News for hackers. Stuff that matters.

A comment on Dissection of COVIDSafe (Android): Australian government's contact tracing app. Parent comment

Re:Dissection of COVIDSafe (Android): Australian government'... by metta2uall on Sunday April 26, 2020 @08:34AM (#22986692)
IMHO, the fact that they app is unobfuscated and can thus be easily decompiled is even better than released source code since one can't be sure that the released source code truly matches the actual build in the app store (unless they also go to the effort of having 'reproducible builds' - which would be quite impressive).

Also it's good to keep in perspective that the 'government' can already track people to a great extent, e.g. via cell towers and face recognition.

[ Parent | on HN ]
Re:Dissection of COVIDSafe (Android): Australian government'... by m4rtink on Sunday April 26, 2020 @11:37AM (#22987872)
IIRC, Fdroid rebuilds all the Android apps they host from source so they can be sure their source really matches the app. Actually, this is also what all good Linux distros do with all their software.
[ Parent | on HN ]
Re:Dissection of COVIDSafe (Android): Australian government'... by lern_too_spel on Sunday April 26, 2020 @04:43PM (#22990088)
I'm not aware of any Linux distros with 100% reproducible builds, though Debian is actively working on it and getting closer.
[ Parent | on HN ]
Re:Dissection of COVIDSafe (Android): Australian government'... by doubleunplussed on Monday April 27, 2020 @02:30AM (#22993410)
The distros can be sure without full reproducibility, since they built it. The users are still required to trust the distros built what they said they would though.
[ Parent | on HN ]
Re:Dissection of COVIDSafe (Android): Australian government'... by sjwright on Monday April 27, 2020 @06:41AM (#22994613)
The end user isn't the distro though.
[ Parent | on HN ]
Re:Dissection of COVIDSafe (Android): Australian government'... by sfpibx on Sunday April 26, 2020 @09:16PM (#22991982)
The mobile app could be just the tip of a very big iceberg. We need the server side code.
[ Parent | on HN ]
Re:Dissection of COVIDSafe (Android): Australian government'... by ifthenorelse on Monday April 27, 2020 @07:33AM (#22994831)
Yes, and presumably the scores of bureaucrats / administrators / call centre operators in all States and Territories accessing the database will read / write to the server via a separate application. So we need the code for those users.
[ Parent | on HN ]
Re:Dissection of COVIDSafe (Android): Australian government'... by justinclift on Sunday April 26, 2020 @01:42PM (#22988723)
If they're not producing reproducible builds, they're not really being serious are they?
[ Parent | on HN ]
Re:Dissection of COVIDSafe (Android): Australian government'... by jfoster on Sunday April 26, 2020 @03:10PM (#22989360)
You're seeking completely perfect solutions in a time of crisis where a "good enough" solution might save a lot of lives. Cut them some slack for trying to stem the harm of the pandemic. This situation affects every human.
[ Parent | on HN ]
Re:Dissection of COVIDSafe (Android): Australian government'... by rstuart4133 on Sunday April 26, 2020 @06:23PM (#22990809)
You seem to be implying a reproducible build is difficult. It can be, if someone hasn't done it before. But in this case fdroid has done it before, and publishes how to do it.
[ Parent | on HN ]
Re:Dissection of COVIDSafe (Android): Australian government'... by barbs on Sunday April 26, 2020 @07:42PM (#22991357)
Is there a way to implement reproducible builds for apps released on Google Play? Because that's where the vast majority of people will be downloading the app from.

Also, I don't think there's any such solution for iOS.

[ Parent | on HN ]
Re:Dissection of COVIDSafe (Android): Australian government'... by justinclift on Monday April 27, 2020 @01:19AM (#22993092)
Reproducible builds are not a "perfect" solution.

They, and the source code to build them, is the baseline requirement for any trust in what is being provided to people.

---

The Australian government has a history of extreme incompetence with IT projects, using PR to try and effect adoption, then bullshitting about their failures.

If there's evidence this project is going to be any different, then great. :)

In the meantime, I'm judging them based on their historical actions.

[ Parent | on HN ]