5 ms·

I have to say the main reason I did not install my country's (Norway) corona-tracing-app is that they said it could not be made safe if the source code was publ

I have to say the main reason I did not install my country's (Norway) corona-tracing-app is that they said it could not be made safe if the source code was public. Nice to see other countries do the right thing.

rozab 6y ago
Does your government have much of an open source culture? I think these arguments were already had (and won) in the UK, for instance. https://github.com/alphagov https://github.com/alphagov https://github.com/hmrc https://github.com/hmrc https://github.com/UKHomeOffice https://github.com/UKHomeOffice
- gspr 6y ago
  > Does your government have much of an open source culture? I'd say no, but it's a bit surprising, because it does have a pretty decent open data culture. The weather [1] and mapping [2] data services are world-class, for example. [1] https://hjelp.yr.no/hc/en-us/articles/360009342833-XML-weather-forecasts https://hjelp.yr.no/hc/en-us/articles/360009342833-XML-weath... [2] https://kartverket.no/en/data/Open-and-Free-geospatial-data-from-Norway/ https://kartverket.no/en/data/Open-and-Free-geospatial-data-...
  - birktj 6y ago
    Even though it is getting better, I would argue Norway still has a pretty bad open data culture. As far as I know Kartverket has only released the N50 with the more detailed N5 data still not being available to the public. The biggest pain points for me is the fact that marine depth data of a certain resolution is classified information [1] and they still wont release nautical maps for free. I am hoping the open trend will continue because the Norwegian government sits on some really high quality data that could see a lot of interesting uses. [1] https://www.kartverket.no/en/data/bathymetric-data-and-DTM-of-the-Seabed/ https://www.kartverket.no/en/data/bathymetric-data-and-DTM-o...
- marvin 6y ago
  Norway botched the contact tracing app completely, certainly politically and maybe technically. Centralized storage of GPS & bluetooth data and refusal to open-source (which is a tacit acknowledgement of insufficient confidence in security -- of the personal movements of the whole population, no less). Statements from researchers involved in the technical development that citizens have a responsibility to give up their personal information. Poor debate and communication regarding the choice of centralized tracing. Then followed up with painfully weak statements from politicians and researchers that this is a truly exceptional one-time-only transgression of privacy, which will be rolled back permanently on a specified date and never be construed as precedence for similar actions in the future. FHI, responsible for the app deployment (the Norwegian version of the CDC), has previously betrayed the trust of the public by refusing to destroy DNA samples of exonerated suspects and witnesses. Skepticism towards their ethics and degree of principled data management is highly justified. Digital contract tracing seems dubious anyway, but thankfully we're in a position at the moment where it is definitely unnecessary. Might be relavant in a few months though.
- bjarneh 6y ago
  > Does your government have much of an open source culture? I would say no. Some years ago (2012) I was somewhat hopeful. I attended a conference hosted by "Friprog senteret" (Free software center) called GoOpen. "Fripro senteret" was a small but very effective organization that got great publicity (the crown prince held a speech together with the Wikipedia founder etc.), and in general open source and open standards seemed to something people cared about, at least when informed about problems of lock-in etc. A few years later (2014) Friprog-senteret was de-funded, and it just seems like the whole society drifted towards convenience over privacy/ethics etc.
s_dev 6y ago
Same in Ireland -- outsourced to to some App Dev company with SAP links. The definition of soft corruption -- very angry with our government. A text book example of an app/software that should absolutely be open source.
- DangerousPie 6y ago
  How is outsourcing the development of an app the "definition of soft corruption"?! Would you prefer the government spent a few years to train up their own app developers before they build the app? FWIW, the German app was largely built by SAP too.
  - s_dev 6y ago
    >How is outsourcing the development of an app the "definition of soft corruption"? Because the app is clearly in the public interest. Funded by public money and simply cannot be reliably secure without being open source. This is just some guys in gov getting kickbacks by awarding the contract to their mates.
- bjarneh 6y ago
  > to some App Dev company with SAP links. Ouch, that in itself does not sound very convincing. Only experience I've had with SAP is when an earlier employer of mine bought SAP and after 6 months the login still did not work. SAP had to bring some Windows PC's of their own for us to login on, which were "setup correctly".
  - addandsubtract 6y ago
    SAP wrote the German Corona app.
flurdy 6y ago
Just making something public is not enough though. The UK made their app public https://github.com/nhsx/COVID-19-app-iOS-BETA https://github.com/nhsx/COVID-19-app-iOS-BETA But app only, none of the server-side projects. Germany and Italy https://github.com/immuni-app https://github.com/immuni-app also made public some of their server-side components. So there is no chance I will install the UK app as I have no idea what they will do with the data. Obviously we cannot be sure the open sourced code is what their servers (and even app) actually runs but it gives more confidence.
- FeepingCreature 6y ago
  If the public app and API works as-designed, then there is simply no information made available to be uploaded that could be personally identifying. So what the server is doing, in a way, doesn't matter. edit: The risk would be breaking into the backend and spamming exposure notifications. In that case, just take down the server and restore from backup.
- JoeSmithson 6y ago
  If you can see what data is leaving your phone, and you don't trust the author, then I don't see what difference the server side code being OS makes...? There's not really anything they can do to comprehensively prove what they do with the data after it has been received. What are your concerns with the data it sends?
- bjarneh 6y ago
  > Just making something public is not enough though. I agree, certainly the server-side part of the project must be open for this to make sense.
fsflover 6y ago
I guess you may be interested in this petition to make all publicly funded software free: https://publiccode.eu https://publiccode.eu
altacc 6y ago
To add to this, Norway has had to stop it's data collection and delete existing data because the agency in charge of data protection ruled that it's excessive. Amnesty did a review of tracing apps and listed Norway as one of the worst for privacy: https://www.amnesty.org/en/latest/news/2020/06/bahrain-kuwait-norway-contact-tracing-apps-danger-for-privacy/ https://www.amnesty.org/en/latest/news/2020/06/bahrain-kuwai...

