16 ms·

Luca App: CCC calls for a moratorium

575 points by hacka22 5y ago

cameronperot 5y ago
Related discussion from a few weeks ago about the mentioned licensing issue: https://news.ycombinator.com/item?id=26644053 https://news.ycombinator.com/item?id=26644053
seesawtron 5y ago
Is this one of the many examples of German government wasting taxpayer's money?
- pantalaimon 5y ago
  Yes. Especially since there is already a government funded app (whose developers also make a much more competent impression) which is scheduled to receive similar functionality as the Luca app with the next update.
  - black_puppydog 5y ago
    And which doesn't have to plan for a business model post-pandemic.
    - lampe3 5y ago
      It does not need to. Its open source and funded by the government Its not run by a private company which only thinks about money.
      - weird-eye-issue 5y ago
        That was probably his point already
- lampe3 5y ago
  yes and its super easy to just create random valid qr codes: https://wolf128058.gitlab.io/schmudo2go/ https://wolf128058.gitlab.io/schmudo2go/ also they don't have any rate limit on the sms service... so anybody can build a loop and call the sms endpoint... More fails: - https://github.com/mame82/misc/blob/master/luca_traceIds.md https://github.com/mame82/misc/blob/master/luca_traceIds.md - https://lucatrack.de/ https://lucatrack.de/ - development private and public key in the repo ( not harmful but a bad sign) - more that i forgot
  - read_if_gay_ 5y ago
    What do these QR codes do?
    - sReinwald 5y ago
      The QR codes let you "check in" at venues that use Luca to make contact tracing possible.
    - lampe3 5y ago
      These qr codes should only valid after you verified that you are an real person. So the health department could call you. This was done by SMS but the verification of an account does not check against that SMS verification but its just a simple else/if on the client.
- simfoo 5y ago
  Yes. This is what you get when incompetent officials jump on any offered solution that promises to make their awful track record of "digitalization" projects look better. Of course without listening to actual experts and instead looking for buzzwords.
  - pantalaimon 5y ago
    Exhibit B: Ubirch and their 5 Blockchains https://www.heise.de/news/Digitaler-Corona-Impfpass-IBM-Ubirch-und-fuenf-Blockchains-5076161.html https://www.heise.de/news/Digitaler-Corona-Impfpass-IBM-Ubir...
    - thinkberg 5y ago
      An issue with the reporting is that the ubirch standard solution is confused all the time with the actual project. Especially since it is mostly guessing, not knowledge of the actual technology behind it.
      - tastroder 5y ago
        Can't really blame the reporting there imho. At the time that article was written they actively marketed towards the blockchain solution and the government side wasn't really forthcoming with public information. Luckily that changed a few days ago but this article in particular is from March 9th.
  - dathinab 5y ago
    The absurd thing is like CCC mentioned the german covid app (state payed, kinda decentralized, very privacy respecting contact tracing app) does not only potentially cover some of the cases (if people are close to each other and the phone can detect it using Bluetooth tokens) but also seem to be getting a feature "to handle meetings" in a privacy friendly way.
- martin_a 5y ago
  May I present to you that the government spend over 430 million Euro for external consultants in the last year? That's just a raise of about 46% in comparison to 2019...
fidesomnes 5y ago
A hacker club condemning government software contracts is pretty hilarious and irreverent.
majkinetor 5y ago
This is amazing. There should be hacker clubs in each country double checking all suspicious public procurements.
- lampe3 5y ago
  I'm part of the CCC in Hamburg We will move to stockholm and I'm thinking of creating one :)
  - jtdev 5y ago
    Do you know if CCC supports regional chapters?
    - tazjin 5y ago
      Yes, they're called Erfa-Kreise: https://www.ccc.de/en/club/erfas https://www.ccc.de/en/club/erfas They're all in German-speaking countries.
    - martin_a 5y ago
      In Germany there are various "local subsidiaries", mainly in or around larger cities. They are also often somewhat tied/connected with local hackerspaces and whatnot.
  - tazjin 5y ago
    Good luck. In countries like Germany or Norway there is a culture of hacker organisations sustaining themselves financially via their members. This culture doesn't exist in Sweden, and the spaces and organisations that aren't subsidised by government funds or universities all disappear after a few years. (Source: Lived in all three countries, was active in such organisations in all three countries)
    - zibzab 5y ago
      Oh, there are tons of hackerspaces in Sweden. Its just that they are either tied to universities, startup clusters or for kids. I guess you were simply not in contact with the right people.
jtdev 5y ago
Is there a U.S. based Chaos Computer Club (CCC) or CCC like group?
- lupire 5y ago
  There's defcon, but it's more of annual conference than an ongoing group that works together.
  - lozaning 5y ago
    There's also the local DC chapters, http://dc612.org/ http://dc612.org/ has been going strong up in Minneapolis for years.
- black_puppydog 5y ago
  My understanding as an outsider who has never been to the US is that the US hacker scene is quite different. One notable difference is a much closer connection to e.g. intelligence services. On the other hand, the relationship to democratic processes, as well as the stance on state/federal involvement in IT problem spaces, seems to differ between Germany and the US. Again: I'm an outsider and would actually like to hear from others how they see this.
