[Discussion] App does not run on iOS 13.5 -13.6

GHRob549 commented 3 years ago

Fix the current (and future) versions of Corona-Warn-App to allow usage under iOS 13.6.1 on iPhone 8.

[X] Bug is not mentioned in the FAQ [X] Bug is not already reported in another issue

Device name: iPhone 8
iOS Version: 13.6.1
App Version: 1.12.1

Describe the bug

The previous version of Corona-Warn-App functioned as expected on iPhone 8 running iOS 13.6.1 until the latest update to version 1.12.1.

After updating to version 1.12.1 of Corona-Warn-App, the user is now shown a button-less dead-end screen with the following notice:

"Please update your iOS. You need the current iOS version to install the Corona-Warn-App. To do so, open the settings in your iPhone and select General -> Software Update."

At that point, the user has no choice but to force-close Corona-Warn-App.

Steps to reproduce the issue

Self-explanatory.

Expected behavior

Corona-Warn-App should run on iPhone 8 running iOS 13.6.1.

Possible Fix

Additional context

I--and I'm sure many other users--don't WANT to update the operating system to iOS14 and Corona-Warn-App shouldn't put us into a position where we're forced by ONE APP to update our iOS version or go without the protections of taxpayer-funded Corona-Warn-App.

Ein-Tim commented 3 years ago

Sorry for answering only now, was a busy day 😅

First of all, @GHRob549, I definitely think that it is bad that an update can break an app like this, and for sure everybody can update at her own speed.

I use other apps which I refuse to update, because I learned over time that their app developers killed functionality in their newest versions of their apps in the name of adding things that not all users even want (SONOS is one prime example of this kind of irritation). Again, it was my mistake to think this wouldn't happen with CWA. I broke my own rule by updating rather than leaving it alone and running a perfectly fine older version.

I definitely understand this, I think your case is really bad since you manually decided to update (but again, it's not your fault, it should have been made clearer).

But I think an important question is: What happens if the device updates automatically? Will there be a pop-up message from CWA, will the dead man message will be fired after 36h or will CWA simply stop work quietly in the background? I fear this, because than there are surely some people out there thinking that CWA runs in the background and will warn them if there was an exposure.

I am an app developer myself. I have five apps of my own in the App Stores. I would never ask my users why they would not upgrade an operating system or an app. CWA, at the moment, is a perfect example of "why not upgrade an OS or app". There's a simple rule that I try to live by: if it's not broken, don't fix it. Right now, iOS 13.6.1 can only be considered "broken" for one reason--and that reason is CWA.

As said before, everybody should be able to update at her own speed. But I disagree on the part that iOS 13.6.1 is not broken, yes, it works, but it's missing security fixes, the better v2 of ENF, etc. But it makes no sense to discuss about this here, since this will not solve the problem. (-:

Regarding the changing of the title. Although I agree that my proposal takes the significance away from this issue, I agree with @ndegendogo that you should maybe at least mention iOS 13.5-13.6.1. But for sure it's up to you, I only wanted to make it easier for other interested people to find their way to this issue.

Regarding the comment that it should have been communicated more obvious, I agree to 100%.

@ndegendogo

I think your proposal would be a good one for quickly resolving this problem (but only if it's good communicated to not create more confusion than before).

Definitely the smoother solution would be the one proposed by @dsarkar (to use v1 on iOS 13.5-13.6.1 which only support this version and v2 on all other iOS Versions), is this allowed by Apple?

Have a nice evening everybody! 😀

PS: As you can see in the reference above, I created an issue in the website repo which asks for an FAQ entry which explains why this screen is shown. This is only one part of the solution, but I think that there should be more information about this ASAP.

ndegendogo commented 3 years ago

use v1 on iOS 13.5-13.6.1 which only support this version and v2 on all other iOS Versions), is this allowed by Apple?

@Ein-Tim very good point. To be clarified with the devs (and Apple?)

