4 ms·

Ok, this is getting strange. There are two ways to get test results: - it's automatically sent to email (if they have it) - you can download it from ezdravlje

Ok, this is getting strange. There are two ways to get test results: - it's automatically sent to email (if they have it) - you can download it from ezdravlje.rs portal The test I shared above is the one I got on email. However, I went to portal, downloaded pdf, and now I have two copies. They're different! IDs and all the data are the same, but QR codes are different. This is the new one: https://pcr.euprava.gov.rs/validate.php?cqcode=1641923234g3DWOTqw9NocsR3M9sx2AnAAwbPVByAjUD$uXqiuc1q0gJjGwI https://pcr.euprava.gov.rs/validate.php?cqcode=1641923234g3D... Timestamp on new pdf is: 1641923234, which is GMT: Tuesday, 11. January 2022. 17:47:14 So it appears that timestamp is related to when pdf is generated, and when you download it from the portal it's generated at that point of time, i.e. there are no pdf documents sitting on government server! So this timestamp is definitely no proof of forgery. But test ID might be - that one is still suspicious. And one more thing, when I switch tabs with my two QR codes - page content is the same but shifted a bit. I didn't look into html/css to see what's different.

zo1 5y ago
This is super important for everyone to see. The timestamp is not proof of time of test but rather the time that the test was "generated" for download. Anyone prominent on Twitter should respond and assist with this information. I've done these kinds of systems many times in the past and there could be any amount of reasons why a timestamp is included like this. Especially with weird government regulations, policies and rules that mandate all sorts of info to be included inside government documents. Like adding a year or date to when a company was registered to a company's company registration no.
- kkjjkgjjgg 5y ago
  Nah, let's just run with the story first, could generate a fair amount of clicks!
  - SpicyLemonZest 5y ago
    I've been beating this drum for a while, but HN really needs to just ban direct links to Twitter threads. I can't remember the last time I saw one on the front page that was actually true.
    - aspenmayer 5y ago
      So new policy is to shoot the messenger, then?
      - SpicyLemonZest 5y ago
        When the messenger is spreading false information all the time, yeah, you shouldn't let them be a messenger anymore. I wasn't being hyperbolic: the vast majority of Twitter threads that I've seen make it to the HN frontpage, easily above 75%, are factually incorrect ragebait.
        aspenmayer 5y ago
        Sucks to be the fourth messenger then. Blanket bans would also block post by amazing Twitter users like foone. It sounds like you just don’t like or use Twitter. Is that accurate?
        SpicyLemonZest 5y ago
        No, I go on Twitter multiple times a week and generally like it. Any active Twitter user will tell you that it's common for false and misleading tweets to go viral. That doesn't mean the site is bad, but it does mean it's a bad idea to go around posting random tweets on news aggregators, since there'll always be someone tweeting any take you can think of.
        aspenmayer 5y ago
        > That doesn't mean the site is bad, but it does mean it's a bad idea to go around posting random tweets on news aggregators, since there'll always be someone tweeting any take you can think of. We’re not talking about random tweets, we’re talking about on-topic tweets from posters like foone which consistently post relevant content. You’re throwing the good out with the bad and claiming that folks submitting off topic links are bad apples that ruin the whole barrel. I just don’t find your logical argument internally consistent or rational.
DominikPeters 5y ago
Can you see from your records whether the confirmation number (i.e. 7601263-535518) is fixed at the time of the report, e.g. sent as part of the email? An alternative that comes to my mind is that the number is assigned when the report is first generated, which could in principle explain why Djokovic's numbers are out of order if the first time he accessed his PDF was on 26 Dec.
- grujicd 5y ago
  My two PDFs with different QR codes have the same test ID (7601263-535518). So that one is not generated on the fly. But we don't know 100% if it's generated on database insert (altough it very much looks like that), or if there are some batches depending on lab, PCR batch, etc.
penumbra_3 5y ago
Yup, its timestamp for creation of PDF. Just tested on my old PCR tests and timestamp i get in URL is from 11.1.2022. and PCR swab was done on 27.2.2021.
grujicd 5y ago
I have 2 more datapoints. My wife went with me to the testing on the same date. If you're negative on rapid test, they usually take PCR as well. Since she was negative on the first one, there was a PCR too. These are her QR urls: Rapid test: https://pcr.euprava.gov.rs/validate.php?cqcode=16415703349MJi4QNr3Ohxz3cgzFrtDBM4CSNHfigF$tg4AiN4YoVJSPtDUO https://pcr.euprava.gov.rs/validate.php?cqcode=16415703349MJ... Timestamp: 1641570334, time: GMT: Friday, 7. January 2022. 15:45:34 PCR: https://pcr.euprava.gov.rs/validate.php?cqcode=1641924832NyL5YS!wsSf!8sEKBcvi!hpbktN2TKm8BJv11xGmKwndWBeXvj https://pcr.euprava.gov.rs/validate.php?cqcode=1641924832NyL... Timestamp: 1641924832, time: GMT: Tuesday, 11. January 2022. 18:13:52 I downloaded PCR from portal today, that's why it has today's timestamp. What's interesting is that her test IDs are 7601574 and 7631146 while they were taken within 15 minutes from each other. There's some 30k difference, and I think Serbia runs around 40k tests a day. PCR samples are sent to central lab and processed later, that would explain why PCR's ID is much higher. However I don't think we have definite proof of how these test IDs are generated. Different labs could be assigned batches of IDs, PCR tests itself could have preassigned IDs (you can see they have same ID when you're tested, but I'm not sure it's the same ID as presented in results). If test ID is generated when results are inserted into database, then they should always be incremental and Novak's test IDs point to forgery. But there could be other explanations. My conclusions: - timestamps are not proof of forgery - test IDs are suspicious, but we can't be sure.
- pajowu 5y ago
  Hey, it'd be great if you'd reach out to zerforschung at hallo@zerforschung.org :)
  - grujicd 5y ago
    I've sent a brief email with links to these posts. Let's see if they publish a correction!
- mandarino 5y ago
  Great analysis!
- truthhunter 5y ago

