microg / GmsCore

Free implementation of Play Services
https://microg.org
Apache License 2.0
7.63k stars 1.61k forks source link

Urgent: Implement the new Apple/Google COVID-19 tracking Framework #1065

Closed echeoquehaii closed 4 years ago

echeoquehaii commented 4 years ago

I know this sounds strange, but this is really important if we want to keep using microg in the next months or years.

Apple and Google have developed a new framework that will be used by many governmental apps for the tracking of possible infections of COVID-19. Many governments have made the use of such apps mandatory and will not let people move freely if they don't have it, while others have just recommended it, but might change in the future. I would like to remember that this is a whole different issue than private companies tracking users just for their own business. We are talking about public health and our own safety. I am well aware that the results and effectivnes of such apps are yet to be clear but, for the prevention principle, I think it is important that people who wants have the chance to use such apps to protect their own health and the one of their closest ones.

Of course I am raising the same issue to my own government and others, about why use such a Framework while they could do things in other ways. For example, my own italian government's app will use it, so I cannot use the app on my phone. While the norwegian government's app doesn't, and I have been able to download and use theirs without any problem. So it means that the technology needed to make such tracking work dont' necessasily must rely on the A/G framework, it's just a decision taken by governments and developers.

But, since we cannot rely on the fact that our governments will listen to us and move away from such freakin' framework, we should give the chance to people to still be protected from Google's malware, but at the same time try to protect our health by using the COVID-19 tracing apps.

ArchangeGabriel commented 4 years ago

Many governments have made the use of such apps mandatory and will not let people move freely if they don't have it, while others have just recommended it, but might change in the future.

Do they ofter Android or iOS smartphones to everyone? My mother doesn’t even have a cellphone… Hopefully I live in a country that is still considered kind of a democracy, and the app is not mandatory at all.

I would like to remember that this is a whole different issue than private companies tracking users just for their own business. We are talking about public health and our own safety.

Yes, but often politics use this to restrain our freedom and make use of terrible event (this pandemic, terrorism) to make laws for our “safety”. This is called “The Shock Doctrine”, and I would quote a famous one by Benjamin Franklin here: “Those who would give up essential liberty, to purchase a little temporary safety, deserve neither liberty nor safety”. Even if they seem tiny (but they actually aren’t), those apps are not a step in the right direction (while their effect for health will likely be very minor).

I am well aware that the results and effectivnes of such apps are yet to be clear but, for the prevention principle, I think it is important that people who wants have the chance to use such apps to protect their own health and the one of their closest ones.

Note that the app never protects you, only the other. While not using the app is not even a prevention principle: they are known ways this will be abused.

Of course I am raising the same issue to my own government and others, about why use such a Framework while they could do things in other ways. For example, my own italian government's app will use it, so I cannot use the app on my phone. While the norwegian government's app doesn't, and I have been able to download and use theirs without any problem. So it means that the technology needed to make such tracking work dont' necessasily must rely on the A/G framework, it's just a decision taken by governments and developers.

Yes, but often it’s laughable. The french government decided to not use Apple/Google decentralized framework (because sovereignty and privacy, and I kind of agree with that), and instead use a centralized solution powered by… Microsoft. So much for sovereignty and privacy.

But, since we cannot rely on the fact that our governments will listen to us and move away from such freakin' framework, we should give the chance to people to still be protected from Google's malware, but at the same time try to protect our health by using the COVID-19 tracing apps.

Anyhow, this is a duplicate of https://github.com/microg/android_packages_apps_GmsCore/issues/1057. Where you will learn than the man issue is manpower: @mar-v-in, microG main and almost sole dev, has been focusing on other topic for a while, and might only return to microG at some point later. They are already a bunch of issues at hand, and implementing all this framework correctly is not an easy task and will likely not be achieved. However, you might rejoice that Google will likely integrate it in AOSP directly in the future.

echeoquehaii commented 4 years ago

@ArchangeGabriel Thank you for your reply.

While I agree with you on the privacy side, I don't on the epidemics side. Governments indeed use this kind of situations as you said, I know, but I, as a health specialist, strongly believe it is a necessary tool to control the epidemics, that's why I'm fighting for having a working app available for most of the systems around.

Being a democracy doesn't imply that useful tools should not be used if they might be used in a not proper way by our governments. Actually I think it should be the opposite, since I live in a democracy I trust my government to use some data for a fair use. And epidemics and health control are one of those use for which such apps are fundamental. Moreover the PEPP-PT protocol has been built with privacy in the center. Does it mean NO DATA at all will be used? Of course not, but that's the point of controlling an epidemics, you need data to know how it is going and we should use the tools we have to do it. Have you ever been hospital? Are you aware that your data in the hospital's database, all your health parameters and information, linked to your real indentity in your country, are available to any government or simply anyone working in the hospital which has an account to enter in the system? Not talking about the private companies making the software used in the hospital, which is prominently proprietary, and this means they might collect all possible data linked to people with their Name, Surname, Address and so on.

My point is, I care about my privacy, but I do care about my health too. If I am sick and I have no chance of getting cured without giving up some of my privacy, I might resist at first, but if the illness will get worse I will eventually go to the hospital, that's for sure.

So, building a system to track infected people does inevitably bring some sort of user data in the hands of the ones handling it. But there are many ways of doing that and the PEPP-PT protocol does this in a pretty fair way, on the privacy side. My problem is that its implementation and application as of now is much worse than it should be, that's why I'm fighting for it. I want to protect me and my family from getting sick and I want to do that using as much open source software as possible. Can the protocol be applied in a better and more open way? YES, if the app is open source and built from source, you exactly know what it does and which data is shared. So why shouldn't those apps and the protocols and frameworks they are built on be open sourced? That's what I'm fighting for. Then, you are free to use it or not, but I want to be free to decide this.

Sorry for the length of my message!

BTW thank you for pointing me to that issue, which I didn't see before, and from which I have been able to find a project that tries to address this issue: the CoraLibre project

eggercomputerchaos commented 4 years ago

if tracking data are available , there will be humans who take advantage of this. the past has shown this sufficiently and there is no reason to assume that this will change. for this reason i consider the further development of microg to be important . every human can/must find his own truth

mar-v-in commented 4 years ago

Duplicate of #1057

echeoquehaii commented 4 years ago

Duplicate of #1057

Sorry! Missed that...