... and actually, I am afraid that the answer is: no (and I will be happy if someone proves me wrong). The app must declare which ENF version it will use in the .plist configuration file (see here, section 'Specify Exposure Notification API Version'). I have never done any sophisticated tricks with this .plist file, but I am not aware that you can release an app version with different .plist files for the different iOS versions ...

Ein-Tim commented 3 years ago

@ndegendogo

I also fear that this is not possible, but please @dsarkar could you transfer this question to the devs? 😀

Also, I think this has a high chance to be overlooked in this long comment, so I will ask this here again:

What happens if the device updates automatically? Will there be a pop-up message from CWA, will the dead man message be fired after 36h or will CWA simply stop work quietly in the background?

Maybe you could also transfer this @dsarkar.

Thanks and have a good night everbody.

GHRob549 commented 3 years ago

As said before, everybody should be able to update at her own speed. But I disagree on the part that iOS 13.6.1 is not broken, yes, it works, but it's missing security fixes, the better v2 of ENF, etc. But it makes no sense to discuss about this here, since this will not solve the problem. (-:

You're correct that it makes no sense to discuss about this here, especially because it's not true and I don't understand why you would assert this.

iOS 13.6.1 contains no publicized security flaws and iOS 13.7 contains no publicized security fixes. Merely 1) bug fixes and 2) letting users opt-in to the COVID-19 Exposure Notifications system without the need to download an app. This is according to Apple's own information.

https://support.apple.com/en-us/HT210393#1361

GHRob549 commented 3 years ago

I must say, reading this discussion is causing me to lose ever more faith in the Corona Warn App, with the specific iOS programming involved and as well as with the overall concept (since variances based on mutations are still not even considered in the calculations). I was a true believer at the start, but we on the outside just keep seeing more and more absurdity in the implementation.

In this specific situation, it would seem that inexperience has led someone to make the decision to update the app without consideration of the broader effects of their decision. (Or they just didn't care about the effect.) "Just put a little statement at the end of the "What's New" telling people that we're not putting in the full effort to find a real solution."

For me, this is an extreme display of either negligence or arrogance (or doses of each) on the part of decision makers and programmers involved.

When commercial companies hit these forks in the road such as these, they consider releasing multiple apps, delineated solely by their ability to function with different hardware. They leave the name of one app intact (in this case, CWA) and they would call the other app by another name (say, CWA 2, or CWA Legacy). If you need examples, Words with Friends and Words with Friends 2, SONOS S1 and SONOS S2, et al.) Their original apps aren't shut down; they appear parallel in the App Store.

But, in this case, I sincerely believe it's possible to do this within one app; I just think someone doesn't think it's worth the effort. Well, maybe it's not worth me keeping the CWA on my device anymore, either.

Ein-Tim commented 3 years ago

@GHRob549

I understand your worries and also that your upset.

The proposal of releasing a new app to the App Store is very good, but Apple just does not allow 2 ENF apps for one region on the Store (see first point in the second section: https://developer.apple.com/contact/request/download/Exposure_Notification_Addendum.pdf)

Yes you could talk with them, but this will take time and so on. I really don't see any fast and simple exit out of this mess.

ndegendogo commented 3 years ago

use v1 on iOS 13.5-13.6.1 which only support this version and v2 on all other iOS Versions), is this allowed by Apple?

Apple publishes sample code snippets that look as if it is possible / allowed, see section "Detect Exposure Notifications API Version at Runtime".

Ein-Tim commented 3 years ago

@ndegendogo

I think I saw something like this in a PR but I can't find it anymore in the code.

@dsarkar could you maybe bring this up?

GHRob549 commented 3 years ago

use v1 on iOS 13.5-13.6.1 which only support this version and v2 on all other iOS Versions), is this allowed by Apple?

Apple publishes sample code snippets that look as if it is possible / allowed, see section "Detect Exposure Notifications API Version at Runtime".

