Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dissection of COVIDSafe (Android): Australian government's contact tracing app

docs.google.com

Post reply on HN
Print view View original

81–90 of 271 posts

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#81

Post by SyneRyder »

I've been running COVIDSafe on Android for most of today, Samsung's Battery monitor is showing 3% battery use by COVIDSafe after 6 hours. I guess that's about a 10-12% battery hit over a full day, but at least it's using less battery than Spotify or TuneIn or Pocket Casts when they were in use with the screen off. So we're not talking Pokemon Go levels of battery drain here.

It works fine in the background on Android. Much like the Pebble smartwatch app does for its Bluetooth connection, you get a permanent notification, and you have to disable battery saver to stop the app sleeping. But you can still use your phone for other things. Battery monitor regards the app as in "Active" use the whole time, not in "background" use.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#82

Post by gruez »

enturn wrote: post #65

Are there concerns that unpatched Android devices could be vulnerable to the Bluetooth bug discovered in February this year? https://www.welivesecurity.com/2020/02/07/google-critical-an...

Exploit details were released a few days ago[1]. Some essential bits were removed, so not any script kiddie can use it, but it's only a matter of time before a full exploit available publicly.

As for how it relates to the app, I don't think it matters much. I'd imagine most people already have bluetooth enabled, so using this app or not won't change their vulnerability status.

[1] https://insinuator.net/2020/04/cve-2020-0022-an-android-8-0-...

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#83

Post by jeromegv »

dragonsky wrote: post #72
neximo64 wrote: post #55

Earlier quoted context omitted.

How do you realistically use this app if you have to keep it open. You and everyone else are so focussed on convincing everyone that it’s safe, etc and totally ignoring the practical aspects of it. For someone to have the app open for 15 mins within 1.5m all day.. how will that be done, it requires a large conscious commitment. You might as well just ask the person who is in your personal space for 15 consecutive min…

This is my problem with the app. The only reason I'm going to be in public for a 15 minute period at the moment is either being on or waiting for public transport or eating in a food court. In those cases I'm going to be using my phone to browse the net or watch a video meaning that this app won't be functional. At least on iOS, so what is the point?

That's why an OS solution is the only viable solution. Asking for the app to be open is the most ridiculous thing ever.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#84

Post by tzs »

zelphirkalt wrote: post #32
em10fan wrote: post #7

> Non-compliant. The CovidSAFE application heavily uses source code from https://github.com/opentrace-community/opentrace-android which was released under GPL v3 That's not to say its non-compliant, they could have reached out to the (one) contributor and licenced it separately.

For this specific case, it would be a grave mistake to license under anything, which does not contain a copyleft to make sure they release the source code as well and grant the 4 freedoms.

If I'm understanding this right, this app was written by the Australian government. Does the license for any libraries or other outside code they have included even matter?

Generally, governments have what is called "sovereign immunity" when it comes to civil lawsuits. They can only be sued if they decide to allow it. Some countries waive their sovereign immunity for specific laws.

For example US copyright law waives it for the Federal government, and so if the US government used your library without permission you could sue them for copyright infringement. It does not waive it in regard to the US states, however, and so if individual states used your library without permission you would probably not be able to do anything about it.

I have no idea if Australia has sovereign immunity from Australian copyright law. Google, Bing, and Duck Duck Go are all insisting on just returning results about the recent US Supreme Court case that said the waiver of sovereign immunity in US copyright just covers the Federal government, not the state government.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#85

Post by dang »

crispinb wrote: post #60
mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Turn the HN angry mob mode off Funny how, to the rich and powerful, any amongst the lower orders who dare to ask questions are always an 'angry mob'. We’re all in this together That would have been nice. Too late.

Please don't post in the flamewar style to HN, regardless of how provocative another comment was or you feel it was. I can understand how that bit could have rubbed some commenters the wrong way (it affected me that way too), but confirming the point is not a good way to respond to it.

By HN standards, let alone internet standards, the thread was unusually mild. Of course that provocation made it angrier, but I'm sure it was unintentional.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#86

Post by chippy »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Your account was created almost a decade ago. Is this really the first and only comment? Why is this? Another user called you "mike" in their comment. Are you famous or noteworthy in relation to this story somehow? Why should your comment have weight behind it?

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#87

Post by justinclift »

metta2uall wrote: post #62
mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

IMHO, the fact that they app is unobfuscated and can thus be easily decompiled is even better than released source code since one can't be sure that the released source code truly matches the actual build in the app store (unless they also go to the effort of having 'reproducible builds' - which would be quite impressive). Also it's good to keep in perspective that the 'government' can already track people to a great…

If they're not producing reproducible builds, they're not really being serious are they?

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#88

Post by processing »

discordance wrote: post #53

@Dang - there are a suspicious number of new users on this thread leaving positive comments about the about the Australian governments new surveillance app

Yes, don't think they were aware of news profile names being green for first <2 weeks. In this instance for the 5 hours they signed up to astroturf.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#89

Post by dang »

discordance wrote: post #53

@Dang - there are a suspicious number of new users on this thread leaving positive comments about the about the Australian governments new surveillance app

Most likely they saw https://twitter.com/mcannonbrookes/status/125437688433222860....

They're not all positive: https://news.ycombinator.com/item?id=22986688. Currently split about equally, in fact.

In the future, if you'd please follow the site guidelines and email hn@ycombinator.com such suspicions so we can investigate, I'd appreciate it. I only saw this comment randomly.

https://news.ycombinator.com/newsguidelines.html

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#90

Post by justinclift »

maxden wrote: post #11
ferros wrote: post #6

It was interesting to hear a lead story on the nightly news talking about data privacy issues related to where the data was stored, saying that the data would be stored on “American company Amazon’s Servers”. No mention of Australian regions or GovCloud etc.

The ABC is reporting that the server must store data in Australia and the data cannot be transferred overseas.

Except if it's stored on AWS, then the US "CLOUD" act means US federal - eg the three letter ones, probably others too - have access to the data anyway:

https://en.wikipedia.org/wiki/CLOUD_Act

Post reply on HN