  - pizzapill 5y ago
    > One notable difference is a much closer connection to e.g. intelligence services. Some CCC hackers had a pretty good relationship with the Russian KGB. They got information about a wide range of US military secrets including details about the Space Defense Initiative (SDI). They were so successful that they wound up dead and a movie was made about them. Since then the CCC has to be heavily infiltrated by all kinds of Intelligence Services.
    - pantalaimon 5y ago
      > Since then the CCC has to be heavily infiltrated by all kinds of Intelligence Services. I think this more served as a cautionary tale to not get involved with this kind of agencies at all.
ThePhysicist 5y ago
The Luca app really is a complete train wreck. And what's worse is that the federal governments don't even have any direct control over the app itself, they just bought access to the contact tracing data for 12 months from the company operating the app. Meanwhile the company controls the app and all connected user accounts and can repurpose it in whichever way they see fit (and they already announced they have plans for the app beyond the pandemic). It's absolutely mind-boggling to me how our government(s) can get the idea to "rent" contact tracing data from a private company like this, it just reeks of corruption. I wasn't a big fan of the Covid tracing app in the beginning, but in retrospect the concept of that app seems miles ahead of the current situation with the Luca app.
- catdog 5y ago
  > I wasn't a big fan of the Covid tracing app in the beginning, but in retrospect the concept of that app seems miles ahead of the current situation with the Luca app. I think the concept behind is really solid and a great example for what is possible w/o invading privacy. The only problem is that development got very very slow after the initial release and a lot of potential was wasted. E.g. adding some kind of check in feature was already discussed mid last year but it took them until now to pick that idea up.
  - tgragnato 5y ago
    I only have positive things to say about our contact tracing application. It’s open source https://github.com/immuni-app https://github.com/immuni-app. It’s simple: contact tracing only, easy for non technical people. And has minimal tracking (I only see a periodic ping to get.immuni.gov.it)
    - kitestramuort 5y ago
      Yeah. Too bad nobody downloaded it
      - mjlawson 5y ago
timdaub 5y ago
Haha I'm waiting for Smudo's disstrack!
- lampe3 5y ago
  There are enough diss tracks and mentions of fanta4 in german hip hop I always found them whack...
  - timdaub 5y ago
    jein
    - lampe3 5y ago
      I was in Hamburg,Germany in the 2000's and listen to stuff like samy deluxe and beginner ect ect. Almost all of my friends did not consider fanta 4 to be rap music but rather pop music :)
deleted 5y ago
[deleted]
wyck 5y ago
There is so much incompetency in governmental IT/software decisions and software it's actually sad. Is it a product of smart people simply not working in this sector or corruption?. It seems from the outside to be filled with imbeciles masquerading as administrators. We need to somehow make the government way more accountable, if only there was an organization that could do that, we could call it the media.
- Swizec 5y ago
  Government IT: pays government salaries Private sector: pays more than lawyers and surgeons even if yiu never graduated college Gee I wonder where smart ambitious people will go
  - bierjunge 5y ago
    Exactly. I dropped out of university, so I can't be hired by any German agency/office, because a degree is a hard requirement. But I can work for them as a consultant asking for more than two-three times the money... The salary is a joke, I've made their base salary, which requires at least bachelors degree, as part time working student in private sector. There is only one reason to work for the government in Germany and it's called "Verbeamtung" (a legal state where you are not employed, but appointed for government service, it's almost impossible to get fired and you pay little to no taxes, etc.), but the whole office politics and long decision making channels are awful (source: me working for a company owned by the local government years ago).
    - nkmnz 5y ago
      Agree with everything, except for the point about taxes. Income tax for employees, state officials („Beamte“) and self employed people in Germany is exactly the same regarding the tax rates. The difference is social insurance, especially pensions and health insurance.
      - dathinab 5y ago
        And pensions, and health insurance, state officials (Beamte) get a (non small part) part of the health insurance payed by the state (at least that was the case in many state official jobs until recently). When you get old and had a not supper high paying job this can easily be as if you had gotten 50%-100% more salery!! At the same time they (state officials) complain they get to little. It's completely stupid. AND at the same time non "Beamte" state officials do not get any such benefits, nor especially good pensions or reasonable pay or absurd employment protections(1) or even a proper working contract... (1): If you are a "ver_beamte_ter" state official it's close to impossible to get fired as long as you don't idk. commit some serve crime (and a few other special cases). So you are not getting any work done because you don't care anyone, no problem keep your job. You mess up all your work, ok you still have a job. You working moral degraded to a degree you are basically unemployable and still you have a full paycheck every moth and keep your job. Through besides serve crimes there are a few things which can cost you your job, but they are easy to avoid. Anyway this doesn't meant there are not honest, proper employees in such positions it's just very hard for them to keep their motivation.
