For one: because this would be extra work within a short time frame. The source shows no extension points. Outside small tech circles nobody would have said anything if it were closed, if they have bad intention they could have made it closed.

For second: we can easily see that the app doesn't use GPS or similar, which is a nice indication

For third: Germans overall trust their government to not lie as much as other governments

For forth: Researchers will reverse the app

The only way this thing can work is, if the population trusts it, installs it and keeps their phone on. If the population doesn't trust it, it's doomed. It's in the self-interest of the project to be trustworthy and transparent.

If you understand German you might enjoy this podcast with two of the developers: https://ukw.fm/ukw030-die-corona-warn-app/

> Germans overall trust their government to not lie as much as other governments

German here. I don't trust my government to not lie (based on past evidence). However, I don't think the government is competent enough to execute this particular type or lie (or even creative enough to come up with it in the first place).

This is not answering the question beyond "it would require some effort to do so". It is not unusual to have a different binary published, than what's in a public repo.

The following points you go on about are mostly irrelevant.

Well, then don't use the app from the app store and compile it yourself ...

I don't care, I just find it odd how you didn't really answer but got off a tangent on how trustworthy of this app we should be.

Does that work, though? Afaik the app needs Google's or Apple's blessing to use the API.

No idea, but as those are closed source one can have the same doubts, so you need an OpenSource alternative to the API, which is in the works in order to be used in that app: https://github.com/theScrabi/CoraLibre-android-sdk/ and https://github.com/corona-warn-app/cwa-app-android/issues/75

That combined with an Android based on AOSP and trust issues should be reduced (while the bad government can still track you using cell towers and for that app one could still place Bluetooth beacons everywhere and the server's could still store more information (while the only keys transmitted are those of infected, which is quite little) ... so yeah, pick your level of conspiracy

> For third: Germans overall trust their government to not lie as much as other governments

Trust is good, control is better. But in this case the fault is certainly with shitty app stores and mobile OS.

Right, the larger concern is somewhere else. It's in the operating system and if the government were to track everybody they could monitor cell towers. Way harder to detect.

They would most certainly break basic law, but they could, yes. I don't trust my government because of numerous attempts to do so, honestly.

I think the restrictions we see on mobile devices will at some point be the death of reasonable software for mobile. Yes, yes, I can run my own binaries if I jump over X hurdles but I have given up on mobile development years ago. It was zero fun in my opinion.

Well, If you don't trust them and don't want to verify there is nothing they can do.

For the ones with basic trust, they do a lot. Way more than most others. (Just look at the transparent dev process, the depth of documentation etc.)

I have very little basic trust because of several reasons and have nothing to criticize on the development process, but I have no blanket trust for my government because it wasn't involved here besides as financier. The decisions for security measures didn't come from them. If they could get more info from people, they would try. The behavior shows a clear pattern over the last decade and luckily we have controlling institutions that are not as easily swayed.

That said, I never said anything about not using the app. I will certainly try it, although I think we are at a pandemic stage when it doesn't matter that much anymore. Maybe for the next one.

> The decisions for security measures didn't come from them.

This becomes philosophical, but the contract certainly contained security requirements (whether those are "adquante" can be argued) and they certainly required audits, which were done. But yes, the health minister is not an IT security expert, thus details are delegated.

> If they could get more info from people, they would try.

As the French try and Norwegians tried with their central approaches. If they wanted they could have made it closed source (like anything else they did before, thus nothing special) could have done more hand wavy design documents, could have done development away from a public repo with public issue tracker, ...

They (and yes, this was to a notable part driven by the engineers, but supervisees could easily overruled) conciously made it open and transparent.

There is hardly anything more they could have done within that project. (Spying activity by German intelligence/BND, "state trojans" (Quellen-TKÜ), ... etc are serious topics and yes, some "security experts" (i.e. Wolfgang Schäuble) demand mandatory tracking apps, but don't see that as being far from a mainstream oppinion in the government.

I don't dislike our current government but am starved of political opposition. I think this is reasonable in the context of the last decade of German politics.

The reason we got this transparency is the implicit demand for open solutions, not because of generous overlords. You could make tracking mandatory but it would certainly be a huge failure in the end. So they reacted to a demand and I have more where that came from. To repeat, I have no issues how it was handled here. Baby steps...

Ack, I think the many years of "große Koalition" aren't good for democracy and I think it had been better if SPD would have gone into opposition after the last election and see the consequences of minority government roll out ... then we could have a political debate with contradicting points of views etc. instead of long discussions in a Koalitionsausschuss followed by harmony ... but this is not directly related to this specific topic. (Side note: I'm fresh SPD member and think they get quite a few of their initiatives through, despite the election results they get ... but we need more proper debate in democratic circles ...)

The technical director gave a press conference and confirmed that they'll add reproducable builds in the near future.

Until then, I hope that infosec researchers are going to scrutinize the binaries.

Germany's the home of the CCC. I'm sure people will be scrutinizing it.

I don't see how your criticism applies to this app in particular, rather than the playstore in general.

How do you know you can trust instagram/google maps/ any other common app on your phone?

I would trust German government way more than i trust just about any corporate entity I can think of.

The comment is a general one. Also it is not a criticism, it was a question because lot of govt are making their tracing app open source.

However, since this is a tracing app and being open source would imply "look, our app is clean, check our code if you do not trust us". Off-course making it open source has other benefits too.

> How do you know you can trust instagram/google maps/ any other common app on your phone?

I don't. If I am using it I know that I have no way to validate or enforce what happens with my data.

You not only need to trust the German government but any intermediate all the way to the store. I doubt that Apple or Google build the app from the repo.

To add, there are currently discussions underway in the German parliament to give our secret services (namely the notorious Verfassungsschutz) the power to compromise IT systems (Bundestrojaner). I'd trust even the government not that much these times.

I agree, its a shame we can't actually trace it all the way from git.

As for conpromising IT systems, arent they just going to bw on a level playing field with NSA and others?