LWN: Comments on "Open-source contact tracing, part 2"

Open-source contact tracing, part 2

anselm — Mon, 27 Jul 2020 10:06:18 +0000

Unless we don't (consider, e.g., the last FIFA World Cup, where Germany gave a dismal showing and didn't get past the preliminary round).

As far as contact-tracing apps are concerned, we spent €20 million of our taxes on an app whose obvious and egregious bugs make the national news (plus €3 million/month to keep it running), compared to, say, the Irish, who spent less than €1 million on an app that actually appears to be quite good. Doesn't look like “winning” to me (unless perhaps you're SAP or Deutsche Telekom, the companies which were contracted to develop the app).

Open-source contact tracing, part 2

mrybczyn — Fri, 24 Jul 2020 06:04:25 +0000

This is a rapidly moving situation and it will be interesting to follow how the initiative of the Linux Foundation will develop. Something to look up.

Open-source contact tracing, part 2

mrybczyn — Fri, 24 Jul 2020 06:00:00 +0000

Thank you for linking to this one. It was impossible to write about all available apps, as there are so many. My goal was to cover different types of designs and different project organizations.

Aroygya Setu has a set of original features so yes, it is a candidate for covering in a follow-up.

Open-source contact tracing, part 2

marcH — Thu, 23 Jul 2020 06:22:26 +0000

So contact tracing is a bit like football: at the end, Germans always win.

Open-source contact tracing, part 2

avasu — Wed, 22 Jul 2020 06:40:39 +0000

There is one notable omission from the list, which has over over 100 million downloads and working reliably over a very large geographic area, the Aroygya Setu app from India. The source code for the android app and the backend have been open sourced.
https://github.com/nic-delhi/AarogyaSetu_Android
https://github.com/AarogyaSetu

Open-source contact tracing, part 2

droundy — Tue, 21 Jul 2020 16:02:31 +0000

Excellent point, and perhaps an argument for changing the temporary ID less frequently.

Open-source contact tracing, part 2

iabervon — Tue, 21 Jul 2020 15:40:42 +0000

But if you went to the trouble of tracking what individuals you were around at all times, you could find out who tested positive from the probably-unique intersection of all of your temporary IDs that person had contact with.

I guess they might think that "a person you were in contact with in these particular time ranges tested positive" is not personal information about them in the same way that "the person who broadcast this temporary ID tested positive" is. Maybe they're worried about the potential that someone will be mapping temporary IDs to real identification based on interaction too distant or brief to get into the infested person's contact log?

Open-source contact tracing, part 2

jangutter — Tue, 21 Jul 2020 15:22:15 +0000

For part 3, you might want to include the tracker funded by the Irish government that has just been donated to the Linux Foundation: https://github.com/covidgreen

There's certainly a long road still ahead. I'm sure that 90% of the success of the method depends on the continued support of the infrastructure behind it. This is not an unfamiliar feeling to anyone who has observed open source projects. Maybe this time the stakes are a bit higher and the need to be purely profit driven might be suppressed.

Open-source contact tracing, part 2

droundy — Tue, 21 Jul 2020 15:18:33 +0000

I think the key is that they don't want to ever release the information about who was infected. I could track the real world names of all temporary IDs I have contact with, and then publish those names when they get sick, or avenge myself on the person who infected me.

Open-source contact tracing, part 2

iabervon — Mon, 20 Jul 2020 21:49:02 +0000

I'm surprised that the decentralized apps are uploading the contact information, since it's not really necessary, is a privacy concern, and it's not the most efficient way to do it. Instead, they could upload the list of the user's temporary IDs that were ever seen, which is necessarily no larger, and just means that contacts need to search the published warnings for IDs they saw rather than IDs they had.

I guess publishing the contacts means that, if you had multiple contacts while using a particular set of temporary IDs, you wouldn't know which of them tested positive, even if you were able at the time to match a temporary ID to a person by rotation schedule and when they arrived and left. On the other hand, given the time windows when you were in contact with the infected person (i.e., the times for which there's a hit in your phone with any search scheme), you could probably guess who the person was, unless it was a stranger you wouldn't be able to recognize regardless.