zo1 5y ago

This is super important for everyone to see. The timestamp is not proof of time of test but rather the time that the test was "generated" for download. Anyone prominent on Twitter should respond and assist with this information. I've done these kinds of systems many times in the past and there could be any amount of reasons why a timestamp is included like this. Especially with weird government regulations, policies and rules that mandate all sorts of info to be included inside government documents. Like adding a year or date to when a company was registered to a company's company registration no.

kkjjkgjjgg 5y ago
Nah, let's just run with the story first, could generate a fair amount of clicks!
- SpicyLemonZest 5y ago
  I've been beating this drum for a while, but HN really needs to just ban direct links to Twitter threads. I can't remember the last time I saw one on the front page that was actually true.
  - aspenmayer 5y ago
    So new policy is to shoot the messenger, then?
    - SpicyLemonZest 5y ago
      When the messenger is spreading false information all the time, yeah, you shouldn't let them be a messenger anymore. I wasn't being hyperbolic: the vast majority of Twitter threads that I've seen make it to the HN frontpage, easily above 75%, are factually incorrect ragebait.
      - aspenmayer 5y ago
        Sucks to be the fourth messenger then. Blanket bans would also block post by amazing Twitter users like foone. It sounds like you just don’t like or use Twitter. Is that accurate?
        SpicyLemonZest 5y ago
        No, I go on Twitter multiple times a week and generally like it. Any active Twitter user will tell you that it's common for false and misleading tweets to go viral. That doesn't mean the site is bad, but it does mean it's a bad idea to go around posting random tweets on news aggregators, since there'll always be someone tweeting any take you can think of.
        aspenmayer 5y ago
        > That doesn't mean the site is bad, but it does mean it's a bad idea to go around posting random tweets on news aggregators, since there'll always be someone tweeting any take you can think of. We’re not talking about random tweets, we’re talking about on-topic tweets from posters like foone which consistently post relevant content. You’re throwing the good out with the bad and claiming that folks submitting off topic links are bad apples that ruin the whole barrel. I just don’t find your logical argument internally consistent or rational.

DominikPeters 5y ago

Can you see from your records whether the confirmation number (i.e. 7601263-535518) is fixed at the time of the report, e.g. sent as part of the email? An alternative that comes to my mind is that the number is assigned when the report is first generated, which could in principle explain why Djokovic's numbers are out of order if the first time he accessed his PDF was on 26 Dec.

grujicd 5y ago
My two PDFs with different QR codes have the same test ID (7601263-535518). So that one is not generated on the fly. But we don't know 100% if it's generated on database insert (altough it very much looks like that), or if there are some batches depending on lab, PCR batch, etc.

penumbra_3 5y ago

Yup, its timestamp for creation of PDF. Just tested on my old PCR tests and timestamp i get in URL is from 11.1.2022. and PCR swab was done on 27.2.2021.

grujicd 5y ago

I have 2 more datapoints. My wife went with me to the testing on the same date. If you're negative on rapid test, they usually take PCR as well. Since she was negative on the first one, there was a PCR too. These are her QR urls: Rapid test: https://pcr.euprava.gov.rs/validate.php?cqcode=16415703349MJi4QNr3Ohxz3cgzFrtDBM4CSNHfigF$tg4AiN4YoVJSPtDUO https://pcr.euprava.gov.rs/validate.php?cqcode=16415703349MJ... Timestamp: 1641570334, time: GMT: Friday, 7. January 2022. 15:45:34 PCR: https://pcr.euprava.gov.rs/validate.php?cqcode=1641924832NyL5YS!wsSf!8sEKBcvi!hpbktN2TKm8BJv11xGmKwndWBeXvj https://pcr.euprava.gov.rs/validate.php?cqcode=1641924832NyL... Timestamp: 1641924832, time: GMT: Tuesday, 11. January 2022. 18:13:52 I downloaded PCR from portal today, that's why it has today's timestamp. What's interesting is that her test IDs are 7601574 and 7631146 while they were taken within 15 minutes from each other. There's some 30k difference, and I think Serbia runs around 40k tests a day. PCR samples are sent to central lab and processed later, that would explain why PCR's ID is much higher. However I don't think we have definite proof of how these test IDs are generated. Different labs could be assigned batches of IDs, PCR tests itself could have preassigned IDs (you can see they have same ID when you're tested, but I'm not sure it's the same ID as presented in results). If test ID is generated when results are inserted into database, then they should always be incremental and Novak's test IDs point to forgery. But there could be other explanations. My conclusions: - timestamps are not proof of forgery - test IDs are suspicious, but we can't be sure.

pajowu 5y ago
Hey, it'd be great if you'd reach out to zerforschung at hallo@zerforschung.org :)
- grujicd 5y ago
  I've sent a brief email with links to these posts. Let's see if they publish a correction!
mandarino 5y ago
Great analysis!
truthhunter 5y ago