ArmandGrillet 5y ago
What was wrong with Corona-Warn-App? Looked amazing compared to ‎TousAntiCovid last year yet I'm learning here that it isn't improved anymore and I haven't seen ads for it anywhere. The differences between German states and the way news are communicated is so complicated, and it's been more than a year that it's like that now. As a French citizen living in Germany I can get vaccinated if I go back to France soon (the French state literally sent me an email to tell me that as they know I'm living in a foreign country), meanwhile I keep on reading that some German states are trying to get more vaccines than the others (e.g. Sputnik in Bavaria) and I cannot get a free PCR in a state where I do not live. Why having such friendly fire in your own country, especially when my health insurance works at the national level?
- step21 5y ago
  It is still improved. The actually also want to add this kind of check-in (almost done) but it might be blocked by apple/google as the terms of use of the contact tracing API forbids use of additional data.
  - foepys 5y ago
    As far as I know CWA will save it on the device and thus comply with all requirements for contact tracing apps.
- perlgeek 5y ago
  Nothing really. Luca app just had more hype/better marketing.
- usrusr 5y ago
  The CWA is developed under extreme scrutiny wrt privacy. It's really good at what it does, so good that even the CCC gave it it's blessing (despite being made by companies that would traditionally be considered evil empire in CCC, which really puts CCC in a very favorable light for objectivity). But that strength makes it the absolute opposite of move fast and break things.
  - 5y ago
KingOfCoders 5y ago
Germany paid 20M+ for this already, without owning anything (code, data, ...).
ndom91 5y ago
What's the difference between this Luca app and the "official" German covid tracing app (Corona-Warn)? Or are they the same thing?
- perlgeek 5y ago
  The official app stores all its data decentralized, only cryptographic hashes are stored centrally that each device then can check locally for potential risks. In the Luca app, the user's location data is stored centrally, and the states can then purchase a license to access data of potentially risky contacts. (BTW the public health offices are notoriously overworked during the pandemic, so it's not clear to me if they'd even manage to do anything with this data).
  - catdog 5y ago
    > (BTW the public health offices are notoriously overworked during the pandemic, so it's not clear to me if they'd even manage to do anything with this data). Anecdotally most of them are completely overwhelmed because of the currently fairly high case numbers and effective contact tracing does not really happen anymore. Also they mostly live in the technological stone age so they have a hard time scaling it up [1]. [1] https://www.dw.com/en/german-health-care-tackling-covid-with-paper-pen-and-a-fax-machine/a-56360491 https://www.dw.com/en/german-health-care-tackling-covid-with...
- pantalaimon 5y ago
  Luca app is made by a private company and stores personal data on a central server. The official Corona Warn App uses the Exposure Notification Framework and does not share any personal data.
renewiltord 5y ago
Yeah, I knew this shit was gonna happen. I installed literally zero of these apps.
- wccrawford 5y ago
  I like the idea of these apps, but none of them were advertised enough near me to think that others would be using them, so they were all pointless. And of course, they were rushed out the door, so they'd probably have quite a few problems.
leipert 5y ago
Source code for the app can be found here: https://gitlab.com/lucaapp https://gitlab.com/lucaapp
- perlgeek 5y ago
  ... though in the past many developers have complained that the source code didn't seem to be the one from which the app on the appstore was built and/or it was quite out of date.
  - tastroder 5y ago
    The former, at the time the gitlab repos for the mobile clients were published they contained code newer than what was available in the app stores.
qwertox 5y ago
This is a privacy issue, in the country which thinks so highly of the GDPR. So it's not something which they should be able to sweep under the rug as if nothing happened. As the article explains, the issue is far bigger than just vulnerabilities, it's about how politics supported this app. If this would be some other thing, like the implementation of a video surveillance system in the political center of Berlin, or any other important place, they would have taken care to at least adhere to the basics in how to give whom the job to do this, how it will be licensed/owned, how it will be run, what happens with the data. A thorough check of the company would have been made. But in this case? It's a small startup with no expertise whatsoever in data protection, expecting the silliest terms and conditions, and the politicians are just glad to throw the money at them, and even expecting citizens to install this app if they want to take part in public life. This is as crazy as it gets and shows how incapable they are of controlling this pandemic, even how little they care to seriously work on it, and I wonder how much this represents what they have been doing over the last decade in general. I was glad to install the Corona-Warn-App and am a bit sad that there are so few people using it, but it was implemented correctly. Not only from a technical point of view. But should any of these apps become a requirement to participate in public life, I'd take it as far as going to jail for not installing or uninstalling it.
