Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Herald – Bluetooth contact tracing protocol

vmware.github.io

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Herald – Bluetooth contact tracing protocol

#21

Post by vlowrian »

merlinscholz wrote: post #16
hiharryhere wrote: post #12

I used the Australian COVIDSafe ios app today which uses herald. The only way it can keep the app receiving Bluetooth while in the background is to request location permissions and show the blue ios bar at the top that says “COVIDSafe is using your location”. It’s a hack. Nobody seems to spell that out in the media coverage about it. Yes it works some of the time, but only under very specific circumstances. Someone n…

Sadly it's the exact same situation as with the German covid app. The limitations of what can be done without the iOS/Android APIs are too high to make the app useful, as can be seen in the official documentation: https://github.com/corona-warn-app/cwa-documentation/blob/ma...

The interesting thing about the German covid app is that it is actually pretty good considering the solution space available to its creators. It features a decentralized "privacy first" architecture and utilizes the platform APIs which _should_ be the best implementation for handling the actual contact tracing.

Since it is open source and uses a very common tech stack, it is easy to check and understand for as many people as possible that it is well-crafted and does not contain any obvious security vulnerabilities or backdoors. This makes it very trustworthy from an IT-persons point of view, and should in minimize the number of unsettled people who don't install the application on their handsets since they mistrust the government.

Well-known public instances like the CCC (German IT-Security NGO) did a review on the app and gave it a good testimonial - even on mass media like public television. The government and the involved third-parties like Deutsche Telekom and SAP did a lot to emphasize that there is no harm to be expected from the app and the worst thing that could happen is that it doesn't work - which would be the exact same outcome as if you just didn't use it.

Still, Germans' are hard to convince, once they made up their mind about something. The public image of the government, as well as Deutsche Telekom and SAP is often disconnected from their actual performance. The same people often disregard these instances' and companies' ideas, products and services with the same persistence they welcome or defend equaly debatable innovations and decisions from actors they look favorably upon, like Apple.

It's sad to see that the good work of many smart people is so easily disregarded. The government and the involved companies actually listened to privacy and security experts and made a lot of right choices. That's something I'd like to see more of in the future. A little bit of appreciation could go a long way for shaping such decisions for the years to come.

Re: Herald – Bluetooth contact tracing protocol

#22

Post by polishdude20 »

hiharryhere wrote: post #12

I used the Australian COVIDSafe ios app today which uses herald. The only way it can keep the app receiving Bluetooth while in the background is to request location permissions and show the blue ios bar at the top that says “COVIDSafe is using your location”. It’s a hack. Nobody seems to spell that out in the media coverage about it. Yes it works some of the time, but only under very specific circumstances. Someone n…

Does IOS normally not need location permissions to enable Bluetooth Low Energy? Because android does.

Re: Herald – Bluetooth contact tracing protocol

#23

Post by arendtio »

arrrg wrote: post #18
merlinscholz wrote: post #16

Earlier quoted context omitted.

Sadly it's the exact same situation as with the German covid app. The limitations of what can be done without the iOS/Android APIs are too high to make the app useful, as can be seen in the official documentation: https://github.com/corona-warn-app/cwa-documentation/blob/ma...

It’s not the exact same situation. It’s a completely different situation. These apps need to use the OS APIs, otherwise there is no hope for them. The German app uses those APIs, the Australian one does not. While there are obviously trade-offs involved with the OS APIs, it's not hopeless like this clusterfuck.

Why not use the OS APIs when available and provide a hack/fallback for old Phones which don't have those APIs?

Re: Herald – Bluetooth contact tracing protocol

#24

Post by absolutelyrad »

merlinscholz wrote: post #16
hiharryhere wrote: post #12

I used the Australian COVIDSafe ios app today which uses herald. The only way it can keep the app receiving Bluetooth while in the background is to request location permissions and show the blue ios bar at the top that says “COVIDSafe is using your location”. It’s a hack. Nobody seems to spell that out in the media coverage about it. Yes it works some of the time, but only under very specific circumstances. Someone n…

Sadly it's the exact same situation as with the German covid app. The limitations of what can be done without the iOS/Android APIs are too high to make the app useful, as can be seen in the official documentation: https://github.com/corona-warn-app/cwa-documentation/blob/ma...

