I have to say the main reason I did not install my country's (Norway) corona-tracing-app is that they said it could not be made safe if the source code was public. Nice to see other countries do the right thing.
The definition of soft corruption -- very angry with our government. A text book example of an app/software that should absolutely be open source.
FWIW, the German app was largely built by SAP too.
Because the app is clearly in the public interest. Funded by public money and simply cannot be reliably secure without being open source.
This is just some guys in gov getting kickbacks by awarding the contract to their mates.
Ouch, that in itself does not sound very convincing.
Only experience I've had with SAP is when an earlier employer of mine bought SAP and after 6 months the login still did not work. SAP had to bring some Windows PC's of their own for us to login on, which were "setup correctly".
https://github.com/alphagov https://github.com/hmrc https://github.com/UKHomeOffice
I'd say no, but it's a bit surprising, because it does have a pretty decent open data culture. The weather [1] and mapping [2] data services are world-class, for example.
[1] https://hjelp.yr.no/hc/en-us/articles/360009342833-XML-weath...
[2] https://kartverket.no/en/data/Open-and-Free-geospatial-data-...
I am hoping the open trend will continue because the Norwegian government sits on some really high quality data that could see a lot of interesting uses.
[1] https://www.kartverket.no/en/data/bathymetric-data-and-DTM-o...
Centralized storage of GPS & bluetooth data and refusal to open-source (which is a tacit acknowledgement of insufficient confidence in security -- of the personal movements of the whole population, no less). Statements from researchers involved in the technical development that citizens have a responsibility to give up their personal information. Poor debate and communication regarding the choice of centralized tracing.
Then followed up with painfully weak statements from politicians and researchers that this is a truly exceptional one-time-only transgression of privacy, which will be rolled back permanently on a specified date and never be construed as precedence for similar actions in the future.
FHI, responsible for the app deployment (the Norwegian version of the CDC), has previously betrayed the trust of the public by refusing to destroy DNA samples of exonerated suspects and witnesses. Skepticism towards their ethics and degree of principled data management is highly justified.
Digital contract tracing seems dubious anyway, but thankfully we're in a position at the moment where it is definitely unnecessary. Might be relavant in a few months though.
I would say no. Some years ago (2012) I was somewhat hopeful. I attended a conference hosted by "Friprog senteret" (Free software center) called GoOpen. "Fripro senteret" was a small but very effective organization that got great publicity (the crown prince held a speech together with the Wikipedia founder etc.), and in general open source and open standards seemed to something people cared about, at least when informed about problems of lock-in etc.
A few years later (2014) Friprog-senteret was de-funded, and it just seems like the whole society drifted towards convenience over privacy/ethics etc.
The UK made their app public https://github.com/nhsx/COVID-19-app-iOS-BETA But app only, none of the server-side projects. Germany and Italy https://github.com/immuni-app also made public some of their server-side components.
So there is no chance I will install the UK app as I have no idea what they will do with the data.
Obviously we cannot be sure the open sourced code is what their servers (and even app) actually runs but it gives more confidence.
edit: The risk would be breaking into the backend and spamming exposure notifications. In that case, just take down the server and restore from backup.
There's not really anything they can do to comprehensively prove what they do with the data after it has been received.
What are your concerns with the data it sends?
I agree, certainly the server-side part of the project must be open for this to make sense.
Amnesty did a review of tracing apps and listed Norway as one of the worst for privacy: https://www.amnesty.org/en/latest/news/2020/06/bahrain-kuwai...