@ndegendogo Good catch.

Your discovery of this in the documentation (versus the non-discovery of this by the leadership and developers) reinforces my thoughts from my most recent post.

ndegendogo commented 3 years ago

Your discovery of this in the documentation (versus the non-discovery of this by the leadership and developers) reinforces my thoughts from my most recent post.

@GHRob549 Actually, no. As an iOS app developer you certainly know that Apple documentation is not always free of contradictions, ambiguities, and omissions. I have never tried if these code snippets work as promised or if some more trickery is needed. You find only out if you try....

dsarkar commented 3 years ago

@ndegendogo @Ein-Tim @GHRob549, dear all,

@Ein-Tim pointed it out, where it all starts: https://github.com/corona-warn-app/cwa-app-ios/issues/2032#issuecomment-782041989

To summarize, what happened:

- Apple introduces for iPhone SE, iPhone 6s, and later models OS versions iOS 13.5 - 13.6 providing ENF API 1
- CWA uses this 'old' ENF API 1 until including CWA 1.7, i.e. min req. is iOS 13.5
- Apple introduces for iPhone SE, iPhone 6s, and later models iOS 13.7 providing ENF API 2
- CWA uses this 'new' ENF API 2 since CWA 1.9 (CWA 1.8 was skipped), i.e. min req. is iOS 13.7
- However, those how didn't update their iOS, keeping iOS 13.5-13.6, could not update their CWA beyond 13.7, but still got a working app, and the AppStore prevents CWA version update
- Apple introduces iOS 12.5 and 12.5.1 providing ENF for older models iPhone 5s, iPhone 6, iPhone 6 Plus
- CWA 1.12 start supporting iPhone 5s, iPhone 6, iPhone 6 Plus (if updated to 12.5)
- And here starts the issue: Min req. version in AppStore is set to 12.5, and those who kept their CWA version < 1.9 suddenly can update to higher versions, without having updated to iOS 13.7 or higher. Those at point 5 are the ones who are affected now if they don't want to update their iOS.

This is a very specific, unique situation. Basically, the issue starts with setting the min req. to iOS 12.5 in the AppStore (release 1.12, including support for older iPhone models 5s etc), and it is apparently not possible, to discriminate in the store combinations of iPhone models and iOS versions, i.e. to set min req iOS separately for iPhone models. In other words, this somehow strange numbering of iOS versions for different iPhone models created this issue here.
Apple currently allows only one tracing app per country, i.e. to offer different CWA versions is not possible in the AppStore. This could be a workaround, but currently, it is not possible.

dsarkar commented 3 years ago

What happens if the device updates automatically? Will there be a pop-up message from CWA, will the dead man message be fired after 36h or will CWA simply stop work quietly in the background?

Stand by for answer, please.

r0my commented 3 years ago

Now i could install cwa 1.7.1 (0) for my device with 13.6 again. (thx jb) and cwa works.

An no. There was no notification, after the automaticky app update. I get no infos about risk status anymore and the the app quits its job. No infos in appstore app and update description about this case. Bad situation.

GHRob549 commented 3 years ago

@ndegendogo @Ein-Tim @GHRob549, dear all,

@Ein-Tim pointed it out, where it all starts: #2032 (comment)

To summarize, what happened:

(...)

This is a very specific, unique situation. Basically, the issue starts with setting the min req. to iOS 12.5 in the AppStore (release 1.12, including support for older iPhone models 5s etc), and it is apparently not possible, to discriminate in the store combinations of iPhone models and iOS versions, i.e. to set min req iOS separately for iPhone models. In other words, this somehow strange numbering of iOS versions for different iPhone models created this issue here.

@dsarkar This situation is specific, but it isn't particularly unique in that it's exactly the kind of thing every iOS developer should plan for when working toward backward compatibility. Sometimes it's due to changes to the SDKs or the presence of new functionality. The revelation here is the lack of understanding by the programmers.

