Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dissection of COVIDSafe (Android): Australian government's contact tracing app

docs.google.com

Post reply on HN
Print view View original

31–40 of 271 posts

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#31

Post by MaxBarraclough »

gumby wrote: post #15
em10fan wrote: post #7

> Non-compliant. The CovidSAFE application heavily uses source code from https://github.com/opentrace-community/opentrace-android which was released under GPL v3 That's not to say its non-compliant, they could have reached out to the (one) contributor and licenced it separately.

By not doing so they are by definition non-compliant. Or they could have GPLed the entire app; no reason not to have.

> By not doing so they are by definition non-compliant.

Pedantry. If you agree a separate licence and are no longer bound by the terms of the GPL, you cannot be in breach of the GPL. That's the point.

> they could have GPLed the entire app; no reason not to have.

They haven't released the source.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#32

Post by zelphirkalt »

em10fan wrote: post #7

> Non-compliant. The CovidSAFE application heavily uses source code from https://github.com/opentrace-community/opentrace-android which was released under GPL v3 That's not to say its non-compliant, they could have reached out to the (one) contributor and licenced it separately.

For this specific case, it would be a grave mistake to license under anything, which does not contain a copyleft to make sure they release the source code as well and grant the 4 freedoms.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#33

Post by lukevdp »

cyphar wrote: post #14
toyg wrote: post #9

Earlier quoted context omitted.

Uhm, no. Once your code contains GPL code that is not yours , it has to be GPL. Particularly in v3, where a number of loopholes were closed. You are free to attach further non-conflicting clauses to it, but the GPL of the original code must be respected. That’s the entire point of the GPL. Double-licensing requires you to have ownership of the entire codebase. At that point, you are licensing everything , so you’re f…

You're agreeing with the OP. The point they were making was that the Australian government could've gotten the source code under an alternative license by asking the sole copyright holder (which I believe is either the Singaporean government, or a contractor of the Singaporean government). But to be honest, as an Aussie I don't think our government is remotely competent enough to have considered the copyright license…

Do you have a source for the source code not being released for “national security”?

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#34

Post by MaxBarraclough »

henvic wrote: post #21

In my opinion, GPL is just another flavor of proprietary software and they should stop calling it free software or even opensource. Something like "Copyleft shared source" would make more sense to what it really is. https://medium.com/@henvic/opensource-and-go-what-license-f6...

As terms-of-art in the software world, 'Free software' and 'Open Source software' have clear accepted definitions. There's nothing wrong with being an advocate for 'copycenter' licences, but please don't muddy the waters.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#35

Post by mcannon »

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same.

They’re obviously operating with extreme urgency to get the app out. For you.

Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips:

- Turn the HN angry mob mode off - it’s not helpful. We’re all in this together.

- Commend the government on some smart privacy and security choices (data deleted after 21 days, open source code, AWS in Australia, sensible sec practices etc). They won’t get it all right - and we as a tech community can help them. Find a bug & help get them closed.

- When asked by non technical people “Should I install this app? Is my data / privacy safe? Is it true it doesn’t track my location?” - say “Yes” and help them understand. Fight the misinformation. Remind them how little time they think before they download dozens of free, adware crap games that are likely far worse for their data & privacy than this ever would be!

Thank you

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#36

Post by dathinab »

em10fan wrote: post #7

> Non-compliant. The CovidSAFE application heavily uses source code from https://github.com/opentrace-community/opentrace-android which was released under GPL v3 That's not to say its non-compliant, they could have reached out to the (one) contributor and licenced it separately.

It's (at least by now) mentioned that the code might have been dual licensed to them.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#37

Post by lukevdp »

In the Privacy Impact assessment that was released here https://www.health.gov.au/sites/default/files/documents/2020...

The government is planning to release the source code “subject to consultation with the Australian Signals Directorate’s Australian Cyber Security Centre.”

Take that for what you will. I suspect some people will take this to mean they won’t be releasing the source, however at this point I think it’s reasonable to believe it is still going through this process.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#38

Post by dathinab »

lukevdp wrote: post #27
ferros wrote: post #6

It was interesting to hear a lead story on the nightly news talking about data privacy issues related to where the data was stored, saying that the data would be stored on “American company Amazon’s Servers”. No mention of Australian regions or GovCloud etc.

PM said it would be stored by Amazon in Australia.

But does that matter?

There is still the CLOUDE act (I think it was called). And secret courts.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#40

Post by bad_user »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

You can easily deny location data to games and people that are concerned about these apps will not share their location lightly.

I have no app on my iPhone with the ability to use my location in the background, not even Waze or Google Maps.

Also I don't care about deletion policies. That data should not be collected in the first place.

I don't know about any specifics, but if the data isn't anonymized somehow, on the client side, such that the government can never trace it back to you, then I'd rather catch the virus personally.

I agree about turning the angry mob mode off, but in times of crisis we would do well to remember that our freedoms are being traded for a little security and in many cases it isn't temporary.

And Australia in particular doesn't have a good track record in preserving those freedoms.

Therefore it isn't unreasonable to ask for source code. This isn't even about the GPL, people need the ability to review the code, especially if it's a public service paid by taxpayers. In my opinion such projects should be developed in the open, always.

Post reply on HN