- catdog 5y ago
  > This is as crazy as it gets and shows how incapable they are of controlling this pandemic, even how little they care to seriously work on it, and I wonder how much this represents what they have been doing over the last decade in general. Fully agree, the whole "Merkel era" was an era of political stagnation. The pandemic relentlessly uncovered that. But now we've reached a new low, German politicians seem completely unwilling to fight the pandemic anymore despite a 3. wave caused by the B.1.1.7 variant building up rapidly. It's crazy times, the luca app disaster is just one manifestation of it.
GekkePrutser 5y ago
Wow this is bad, I'm sorry to hear it's already mandatory in one German state. I'm really surprised Germany is playing so loose and fast with privacy as they're known to be one of the countries with the strictest privacy laws around. By the way how does this work being mandatory with people that don't own a smartphone??
- glitchcrab 5y ago
  It stated in the article that you can purchase a fob which can be used in place of the smartphone app.
- read_if_gay_ 5y ago
  > I'm really surprised Germany is playing so loose and fast with privacy You're surprised because you're expecting politicians to have consistent principles, but it's just about what's convenient right now. This is an inherent issue with having elections every couple of years.
- usrusr 5y ago
  It's more like playing loose and slow. For a year, all reasonable projects aiming for a pragmatic compromise between privacy and checkin tracking were reliably choked by privacy concerns. It's hardly surprising that now that opinions are shifting, the only projects remaining are those most lacking in privacy awareness. The aware have long given up. And opinions are shifting in no small part because unsurprisingly, the ineffective pen & paper tracking that was deployed instead was suffering from quite real privacy problems that weren't theoretic at all (routinely breached not by ssh keys in the wrong hands or some backdoor hidden in the code but by just asking nicely).
fock 5y ago
worst thing is, my university seemingly developed something similar (which has been used for exams for half a year now) already: https://qroniton.eu/ https://qroniton.eu/ But I guess kickbacks for using something created by state employees are not as good as for something new from a private enterprise (with blockchain! - they silently removed it, when the CCC called that out and now the CEO claims: "we've never used blockchain").
s_dev 5y ago
Ireland has a Covid19 tracker app that can easily intergrate with other EU covid apps. NearForm the Developer sells a branded version for a million. It's also open source with a generous licence. Why didn't Germany use that? Corruption.
- detaro 5y ago
  The equivalent app to that in Germany launched a month earlier than Irelands, is also open-source and integrated with other countries' (like Irlands), and not the app talked about here.
JanNash 5y ago
If a lot of people with good pentesting skills started bashing the hell out of this app in an organized yet brutal fashion, that could be very interesting and likely legally problematic. I wouldn’t advise anyone to do that. Ever. Honestly.
- hda111 5y ago
  I’m not sure how this is responsible disclosure what some people are doing. I know it’s not the ccc itself but ccc is always encouraging to responsible disclosure afaik.
ehershey 5y ago
I’m shocked (and amused) how little of this is comprehensible to me without more context.
euske 5y ago
Is there any government contact tracing app that is considered successful by tech people? Japan had a similar problem: its contact tracing app, COCOA, was originally developed by volunteers in open source. Then the government "purchased" the app and subsidized it to some medium IT vendor, which further subsidized it to six (!) other companies. The app has been regarded clusterfuck and failed to support the latest version of iOS/Android.
- lordfosco 5y ago
  The official german contact tracing app [1] that has been developed by two major german corporations on behalf of the german government has received quite good feedback from tech-media as well as the CCC. Similar to other governmentally supported apps this one has been made open-source beginning with the first drafts, is based on the provided framework by Apple and Google, does not store privacy relevant data on centralized servers and even follows the 10 baseline rules the CCC has published. That actually makes it even more sad that the german government reaches out to the Luca app developers and buys their service for such a huge amount of money - although there is a product that is on par service wise and way better from a privacy perspective. [1]: https://www.bundesregierung.de/breg-de/themen/corona-warn-app/corona-warn-app-englisch https://www.bundesregierung.de/breg-de/themen/corona-warn-ap...
bigpeopleareold 5y ago
> Mecklenburg-Western Pomerania even wants to make installation of the app a prerequisite for participating in public life. This is the trajectory for everything essential it seems. Want to function in the modern world? You need a pocket computer with approved applications on it to do increasingly important, but basic tasks. Banking, health, transportation, etc. are all sitting on the pocket computer that can watch where you go and track what you do to the minute.
abductee_hg 5y ago
german hiphop star smudo has been promoting the luca app in german tv, etc. - funnily enough the same smudo who was a very vocal "Napster bad!!11eleven" voice back in the day ... however napster would at least meet 2 op the ccc criteria(instead of 0, like luca :)