* Apple currently allows only one tracing app per country, i.e. to offer different CWA versions is not possible in the AppStore. This could be a workaround, but currently, it is not possible.

The code on these two pages below seems to clearly hold the answers. "Extend your app to handle different versions of iOS and Exposure Notifications by incorporating the following code. Call getSupportedExposureNotificationsVersion() to determine if Exposure Notifications is available on the device, and if so, which API version to support."

https://developer.apple.com/documentation/exposurenotification/supporting_exposure_notifications_in_ios_12_5 https://developer.apple.com/documentation/exposurenotification/building_an_app_to_notify_users_of_covid-19_exposure

I beginning to really wonder what I'm clearly seeing here that the CWA programmers are not.

Ein-Tim commented 3 years ago

Maybe @thomasaugsten would like to quickly jump in here and give us a hint why the option discovered by @ndegendogo in https://github.com/corona-warn-app/cwa-app-ios/issues/2032#issuecomment-784613026 wasn't used?

thomasaugsten commented 3 years ago

We assume the documentation is not 100% exact here. You can add this kind of checks but in the plist you can only activate one version of the ENF. This means iOS 13.7 can also have version1 if this is defined in the plist. We gave this feedback also to Apple.

Besides this the support of two different versions, risk calculation and key attributes is out of scope for the CWA.

We recommend here to update on the latest iOS version because of the available exploits it is a high risk to use an old iOS version.

There are a lot exploits website/images or airdrop bluetooth commands available, which allows to get full control over your iPhone. Please install security updates. This also one of the reason for iOS 12.5

https://support.apple.com/en-us/HT212146

ndegendogo commented 3 years ago

Thanks @thomasaugsten!

the documentation is not 100% exact here

Indeed, true, the docu is a bit unclear. I remember that before iOS 13.7 / at times of ENF v1 only, the docu mandated to declare v1 in the plist. Still I have a question. From the docu alone it is not clear if Apple really performs a runtime check for the declared ENF version on a device with iOS 13.5 / 13.6 / 13.6.1.

Did you try to modify only the plist of cwa v 1.7.x to ENF version 2 and test if you can load this to a device with these affected iOS versions, and if this works?

For sure this would be only a first test if this could be a viable path to go. I am aware that neither you nor the users of these iOS versions see enough of ENF to assess if such a configuration is indeed working as expected; and that you need a confirmation from Apple on this.

ndegendogo commented 3 years ago

This situation is specific, but it isn't particularly unique in that it's exactly the kind of thing every iOS developer should plan for when working toward backward compatibility. Sometimes it's due to changes to the SDKs or the presence of new functionality. The revelation here is the lack of understanding by the programmers.

@GHRob549 well, the situation here is indeed different from the usual considerations that iOS app developers face when they support multiple iOS versions in their app. Yes, Apple gives us a lot of mechanisms to enable this. We can query for the availability of a method at runtime before we call it. We can query the iOS version at runtime. We can implement iOS-version-specific code where needed. And the minimum required iOS version usually prevents that a user loads an app version to her incompatible iOS.

But this case is different. In this case, Apple decided to backport their ENF to iOS 12. I am not aware of any such backports before; for sure it doesn't happen often (and I hope very much that they don't regret it meanwhile).

We all know that Apple usually goes forward fast; even at the expense to drop support for older iOS versions or devices; and that they have no interest to support jailbreak devices. I think we may safely assume that their focus in design and test of this backport was on device types; not on iOS versions...

GHRob549 commented 3 years ago

I have now deleted Corona Warn App. If my case puts me in the "out of scope" category, I am obviously not your target customer.

r0my commented 3 years ago

Why closed now?

thomasaugsten commented 3 years ago

To support iOS >13.5 <=13.6.1 is out of scope for the CWA.

We recommend to use the latest iOS because of the highly critical security issues of iOS before 14.4.