rozab 6y ago

Does your government have much of an open source culture? I think these arguments were already had (and won) in the UK, for instance. https://github.com/alphagov https://github.com/alphagov https://github.com/hmrc https://github.com/hmrc https://github.com/UKHomeOffice https://github.com/UKHomeOffice

gspr 6y ago
> Does your government have much of an open source culture? I'd say no, but it's a bit surprising, because it does have a pretty decent open data culture. The weather [1] and mapping [2] data services are world-class, for example. [1] https://hjelp.yr.no/hc/en-us/articles/360009342833-XML-weather-forecasts https://hjelp.yr.no/hc/en-us/articles/360009342833-XML-weath... [2] https://kartverket.no/en/data/Open-and-Free-geospatial-data-from-Norway/ https://kartverket.no/en/data/Open-and-Free-geospatial-data-...
- birktj 6y ago
  Even though it is getting better, I would argue Norway still has a pretty bad open data culture. As far as I know Kartverket has only released the N50 with the more detailed N5 data still not being available to the public. The biggest pain points for me is the fact that marine depth data of a certain resolution is classified information [1] and they still wont release nautical maps for free. I am hoping the open trend will continue because the Norwegian government sits on some really high quality data that could see a lot of interesting uses. [1] https://www.kartverket.no/en/data/bathymetric-data-and-DTM-of-the-Seabed/ https://www.kartverket.no/en/data/bathymetric-data-and-DTM-o...
marvin 6y ago
Norway botched the contact tracing app completely, certainly politically and maybe technically. Centralized storage of GPS & bluetooth data and refusal to open-source (which is a tacit acknowledgement of insufficient confidence in security -- of the personal movements of the whole population, no less). Statements from researchers involved in the technical development that citizens have a responsibility to give up their personal information. Poor debate and communication regarding the choice of centralized tracing. Then followed up with painfully weak statements from politicians and researchers that this is a truly exceptional one-time-only transgression of privacy, which will be rolled back permanently on a specified date and never be construed as precedence for similar actions in the future. FHI, responsible for the app deployment (the Norwegian version of the CDC), has previously betrayed the trust of the public by refusing to destroy DNA samples of exonerated suspects and witnesses. Skepticism towards their ethics and degree of principled data management is highly justified. Digital contract tracing seems dubious anyway, but thankfully we're in a position at the moment where it is definitely unnecessary. Might be relavant in a few months though.
bjarneh 6y ago
> Does your government have much of an open source culture? I would say no. Some years ago (2012) I was somewhat hopeful. I attended a conference hosted by "Friprog senteret" (Free software center) called GoOpen. "Fripro senteret" was a small but very effective organization that got great publicity (the crown prince held a speech together with the Wikipedia founder etc.), and in general open source and open standards seemed to something people cared about, at least when informed about problems of lock-in etc. A few years later (2014) Friprog-senteret was de-funded, and it just seems like the whole society drifted towards convenience over privacy/ethics etc.