575 points by hacka22 5y ago

Related discussion from a few weeks ago about the mentioned licensing issue: https://news.ycombinator.com/item?id=26644053 https://news.ycombinator.com/item?id=26644053

seesawtron 5y ago

Is this one of the many examples of German government wasting taxpayer's money?

pantalaimon 5y ago
Yes. Especially since there is already a government funded app (whose developers also make a much more competent impression) which is scheduled to receive similar functionality as the Luca app with the next update.
- black_puppydog 5y ago
  And which doesn't have to plan for a business model post-pandemic.
  - lampe3 5y ago
    It does not need to. Its open source and funded by the government Its not run by a private company which only thinks about money.
    - weird-eye-issue 5y ago
      That was probably his point already
lampe3 5y ago
yes and its super easy to just create random valid qr codes: https://wolf128058.gitlab.io/schmudo2go/ https://wolf128058.gitlab.io/schmudo2go/ also they don't have any rate limit on the sms service... so anybody can build a loop and call the sms endpoint... More fails: - https://github.com/mame82/misc/blob/master/luca_traceIds.md https://github.com/mame82/misc/blob/master/luca_traceIds.md - https://lucatrack.de/ https://lucatrack.de/ - development private and public key in the repo ( not harmful but a bad sign) - more that i forgot
- read_if_gay_ 5y ago
  What do these QR codes do?
  - sReinwald 5y ago
    The QR codes let you "check in" at venues that use Luca to make contact tracing possible.
  - lampe3 5y ago
    These qr codes should only valid after you verified that you are an real person. So the health department could call you. This was done by SMS but the verification of an account does not check against that SMS verification but its just a simple else/if on the client.
simfoo 5y ago
Yes. This is what you get when incompetent officials jump on any offered solution that promises to make their awful track record of "digitalization" projects look better. Of course without listening to actual experts and instead looking for buzzwords.
- pantalaimon 5y ago
  Exhibit B: Ubirch and their 5 Blockchains https://www.heise.de/news/Digitaler-Corona-Impfpass-IBM-Ubirch-und-fuenf-Blockchains-5076161.html https://www.heise.de/news/Digitaler-Corona-Impfpass-IBM-Ubir...
  - thinkberg 5y ago
    An issue with the reporting is that the ubirch standard solution is confused all the time with the actual project. Especially since it is mostly guessing, not knowledge of the actual technology behind it.
    - tastroder 5y ago
      Can't really blame the reporting there imho. At the time that article was written they actively marketed towards the blockchain solution and the government side wasn't really forthcoming with public information. Luckily that changed a few days ago but this article in particular is from March 9th.
- dathinab 5y ago
  The absurd thing is like CCC mentioned the german covid app (state payed, kinda decentralized, very privacy respecting contact tracing app) does not only potentially cover some of the cases (if people are close to each other and the phone can detect it using Bluetooth tokens) but also seem to be getting a feature "to handle meetings" in a privacy friendly way.
martin_a 5y ago
May I present to you that the government spend over 430 million Euro for external consultants in the last year? That's just a raise of about 46% in comparison to 2019...

fidesomnes 5y ago

A hacker club condemning government software contracts is pretty hilarious and irreverent.

majkinetor 5y ago

This is amazing. There should be hacker clubs in each country double checking all suspicious public procurements.

lampe3 5y ago
I'm part of the CCC in Hamburg We will move to stockholm and I'm thinking of creating one :)
- jtdev 5y ago
  Do you know if CCC supports regional chapters?
  - tazjin 5y ago
    Yes, they're called Erfa-Kreise: https://www.ccc.de/en/club/erfas https://www.ccc.de/en/club/erfas They're all in German-speaking countries.
  - martin_a 5y ago
    In Germany there are various "local subsidiaries", mainly in or around larger cities. They are also often somewhat tied/connected with local hackerspaces and whatnot.
- tazjin 5y ago
  Good luck. In countries like Germany or Norway there is a culture of hacker organisations sustaining themselves financially via their members. This culture doesn't exist in Sweden, and the spaces and organisations that aren't subsidised by government funds or universities all disappear after a few years. (Source: Lived in all three countries, was active in such organisations in all three countries)
  - zibzab 5y ago
    Oh, there are tons of hackerspaces in Sweden. Its just that they are either tied to universities, startup clusters or for kids. I guess you were simply not in contact with the right people.

jtdev 5y ago

Is there a U.S. based Chaos Computer Club (CCC) or CCC like group?

