> Germans overall trust their government to not lie as much as other governments

German here. I don't trust my government to not lie (based on past evidence). However, I don't think the government is competent enough to execute this particular type or lie (or even creative enough to come up with it in the first place).

This is not answering the question beyond "it would require some effort to do so". It is not unusual to have a different binary published, than what's in a public repo.

The following points you go on about are mostly irrelevant.

Well, then don't use the app from the app store and compile it yourself ...

I don't care, I just find it odd how you didn't really answer but got off a tangent on how trustworthy of this app we should be.

Does that work, though? Afaik the app needs Google's or Apple's blessing to use the API.

No idea, but as those are closed source one can have the same doubts, so you need an OpenSource alternative to the API, which is in the works in order to be used in that app: https://github.com/theScrabi/CoraLibre-android-sdk/ and https://github.com/corona-warn-app/cwa-app-android/issues/75

That combined with an Android based on AOSP and trust issues should be reduced (while the bad government can still track you using cell towers and for that app one could still place Bluetooth beacons everywhere and the server's could still store more information (while the only keys transmitted are those of infected, which is quite little) ... so yeah, pick your level of conspiracy

> For third: Germans overall trust their government to not lie as much as other governments

Trust is good, control is better. But in this case the fault is certainly with shitty app stores and mobile OS.

Right, the larger concern is somewhere else. It's in the operating system and if the government were to track everybody they could monitor cell towers. Way harder to detect.

They would most certainly break basic law, but they could, yes. I don't trust my government because of numerous attempts to do so, honestly.

I think the restrictions we see on mobile devices will at some point be the death of reasonable software for mobile. Yes, yes, I can run my own binaries if I jump over X hurdles but I have given up on mobile development years ago. It was zero fun in my opinion.

Well, If you don't trust them and don't want to verify there is nothing they can do.

For the ones with basic trust, they do a lot. Way more than most others. (Just look at the transparent dev process, the depth of documentation etc.)

I have very little basic trust because of several reasons and have nothing to criticize on the development process, but I have no blanket trust for my government because it wasn't involved here besides as financier. The decisions for security measures didn't come from them. If they could get more info from people, they would try. The behavior shows a clear pattern over the last decade and luckily we have controlling institutions that are not as easily swayed.

That said, I never said anything about not using the app. I will certainly try it, although I think we are at a pandemic stage when it doesn't matter that much anymore. Maybe for the next one.

> The decisions for security measures didn't come from them.

This becomes philosophical, but the contract certainly contained security requirements (whether those are "adquante" can be argued) and they certainly required audits, which were done. But yes, the health minister is not an IT security expert, thus details are delegated.

> If they could get more info from people, they would try.

As the French try and Norwegians tried with their central approaches. If they wanted they could have made it closed source (like anything else they did before, thus nothing special) could have done more hand wavy design documents, could have done development away from a public repo with public issue tracker, ...

They (and yes, this was to a notable part driven by the engineers, but supervisees could easily overruled) conciously made it open and transparent.

There is hardly anything more they could have done within that project. (Spying activity by German intelligence/BND, "state trojans" (Quellen-TKÜ), ... etc are serious topics and yes, some "security experts" (i.e. Wolfgang Schäuble) demand mandatory tracking apps, but don't see that as being far from a mainstream oppinion in the government.

I don't dislike our current government but am starved of political opposition. I think this is reasonable in the context of the last decade of German politics.

The reason we got this transparency is the implicit demand for open solutions, not because of generous overlords. You could make tracking mandatory but it would certainly be a huge failure in the end. So they reacted to a demand and I have more where that came from. To repeat, I have no issues how it was handled here. Baby steps...

Ack, I think the many years of "große Koalition" aren't good for democracy and I think it had been better if SPD would have gone into opposition after the last election and see the consequences of minority government roll out ... then we could have a political debate with contradicting points of views etc. instead of long discussions in a Koalitionsausschuss followed by harmony ... but this is not directly related to this specific topic. (Side note: I'm fresh SPD member and think they get quite a few of their initiatives through, despite the election results they get ... but we need more proper debate in democratic circles ...)