Ein-Tim commented 3 years ago

I fully understand the part about the exploits and also that it is not easy/it's impossible to define the ENA version on each device.

But what I don't understand is why it would be out of scope to support ENF v1 and v2? IIRC, it was possible to use version 1.7 (ENF v1) even after version 1.9 (ENF v2) was released. Where would be the difference in supporting it now? Or are all users on 1.7 running old configuration, etc.? The last supported CWA version was just set to 1.5, but not to 1.9.

Could somebody please explain this to me? Maybe I'm missing something here 😅 Thanks!

Edit: Maybe with support you meant that it would be too much work to support 2 versions in the app, etc.

So or so for me I consider this as solved since it is possible to fix this issue when updating iOS.

Have a good night!

GHRob549 commented 3 years ago

@Ein-Tim The topic is closed, but it's not solved by any means. It is disingenuous to call it solved.

@thomasaugsten I've now installed a non-German coronavirus warning app. It uses ENF as well, of course. Other nations' coronavirus app owners/dev teams consider iOS 13.6.1 to be what it is--a valid, signed iOS version and very much "in-scope".

If anyone is still reading this, I'll continue with what I consider to be wisdom based on experience:

Let's analyze the situation from the CWA user standpoint for a moment--critical for designing and maintaining any app, if the app owners/dev team care about actually what's happening out in the field in the users' hands.

COVID-19 continues to spread exactly because people are not behaving as others want them to. But here we have a situation where the CWA owner demands of its users that they update their fully-functional signed version of iOS? If people aren't being very wise about preventing contacts, why would that same person be expected to update their functioning iOS version? This defies logic.

Fact is, iOS 13.6.1 is not obsolete. It will be someday (just as iOS 14 or 15 will be), but it is not today, nor has it been for the last two weeks. It's just not supported by CWA. But it's supported by a few apps created outside of Germany, still utilizing ENF.

thomasaugsten commented 3 years ago

With 1.9 we have to increased the minimum version to iOS 13.7 The reason of the v1.5 min version was to decrease the support matrix. We will not support two ENF version in one app, we also don't thing this is possible at the moment.

This is correct other Covid-19 app doesn't update the risk calculation and they are using the deprecated ENF v1. All Covid-19 apps with the recommended risk calculation are not running on iOS <=13.6.1

The recommendation from Apple is not to use iOS 13.6.1 because is is not fully functional and not secure to use it. Also the signed windows is closed this means it is obsolete because it is not the latest version for your device and you are not able to install this version on your device.

GHRob549 commented 3 years ago

A lot of debatable lexical semantics here. I will continue to take personal precautions against COVID-19 for myself and my friends and family because this is my civil and social duty, but I won't be participating in using CWA in the future, even with any iOS update making it possible. As a CWA app user and taxpayer, I don't appreciate my thoughts simply being discarded, so the CWA app is now gone for me.

Hopefully you've gained millions of iPhone 5/6 and it doesn't matter what you do to others like me (as we both know I'm not the only person in this situation as your analytics would also show you.) But you are doing your job defending the stance here, this I understand.

jucktnich commented 3 years ago

Are there COVID apps wich support iOS 13.5 - 13.6.1 and are connected to the German app, wich will not drop the support for these versions soon? Maybe we can link to this app on the please update your iOS screen. (Maybe there should be a warning, that iOS 13.6.1 is not safe anymore, and you first should try to update your iOS.)

thomasaugsten commented 3 years ago

Here is the official list https://ec.europa.eu/info/live-work-travel-eu/coronavirus-response/travel-during-coronavirus-pandemic/mobile-contact-tracing-apps-eu-member-states_de

ndegendogo commented 3 years ago

@GHRob549 @jucktnich

When switching to an app of another European country, you should also consider the following:

does that country participate in the European Gateway, and especially does it import and distribute DEK keys of German origin? (most countries do)
does that country allow you to report infection when your lab is in Germany? (most countries don't)

ndegendogo commented 3 years ago

@thomasaugsten Thanks for the link!

