nic-delhi/AarogyaSetu_Android https://github.com/nic-delhi/AarogyaSetu_Android

phepranto 6y ago
The technical director gave a press conference and confirmed that they'll add reproducable builds in the near future.
- Hackbraten 6y ago
  Until then, I hope that infosec researchers are going to scrutinize the binaries.
  - FakeRemore 6y ago
    Germany's the home of the CCC. I'm sure people will be scrutinizing it.
johannes1234321 6y ago
For one: because this would be extra work within a short time frame. The source shows no extension points. Outside small tech circles nobody would have said anything if it were closed, if they have bad intention they could have made it closed. For second: we can easily see that the app doesn't use GPS or similar, which is a nice indication For third: Germans overall trust their government to not lie as much as other governments For forth: Researchers will reverse the app The only way this thing can work is, if the population trusts it, installs it and keeps their phone on. If the population doesn't trust it, it's doomed. It's in the self-interest of the project to be trustworthy and transparent. If you understand German you might enjoy this podcast with two of the developers: https://ukw.fm/ukw030-die-corona-warn-app/ https://ukw.fm/ukw030-die-corona-warn-app/
- the_gipsy 6y ago
  This is not answering the question beyond "it would require some effort to do so". It is not unusual to have a different binary published, than what's in a public repo. The following points you go on about are mostly irrelevant.
  - johannes1234321 6y ago
    Well, then don't use the app from the app store and compile it yourself ...
    - chopin 6y ago
      Does that work, though? Afaik the app needs Google's or Apple's blessing to use the API.
      - johannes1234321 6y ago
        No idea, but as those are closed source one can have the same doubts, so you need an OpenSource alternative to the API, which is in the works in order to be used in that app: https://github.com/theScrabi/CoraLibre-android-sdk/ https://github.com/theScrabi/CoraLibre-android-sdk/ and https://github.com/corona-warn-app/cwa-app-android/issues/75 https://github.com/corona-warn-app/cwa-app-android/issues/75 That combined with an Android based on AOSP and trust issues should be reduced (while the bad government can still track you using cell towers and for that app one could still place Bluetooth beacons everywhere and the server's could still store more information (while the only keys transmitted are those of infected, which is quite little) ... so yeah, pick your level of conspiracy
    - the_gipsy 6y ago
      I don't care, I just find it odd how you didn't really answer but got off a tangent on how trustworthy of this app we should be.
- raxxorrax 6y ago
  > For third: Germans overall trust their government to not lie as much as other governments Trust is good, control is better. But in this case the fault is certainly with shitty app stores and mobile OS.
ClumsyPilot 6y ago
I don't see how your criticism applies to this app in particular, rather than the playstore in general. How do you know you can trust instagram/google maps/ any other common app on your phone? I would trust German government way more than i trust just about any corporate entity I can think of.
- sudeepj 6y ago
  The comment is a general one. Also it is not a criticism, it was a question because lot of govt are making their tracing app open source. However, since this is a tracing app and being open source would imply "look, our app is clean, check our code if you do not trust us". Off-course making it open source has other benefits too. > How do you know you can trust instagram/google maps/ any other common app on your phone? I don't. If I am using it I know that I have no way to validate or enforce what happens with my data.
- chopin 6y ago
  You not only need to trust the German government but any intermediate all the way to the store. I doubt that Apple or Google build the app from the repo. To add, there are currently discussions underway in the German parliament to give our secret services (namely the notorious Verfassungsschutz) the power to compromise IT systems (Bundestrojaner). I'd trust even the government not that much these times.
  - ClumsyPilot 6y ago
    I agree, its a shame we can't actually trace it all the way from git. As for conpromising IT systems, arent they just going to bw on a level playing field with NSA and others?

phepranto 6y ago

The technical director gave a press conference and confirmed that they'll add reproducable builds in the near future.

Hackbraten 6y ago
Until then, I hope that infosec researchers are going to scrutinize the binaries.
- FakeRemore 6y ago
  Germany's the home of the CCC. I'm sure people will be scrutinizing it.

johannes1234321 6y ago

For one: because this would be extra work within a short time frame. The source shows no extension points. Outside small tech circles nobody would have said anything if it were closed, if they have bad intention they could have made it closed. For second: we can easily see that the app doesn't use GPS or similar, which is a nice indication For third: Germans overall trust their government to not lie as much as other governments For forth: Researchers will reverse the app The only way this thing can work is, if the population trusts it, installs it and keeps their phone on. If the population doesn't trust it, it's doomed. It's in the self-interest of the project to be trustworthy and transparent. If you understand German you might enjoy this podcast with two of the developers: https://ukw.fm/ukw030-die-corona-warn-app/ https://ukw.fm/ukw030-die-corona-warn-app/

the_gipsy 6y ago
This is not answering the question beyond "it would require some effort to do so". It is not unusual to have a different binary published, than what's in a public repo. The following points you go on about are mostly irrelevant.
- johannes1234321 6y ago
  Well, then don't use the app from the app store and compile it yourself ...
  - chopin 6y ago
    Does that work, though? Afaik the app needs Google's or Apple's blessing to use the API.
    - johannes1234321 6y ago
      No idea, but as those are closed source one can have the same doubts, so you need an OpenSource alternative to the API, which is in the works in order to be used in that app: https://github.com/theScrabi/CoraLibre-android-sdk/ https://github.com/theScrabi/CoraLibre-android-sdk/ and https://github.com/corona-warn-app/cwa-app-android/issues/75 https://github.com/corona-warn-app/cwa-app-android/issues/75 That combined with an Android based on AOSP and trust issues should be reduced (while the bad government can still track you using cell towers and for that app one could still place Bluetooth beacons everywhere and the server's could still store more information (while the only keys transmitted are those of infected, which is quite little) ... so yeah, pick your level of conspiracy
  - the_gipsy 6y ago
    I don't care, I just find it odd how you didn't really answer but got off a tangent on how trustworthy of this app we should be.
raxxorrax 6y ago
> For third: Germans overall trust their government to not lie as much as other governments Trust is good, control is better. But in this case the fault is certainly with shitty app stores and mobile OS.

ClumsyPilot 6y ago

I don't see how your criticism applies to this app in particular, rather than the playstore in general. How do you know you can trust instagram/google maps/ any other common app on your phone? I would trust German government way more than i trust just about any corporate entity I can think of.

sudeepj 6y ago
The comment is a general one. Also it is not a criticism, it was a question because lot of govt are making their tracing app open source. However, since this is a tracing app and being open source would imply "look, our app is clean, check our code if you do not trust us". Off-course making it open source has other benefits too. > How do you know you can trust instagram/google maps/ any other common app on your phone? I don't. If I am using it I know that I have no way to validate or enforce what happens with my data.
chopin 6y ago
You not only need to trust the German government but any intermediate all the way to the store. I doubt that Apple or Google build the app from the repo. To add, there are currently discussions underway in the German parliament to give our secret services (namely the notorious Verfassungsschutz) the power to compromise IT systems (Bundestrojaner). I'd trust even the government not that much these times.
- ClumsyPilot 6y ago
  I agree, its a shame we can't actually trace it all the way from git. As for conpromising IT systems, arent they just going to bw on a level playing field with NSA and others?