Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dissection of COVIDSafe (Android): Australian government's contact tracing app

docs.google.com

Post reply on HN
Print view View original

51–60 of 271 posts

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#51

Post by TJA1 »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Hey Mike,

I've attended a few cyber security conferences and spoken to a number of active people in those communities and it amazes me how backwards the Australian government is regarding cyber security.

There seems to be less incentive for them to invest, both financially and in developing governance, than say industry. If a Google, Telstra, NAB had a severe breach, customers would be up in arms, fines would be handed out, financially there would be a big impact. Government just issues an apology and false promises to improve processes and accountability. Then a month later you see more reports in the news about more data safety breaches and unauthorised access from obscure government bodies like the RSPCA.

Uploading the code is one way to show some transparency, but trusting them to make good on their promise of appropriate handling of data and retention is questionable.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#52

Post by shermozle »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Nope. Why is it normal to take a few weeks to release the source? If it's good enough to release its good enough o publish openly.

This government has ample form. If you want my recommendation you need to open it up.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#54

Post by ferros »

lukevdp wrote: post #27
ferros wrote: post #6

It was interesting to hear a lead story on the nightly news talking about data privacy issues related to where the data was stored, saying that the data would be stored on “American company Amazon’s Servers”. No mention of Australian regions or GovCloud etc.

PM said it would be stored by Amazon in Australia.

To his credit the PM seemed quite knowledgeable about AWS as far as a non tech person/politician when he answered questions in a press conference. Used the correct terminology and was able to explain in minor detail.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#55

Post by neximo64 »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

How do you realistically use this app if you have to keep it open. You and everyone else are so focussed on convincing everyone that it’s safe, etc and totally ignoring the practical aspects of it. For someone to have the app open for 15 mins within 1.5m all day.. how will that be done, it requires a large conscious commitment. You might as well just ask the person who is in your personal space for 15 consecutive minutes

If it worked in the background that’s more useful and realistic.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#56

Post by lysp »

PudgePacket wrote: post #49
mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Aus gov has a terrible track record with information systems. Data leaks & breaches, flaky IT services, mass robo-debt claims of which 600,000 needed to be re-evaluated. Not to mention rushing through privacy destroying laws citing "Islamist terrorism, paedophile networks and organised crime". If you are who I think you are you're probably more knowledgable of the particular 2018 law than me. And now they're "rushing…

Assistance and Access Bill:

https://www.zdnet.com/article/whats-actually-in-australias-e...

Telecommunications (Interception and Access) Amendment (Data Retention) Bill:

https://www.bbc.com/news/world-australia-32061421

Peter Dutton's proposed "give me your password" law:

https://www.sydneycriminallawyers.com.au/blog/peter-dutton-p...

> Under the proposals, people who are not even suspected of a crime would face a fine of up to $50,000 and up to five years’ imprisonment for declining to provide a password to their smartphone, computer or other electronic devices.

> Furthermore, anyone (an IT professional, for example) who refuses to help the authorities crack a computer system when ordered will face up to five years in prison. If the crime being investigated is terrorism-related then the penalty for non-compliance increases to 10 years in prison and/or a $126,000 fine.

> Tech companies who refuse to assist authorities to crack encryption when asked to do so, will face up to $10 million in fines. What’s more, if any employee of the company tells anyone else they have been told to do this, they will face up to five years in gaol.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#57

Post by cyphar »

crispinb wrote: post #28
cyphar wrote: post #14

Earlier quoted context omitted.

You're agreeing with the OP. The point they were making was that the Australian government could've gotten the source code under an alternative license by asking the sole copyright holder (which I believe is either the Singaporean government, or a contractor of the Singaporean government). But to be honest, as an Aussie I don't think our government is remotely competent enough to have considered the copyright license…

but these promises were quickly revoked Were they? Where did you see that? The Health Dept's response to the Privacy Impact Assessment's recommendation for release of the app's source code says as follows: Agreed. The PIA and source code will be released subject to consultation with the Australian Signals Directorate’s Australian Cyber Security Centre ( https://www.health.gov.au/resources/publications/covidsafe-a...…

I was basing it on the public statements of the Health Minister[1].

Now, it's very possible that they'll release it tomorrow and this whole discussion will have been a waste of time -- but at the time of writing the Minister for Government Services said unequivocally that they would release the source code[2] and later the Health Minister said they were "unsure it would be safe"[1], and finally when the app was released the source code was nowhere to be seen. To be fair, he was insistent that they would release it (despite being "unsure it would be safe").

But sure, I also wouldn't be surprised to discover that the whole process has been delayed by some other bureaucracy. After all, they probably see releasing the source code as a token gesture and not a form of review by the public.

[1]: https://www.itnews.com.au/news/health-minister-now-unsure-if... [2]: https://www.itnews.com.au/news/govt-to-release-source-code-o...

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#58

Post by lukevdp »

cyphar wrote: post #50
lukevdp wrote: post #33

Earlier quoted context omitted.

Do you have a source for the source code not being released for “national security”?

They didn't say it was for national security ("or some other such rubbish" was the point I was making -- that it was a bullshit reason, not that it was a direct quote). The Health Minister claimed that having the source code public would make it easier to hack[1]. But it's just as ridiculous of a statement. [1]: https://www.itnews.com.au/news/health-minister-now-unsure-if...

From that article:

“The first thing we want to do is make sure that we're protecting the safety and the privacy of individuals. Everything that can be released, will be, for sure,”

I don’t share your cynicism but I do hope that “everything” means everything.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#59

Post by lukevdp »

ferros wrote: post #54
lukevdp wrote: post #27

Earlier quoted context omitted.

PM said it would be stored by Amazon in Australia.

To his credit the PM seemed quite knowledgeable about AWS as far as a non tech person/politician when he answered questions in a press conference. Used the correct terminology and was able to explain in minor detail.

Yeah I was pleasantly surprised.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#60

Post by crispinb »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Turn the HN angry mob mode off

Funny how, to the rich and powerful, any amongst the lower orders who dare to ask questions are always an 'angry mob'.

We’re all in this together

That would have been nice. Too late.

Post reply on HN