ndegendogo commented 3 years ago

@dsarkar please consider to add a 'won't fix' label here - just to avoid any misunderstanding - because else it looks as if it is resolved and awakes false hopes ...

jucktnich commented 3 years ago

@ndegendogo maybe put your infos plus a link to f.e. the Austrian StoppCorona app on the Update your iOS Screen, because the most users won't update their os and will just delete the app. They probably won't know that StoppCorona app also works in germany and because of that, don't Download it. (What is better than no app.)

ndegendogo commented 3 years ago

maybe put your infos plus a link to f.e. the Austrian StoppCorona app on the Update your iOS Screen, because the most users won't update their os and will just delete the app. They probably won't know that StoppCorona app also works in germany and because of that, don't Download it. (What is better than no app.)

@jucktnich thanks for your suggestion.

@dsarkar could you please forward this suggestion to the developers?

Disclaimer: I am none of the project maintainers here; just part of the community... trying to support this project from my side as much as I can ... and personally I am very sad about this decision ...

Ein-Tim commented 3 years ago

cc @dsarkar

I suggest to:

Reopen this, for better visibility for new/other contributors. Although it won't/can't be fixed, the discussion is still going (and label it as won't fix, as suggested by @ndegendogo)
Discuss how to enhance the screen in the opened issue #2045.
Clarify wether a dead man message/etc. will be fired after the screen is shown. If not, this is absolutely something what should be fixed in the next version.

Have a nice Sunday everyone.

Ein-Tim commented 3 years ago

@GHRob549

I really understand that you are in a bad situation and I think that this never ever should have happened. Do you have any ideas how to fix this mess?

And, I'm so sorry to say this, but I think that the lost users are coming back through the new users, but I can't really tell. When looking at the comments in the App Store, I don't see that many users complaining about it, and remember, the most users are commenting in the App Store if something isn't working.

Also, about the "out of scope" thing. I think you, @GHRob549, are definitely in the "in scope" category for CWA, since you have a mobile device and also want to help stopping/fighting the pandemic. But you aren't the target customer/"in scope" user for Apple. Apple's iOS is build so that normal users don't have to deal with software or App updates, the OS will deal with it. Software updates are installed during the night, Apps are updated automatically, etc. When looking at non technical users, like my father or my mother, they fulfill this "in scope" category for Apple perfectly. The most users of CWA won't have this problem, I think that the most users who have this problem are actively stopping iOS from updating to stay on iOS 13.5 -> 13.6.1 (for what ever reason). And yes, they can for sure do this, but these aren't the majority.

But I think we had this on the beginning of the thread here, I just wanted to add that again.

dsarkar commented 3 years ago

@Ein-Tim

Clarify wether a dead man message/etc. will be fired after the screen is shown. If not, this is absolutely something what should be fixed in the next version.

I can give you feedback on this question already: CWA 1.12 on iOS 13.5-13.6 won't send a dead man message, but a message that update is required.

Regarding all other questions/suggestions, please stand by.

Also to you and everybody else in the community a nice Sunday!

dsarkar commented 3 years ago

Dear community,

in order to mitigate the "side-effects" due to lowering the minimum required iOS version to 12.5, and the known consequences for some users, as discussed above, we suggest a dedicated discussion issue to solve some of the problems encountered.

Some users reported they can't update iOS because there is not enough space. Different approaches can be discussed here: https://github.com/corona-warn-app/cwa-app-ios/issues/2126

This also should increase the awareness that even older iPhones can be updated to the latest iOS versions since we noticed that some users believe this is not supported.

Thanks to everybody!

Corona-Warn-App Open Source Team

Ein-Tim commented 2 years ago

I think this issue can now be closed, there was no engagement for over one year.

corona-warn-app / cwa-app-ios