Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TracePrivately – open-source sample app using Apple's contact tracing framework

github.com

Post reply on HN
Print view View original

11–20 of 45 posts

Re: TracePrivately – open-source sample app using Apple's contact tracing framework

#11

Post by kapilvt »

londons_explore wrote: post #6
exprez135 wrote: post #4

One note: the README lists one of the objectives as to "Remain open source for independent verification", but the project is licensed under the MIT license. Since it's being designed to be a turn-key solution for governments to use, wouldn't this allow them to distribute closed-source and (potentially maliciously) modified versions?

But license it GPL, and governments won't use it at all...

In the usa its more like they are free to ignore, licenses are rooted in copyright law aka ownership, per recent Supreme Court Case, states can freely violate copyright... https://arstechnica.com/tech-policy/2020/03/supreme-court-ru...

Re: TracePrivately – open-source sample app using Apple's contact tracing framework

#12

Post by geofft »

exprez135 wrote: post #4

One note: the README lists one of the objectives as to "Remain open source for independent verification", but the project is licensed under the MIT license. Since it's being designed to be a turn-key solution for governments to use, wouldn't this allow them to distribute closed-source and (potentially maliciously) modified versions?

1. You can't put GPL'd apps on the Apple App Store, because the terms conflict. For instance, you cannot redistribute an app you've received from the App Store. (At best you can use code with a specific waiver e.g. https://github.com/mobile-shell/mosh/blob/master/COPYING.iOS .)

2. It seems a tiny bit optimistic to expect a malicious government to abide by copyright law.

I think the goal of making this open-source is to enable third-party review to avoid innocent mistakes, not to allow you to audit that the code hasn't been maliciously and intentionally modified. There isn't a great way to audit that the binary you download from the App Store matches specific source, for instance.

Re: TracePrivately – open-source sample app using Apple's contact tracing framework

#13

Post by devit »

I don't quite understand why Apple and Google are releasing an API instead of a single system application.

This is going to create a gigantic mess as governments with limited software development competence slowly release incompatible and partially broken applications, while Apple and Google could just deploy a single solution via a system update.

Also, it's much easier to make it mandatory if it's a system app (and obviously it needs to be mandatory to be useful).

Re: TracePrivately – open-source sample app using Apple's contact tracing framework

#15

Post by jedieaston »

devit wrote: post #13

I don't quite understand why Apple and Google are releasing an API instead of a single system application. This is going to create a gigantic mess as governments with limited software development competence slowly release incompatible and partially broken applications, while Apple and Google could just deploy a single solution via a system update. Also, it's much easier to make it mandatory if it's a system app (and…

The governments each want their own app so data isn't shared with other governments, so either Apple sends out 100+ versions of an iOS update, or, they expose an API and let the governments ingest it into an app that they control, which adds privacy for the user by making it opt-in.

Re: TracePrivately – open-source sample app using Apple's contact tracing framework

#16

Post by devit »

jedieaston wrote: post #15
devit wrote: post #13

I don't quite understand why Apple and Google are releasing an API instead of a single system application. This is going to create a gigantic mess as governments with limited software development competence slowly release incompatible and partially broken applications, while Apple and Google could just deploy a single solution via a system update. Also, it's much easier to make it mandatory if it's a system app (and…

The governments each want their own app so data isn't shared with other governments, so either Apple sends out 100+ versions of an iOS update, or, they expose an API and let the governments ingest it into an app that they control, which adds privacy for the user by making it opt-in.

But no data is shared with the government, so there isn't any data that gets shared with "other governments".

All that is shared is a randomly generated key that can only be used by other smartphones to determine if any of the ids that they have collected come from the key.

Re: TracePrivately – open-source sample app using Apple's contact tracing framework

#17

Post by bjtitus »

devit wrote: post #16
jedieaston wrote: post #15

Earlier quoted context omitted.

The governments each want their own app so data isn't shared with other governments, so either Apple sends out 100+ versions of an iOS update, or, they expose an API and let the governments ingest it into an app that they control, which adds privacy for the user by making it opt-in.

But no data is shared with the government, so there isn't any data that gets shared with "other governments". All that is shared is a randomly generated key that can only be used by other smartphones to determine if any of the ids that they have collected come from the key.

> But no data is shared with the government

> All that is shared is a randomly generated key

thinking face

I agree, though, it seems dumb to have governments anywhere near this.

Re: TracePrivately – open-source sample app using Apple's contact tracing framework

#18

Post by pmiller2 »

devit wrote: post #16
jedieaston wrote: post #15

Earlier quoted context omitted.

The governments each want their own app so data isn't shared with other governments, so either Apple sends out 100+ versions of an iOS update, or, they expose an API and let the governments ingest it into an app that they control, which adds privacy for the user by making it opt-in.

But no data is shared with the government, so there isn't any data that gets shared with "other governments". All that is shared is a randomly generated key that can only be used by other smartphones to determine if any of the ids that they have collected come from the key.

That sounds like a massive privacy violation to me.

Re: TracePrivately – open-source sample app using Apple's contact tracing framework

#19

Post by [deleted] »

exprez135 wrote: post #4

One note: the README lists one of the objectives as to "Remain open source for independent verification", but the project is licensed under the MIT license. Since it's being designed to be a turn-key solution for governments to use, wouldn't this allow them to distribute closed-source and (potentially maliciously) modified versions?

[deleted]

Re: TracePrivately – open-source sample app using Apple's contact tracing framework

#20

Post by yegle »

pmiller2 wrote: post #18
devit wrote: post #16

Earlier quoted context omitted.

But no data is shared with the government, so there isn't any data that gets shared with "other governments". All that is shared is a randomly generated key that can only be used by other smartphones to determine if any of the ids that they have collected come from the key.

That sounds like a massive privacy violation to me.

The only time your keys are uploaded, is when you are infected. The assumption is that if you are infectious certain privacy needs to forgo to protect others.

In fact this is over simplification. The only key that will be uploaded is partial of the daily tracing key (called Diagnosis Key in the specification).

Most importantly, there's no location or timestamp involved or needed. Once this Diagnosis Key is uploaded, every client (anyone who wants to know if they are potentially infected) will periodically download the batch and see if your phone has seen any of the Rolling Proximity Identifiers, and when.

Post reply on HN