lupire 5y ago
There's defcon, but it's more of annual conference than an ongoing group that works together.
- lozaning 5y ago
  There's also the local DC chapters, http://dc612.org/ http://dc612.org/ has been going strong up in Minneapolis for years.
black_puppydog 5y ago
My understanding as an outsider who has never been to the US is that the US hacker scene is quite different. One notable difference is a much closer connection to e.g. intelligence services. On the other hand, the relationship to democratic processes, as well as the stance on state/federal involvement in IT problem spaces, seems to differ between Germany and the US. Again: I'm an outsider and would actually like to hear from others how they see this.
- pizzapill 5y ago
  > One notable difference is a much closer connection to e.g. intelligence services. Some CCC hackers had a pretty good relationship with the Russian KGB. They got information about a wide range of US military secrets including details about the Space Defense Initiative (SDI). They were so successful that they wound up dead and a movie was made about them. Since then the CCC has to be heavily infiltrated by all kinds of Intelligence Services.
  - pantalaimon 5y ago
    > Since then the CCC has to be heavily infiltrated by all kinds of Intelligence Services. I think this more served as a cautionary tale to not get involved with this kind of agencies at all.

ThePhysicist 5y ago

The Luca app really is a complete train wreck. And what's worse is that the federal governments don't even have any direct control over the app itself, they just bought access to the contact tracing data for 12 months from the company operating the app. Meanwhile the company controls the app and all connected user accounts and can repurpose it in whichever way they see fit (and they already announced they have plans for the app beyond the pandemic). It's absolutely mind-boggling to me how our government(s) can get the idea to "rent" contact tracing data from a private company like this, it just reeks of corruption. I wasn't a big fan of the Covid tracing app in the beginning, but in retrospect the concept of that app seems miles ahead of the current situation with the Luca app.

catdog 5y ago
> I wasn't a big fan of the Covid tracing app in the beginning, but in retrospect the concept of that app seems miles ahead of the current situation with the Luca app. I think the concept behind is really solid and a great example for what is possible w/o invading privacy. The only problem is that development got very very slow after the initial release and a lot of potential was wasted. E.g. adding some kind of check in feature was already discussed mid last year but it took them until now to pick that idea up.
- tgragnato 5y ago
  I only have positive things to say about our contact tracing application. It’s open source https://github.com/immuni-app https://github.com/immuni-app. It’s simple: contact tracing only, easy for non technical people. And has minimal tracking (I only see a periodic ping to get.immuni.gov.it)
  - kitestramuort 5y ago
    Yeah. Too bad nobody downloaded it
    - mjlawson 5y ago

timdaub 5y ago

Haha I'm waiting for Smudo's disstrack!

lampe3 5y ago
There are enough diss tracks and mentions of fanta4 in german hip hop I always found them whack...
- timdaub 5y ago
  jein
  - lampe3 5y ago
    I was in Hamburg,Germany in the 2000's and listen to stuff like samy deluxe and beginner ect ect. Almost all of my friends did not consider fanta 4 to be rap music but rather pop music :)

deleted 5y ago

[deleted]

wyck 5y ago

There is so much incompetency in governmental IT/software decisions and software it's actually sad. Is it a product of smart people simply not working in this sector or corruption?. It seems from the outside to be filled with imbeciles masquerading as administrators. We need to somehow make the government way more accountable, if only there was an organization that could do that, we could call it the media.

Swizec 5y ago
Government IT: pays government salaries Private sector: pays more than lawyers and surgeons even if yiu never graduated college Gee I wonder where smart ambitious people will go
- bierjunge 5y ago
  Exactly. I dropped out of university, so I can't be hired by any German agency/office, because a degree is a hard requirement. But I can work for them as a consultant asking for more than two-three times the money... The salary is a joke, I've made their base salary, which requires at least bachelors degree, as part time working student in private sector. There is only one reason to work for the government in Germany and it's called "Verbeamtung" (a legal state where you are not employed, but appointed for government service, it's almost impossible to get fired and you pay little to no taxes, etc.), but the whole office politics and long decision making channels are awful (source: me working for a company owned by the local government years ago).
  - nkmnz 5y ago
    Agree with everything, except for the point about taxes. Income tax for employees, state officials („Beamte“) and self employed people in Germany is exactly the same regarding the tax rates. The difference is social insurance, especially pensions and health insurance.
    - dathinab 5y ago
      And pensions, and health insurance, state officials (Beamte) get a (non small part) part of the health insurance payed by the state (at least that was the case in many state official jobs until recently). When you get old and had a not supper high paying job this can easily be as if you had gotten 50%-100% more salery!! At the same time they (state officials) complain they get to little. It's completely stupid. AND at the same time non "Beamte" state officials do not get any such benefits, nor especially good pensions or reasonable pay or absurd employment protections(1) or even a proper working contract... (1): If you are a "ver_beamte_ter" state official it's close to impossible to get fired as long as you don't idk. commit some serve crime (and a few other special cases). So you are not getting any work done because you don't care anyone, no problem keep your job. You mess up all your work, ok you still have a job. You working moral degraded to a degree you are basically unemployable and still you have a full paycheck every moth and keep your job. Through besides serve crimes there are a few things which can cost you your job, but they are easy to avoid. Anyway this doesn't meant there are not honest, proper employees in such positions it's just very hard for them to keep their motivation.