> The limitations of what can be done without the iOS/Android APIs are too high to make the app useful, as can be seen in the official documentation: https://github.com/corona-warn-app/cwa-documentation/blob/ma...

This is the core reason I'm so against these duopolies. I have a startup idea that I want to implement. I've done it on windows, and it's flawless. Should work on macOS too. But these mobile OS's don't provide the right API's to do it. Android offers access to do it in a half assed way, and the way to do it right is to do it the correct way, flawlessly. So I'm stuck in a limbo, I want to be the first and last to market, prepared for when these companies break up, the OS offers access to some API's I want, and capture the market. There may be little network effects to the idea. But it's going to be a big market for everyone, with plenty of competition if idiots offer the right API's. [edited it gave away a bit too revealing info]. Enough that I don't ever connect my development machine to the internet to make sure no source code ever leaves.

My test users have asked me when will I offer a mobile app? The app needs mobile integration to make it work the way the idea was supposed to be. All OS's that the user uses, together.

And, I have no response to their questions and the mails end up collecting dust.

These fuckers ruin innovation for everyone and it makes me mad.

If these companies don't get broken up with a competitive mobile OS landscape again, don't get mad when I jump ship and go with some OS Huawei makes if it offers the right way and gains adoption.

If America wants competitiveness, innovation and a technological lead, it has work to do at home: Trust busting needs to happen fast.

Re: Herald – Bluetooth contact tracing protocol

#25

Post by arrrg »

arendtio wrote: post #23
arrrg wrote: post #18

Earlier quoted context omitted.

It’s not the exact same situation. It’s a completely different situation. These apps need to use the OS APIs, otherwise there is no hope for them. The German app uses those APIs, the Australian one does not. While there are obviously trade-offs involved with the OS APIs, it's not hopeless like this clusterfuck.

Why not use the OS APIs when available and provide a hack/fallback for old Phones which don't have those APIs?

Why would that be worth the effort? Support is pretty far-reaching and picking up marginal old phones isn’t that important.

Re: Herald – Bluetooth contact tracing protocol

#26

Post by arendtio »

arrrg wrote: post #25
arendtio wrote: post #23

Earlier quoted context omitted.

Why not use the OS APIs when available and provide a hack/fallback for old Phones which don't have those APIs?

Why would that be worth the effort? Support is pretty far-reaching and picking up marginal old phones isn’t that important.

I have no statistics at hand but the Android ecosystem is known for having a lot of old phones. Since the corona apps are not about reaching the wealthiest, but about reaching as many people as possible it might be worth the effort.

Re: Herald – Bluetooth contact tracing protocol

#27

Post by qzervaas »

jrmg wrote: post #20

Is there a short summary of what this purports to provide that the Apple/Google APIs do not?

Their claims change depending on the day, but they include:

* Better long tail of older device support

(meaningless if the app doesn't work, and completely debunked now that ENF supports iOS 12)

* They want to control contact tracing, rather than have the app directly notify the user

(this isn't a requirement of ENF, but the Govt falsely claims it is. In fact, ENF can still notify authorities so a contact tracing phone interview can take place. The only difference is that with ENF, you can't force a user to enter their phone number to start using the app)

* They want a better picture of the entire social graph, since ENF gives more vague / anonymous data.

This is the only partially valid claim they make, however, this is predicated on the current app actually working and providing that information, which is does not.

Re: Herald – Bluetooth contact tracing protocol

#28

Post by steve_taylor »

mcbain wrote: post #10
steve_taylor wrote: post #5

Earlier quoted context omitted.

Yes, Australia’s COVIDSafe app uses Herald.

On iOS it only switched to Herald in v2.0 which - according to my phone - was installed 2 days ago.

That’s when I finally uninstalled it.

Re: Herald – Bluetooth contact tracing protocol

#29

Post by arendtio »

arendtio wrote: post #26
arrrg wrote: post #25

Earlier quoted context omitted.

Why would that be worth the effort? Support is pretty far-reaching and picking up marginal old phones isn’t that important.

I have no statistics at hand but the Android ecosystem is known for having a lot of old phones. Since the corona apps are not about reaching the wealthiest, but about reaching as many people as possible it might be worth the effort.

In this article you can find statistics about the amount of old Android versions still in use: https://arstechnica.com/gadgets/2020/12/lets-encrypt-comes-u...
Post reply on HN