s_dev 6y ago

Same in Ireland -- outsourced to to some App Dev company with SAP links. The definition of soft corruption -- very angry with our government. A text book example of an app/software that should absolutely be open source.

DangerousPie 6y ago
How is outsourcing the development of an app the "definition of soft corruption"?! Would you prefer the government spent a few years to train up their own app developers before they build the app? FWIW, the German app was largely built by SAP too.
- s_dev 6y ago
  >How is outsourcing the development of an app the "definition of soft corruption"? Because the app is clearly in the public interest. Funded by public money and simply cannot be reliably secure without being open source. This is just some guys in gov getting kickbacks by awarding the contract to their mates.
bjarneh 6y ago
> to some App Dev company with SAP links. Ouch, that in itself does not sound very convincing. Only experience I've had with SAP is when an earlier employer of mine bought SAP and after 6 months the login still did not work. SAP had to bring some Windows PC's of their own for us to login on, which were "setup correctly".
- addandsubtract 6y ago
  SAP wrote the German Corona app.

flurdy 6y ago

Just making something public is not enough though. The UK made their app public https://github.com/nhsx/COVID-19-app-iOS-BETA https://github.com/nhsx/COVID-19-app-iOS-BETA But app only, none of the server-side projects. Germany and Italy https://github.com/immuni-app https://github.com/immuni-app also made public some of their server-side components. So there is no chance I will install the UK app as I have no idea what they will do with the data. Obviously we cannot be sure the open sourced code is what their servers (and even app) actually runs but it gives more confidence.

FeepingCreature 6y ago
If the public app and API works as-designed, then there is simply no information made available to be uploaded that could be personally identifying. So what the server is doing, in a way, doesn't matter. edit: The risk would be breaking into the backend and spamming exposure notifications. In that case, just take down the server and restore from backup.
JoeSmithson 6y ago
If you can see what data is leaving your phone, and you don't trust the author, then I don't see what difference the server side code being OS makes...? There's not really anything they can do to comprehensively prove what they do with the data after it has been received. What are your concerns with the data it sends?
bjarneh 6y ago
> Just making something public is not enough though. I agree, certainly the server-side part of the project must be open for this to make sense.

fsflover 6y ago

I guess you may be interested in this petition to make all publicly funded software free: https://publiccode.eu https://publiccode.eu

altacc 6y ago

To add to this, Norway has had to stop it's data collection and delete existing data because the agency in charge of data protection ruled that it's excessive. Amnesty did a review of tracing apps and listed Norway as one of the worst for privacy: https://www.amnesty.org/en/latest/news/2020/06/bahrain-kuwait-norway-contact-tracing-apps-danger-for-privacy/ https://www.amnesty.org/en/latest/news/2020/06/bahrain-kuwai...