ArmandGrillet 5y ago

What was wrong with Corona-Warn-App? Looked amazing compared to ‎TousAntiCovid last year yet I'm learning here that it isn't improved anymore and I haven't seen ads for it anywhere. The differences between German states and the way news are communicated is so complicated, and it's been more than a year that it's like that now. As a French citizen living in Germany I can get vaccinated if I go back to France soon (the French state literally sent me an email to tell me that as they know I'm living in a foreign country), meanwhile I keep on reading that some German states are trying to get more vaccines than the others (e.g. Sputnik in Bavaria) and I cannot get a free PCR in a state where I do not live. Why having such friendly fire in your own country, especially when my health insurance works at the national level?

step21 5y ago
It is still improved. The actually also want to add this kind of check-in (almost done) but it might be blocked by apple/google as the terms of use of the contact tracing API forbids use of additional data.
- foepys 5y ago
  As far as I know CWA will save it on the device and thus comply with all requirements for contact tracing apps.
perlgeek 5y ago
Nothing really. Luca app just had more hype/better marketing.
usrusr 5y ago
The CWA is developed under extreme scrutiny wrt privacy. It's really good at what it does, so good that even the CCC gave it it's blessing (despite being made by companies that would traditionally be considered evil empire in CCC, which really puts CCC in a very favorable light for objectivity). But that strength makes it the absolute opposite of move fast and break things.
- 5y ago

KingOfCoders 5y ago

Germany paid 20M+ for this already, without owning anything (code, data, ...).

ndom91 5y ago

What's the difference between this Luca app and the "official" German covid tracing app (Corona-Warn)? Or are they the same thing?

perlgeek 5y ago
The official app stores all its data decentralized, only cryptographic hashes are stored centrally that each device then can check locally for potential risks. In the Luca app, the user's location data is stored centrally, and the states can then purchase a license to access data of potentially risky contacts. (BTW the public health offices are notoriously overworked during the pandemic, so it's not clear to me if they'd even manage to do anything with this data).
- catdog 5y ago
  > (BTW the public health offices are notoriously overworked during the pandemic, so it's not clear to me if they'd even manage to do anything with this data). Anecdotally most of them are completely overwhelmed because of the currently fairly high case numbers and effective contact tracing does not really happen anymore. Also they mostly live in the technological stone age so they have a hard time scaling it up [1]. [1] https://www.dw.com/en/german-health-care-tackling-covid-with-paper-pen-and-a-fax-machine/a-56360491 https://www.dw.com/en/german-health-care-tackling-covid-with...
pantalaimon 5y ago
Luca app is made by a private company and stores personal data on a central server. The official Corona Warn App uses the Exposure Notification Framework and does not share any personal data.

renewiltord 5y ago

Yeah, I knew this shit was gonna happen. I installed literally zero of these apps.

wccrawford 5y ago
I like the idea of these apps, but none of them were advertised enough near me to think that others would be using them, so they were all pointless. And of course, they were rushed out the door, so they'd probably have quite a few problems.

leipert 5y ago

Source code for the app can be found here: https://gitlab.com/lucaapp https://gitlab.com/lucaapp

perlgeek 5y ago
... though in the past many developers have complained that the source code didn't seem to be the one from which the app on the appstore was built and/or it was quite out of date.
- tastroder 5y ago
  The former, at the time the gitlab repos for the mobile clients were published they contained code newer than what was available in the app stores.

qwertox 5y ago

This is a privacy issue, in the country which thinks so highly of the GDPR. So it's not something which they should be able to sweep under the rug as if nothing happened. As the article explains, the issue is far bigger than just vulnerabilities, it's about how politics supported this app. If this would be some other thing, like the implementation of a video surveillance system in the political center of Berlin, or any other important place, they would have taken care to at least adhere to the basics in how to give whom the job to do this, how it will be licensed/owned, how it will be run, what happens with the data. A thorough check of the company would have been made. But in this case? It's a small startup with no expertise whatsoever in data protection, expecting the silliest terms and conditions, and the politicians are just glad to throw the money at them, and even expecting citizens to install this app if they want to take part in public life. This is as crazy as it gets and shows how incapable they are of controlling this pandemic, even how little they care to seriously work on it, and I wonder how much this represents what they have been doing over the last decade in general. I was glad to install the Corona-Warn-App and am a bit sad that there are so few people using it, but it was implemented correctly. Not only from a technical point of view. But should any of these apps become a requirement to participate in public life, I'd take it as far as going to jail for not installing or uninstalling it.

catdog 5y ago
> This is as crazy as it gets and shows how incapable they are of controlling this pandemic, even how little they care to seriously work on it, and I wonder how much this represents what they have been doing over the last decade in general. Fully agree, the whole "Merkel era" was an era of political stagnation. The pandemic relentlessly uncovered that. But now we've reached a new low, German politicians seem completely unwilling to fight the pandemic anymore despite a 3. wave caused by the B.1.1.7 variant building up rapidly. It's crazy times, the luca app disaster is just one manifestation of it.

GekkePrutser 5y ago

Wow this is bad, I'm sorry to hear it's already mandatory in one German state. I'm really surprised Germany is playing so loose and fast with privacy as they're known to be one of the countries with the strictest privacy laws around. By the way how does this work being mandatory with people that don't own a smartphone??

glitchcrab 5y ago
It stated in the article that you can purchase a fob which can be used in place of the smartphone app.
read_if_gay_ 5y ago
> I'm really surprised Germany is playing so loose and fast with privacy You're surprised because you're expecting politicians to have consistent principles, but it's just about what's convenient right now. This is an inherent issue with having elections every couple of years.
usrusr 5y ago
It's more like playing loose and slow. For a year, all reasonable projects aiming for a pragmatic compromise between privacy and checkin tracking were reliably choked by privacy concerns. It's hardly surprising that now that opinions are shifting, the only projects remaining are those most lacking in privacy awareness. The aware have long given up. And opinions are shifting in no small part because unsurprisingly, the ineffective pen & paper tracking that was deployed instead was suffering from quite real privacy problems that weren't theoretic at all (routinely breached not by ssh keys in the wrong hands or some backdoor hidden in the code but by just asking nicely).

fock 5y ago

worst thing is, my university seemingly developed something similar (which has been used for exams for half a year now) already: https://qroniton.eu/ https://qroniton.eu/ But I guess kickbacks for using something created by state employees are not as good as for something new from a private enterprise (with blockchain! - they silently removed it, when the CCC called that out and now the CEO claims: "we've never used blockchain").

s_dev 5y ago

Ireland has a Covid19 tracker app that can easily intergrate with other EU covid apps. NearForm the Developer sells a branded version for a million. It's also open source with a generous licence. Why didn't Germany use that? Corruption.

detaro 5y ago
The equivalent app to that in Germany launched a month earlier than Irelands, is also open-source and integrated with other countries' (like Irlands), and not the app talked about here.

JanNash 5y ago

If a lot of people with good pentesting skills started bashing the hell out of this app in an organized yet brutal fashion, that could be very interesting and likely legally problematic. I wouldn’t advise anyone to do that. Ever. Honestly.

hda111 5y ago
I’m not sure how this is responsible disclosure what some people are doing. I know it’s not the ccc itself but ccc is always encouraging to responsible disclosure afaik.

ehershey 5y ago

I’m shocked (and amused) how little of this is comprehensible to me without more context.

euske 5y ago

Is there any government contact tracing app that is considered successful by tech people? Japan had a similar problem: its contact tracing app, COCOA, was originally developed by volunteers in open source. Then the government "purchased" the app and subsidized it to some medium IT vendor, which further subsidized it to six (!) other companies. The app has been regarded clusterfuck and failed to support the latest version of iOS/Android.

lordfosco 5y ago
The official german contact tracing app [1] that has been developed by two major german corporations on behalf of the german government has received quite good feedback from tech-media as well as the CCC. Similar to other governmentally supported apps this one has been made open-source beginning with the first drafts, is based on the provided framework by Apple and Google, does not store privacy relevant data on centralized servers and even follows the 10 baseline rules the CCC has published. That actually makes it even more sad that the german government reaches out to the Luca app developers and buys their service for such a huge amount of money - although there is a product that is on par service wise and way better from a privacy perspective. [1]: https://www.bundesregierung.de/breg-de/themen/corona-warn-app/corona-warn-app-englisch https://www.bundesregierung.de/breg-de/themen/corona-warn-ap...

bigpeopleareold 5y ago

> Mecklenburg-Western Pomerania even wants to make installation of the app a prerequisite for participating in public life. This is the trajectory for everything essential it seems. Want to function in the modern world? You need a pocket computer with approved applications on it to do increasingly important, but basic tasks. Banking, health, transportation, etc. are all sitting on the pocket computer that can watch where you go and track what you do to the minute.

abductee_hg 5y ago

german hiphop star smudo has been promoting the luca app in german tv, etc. - funnily enough the same smudo who was a very vocal "Napster bad!!11eleven" voice back in the day ... however napster would at least meet 2 op the ccc criteria(instead of 0, like luca :)