NHS open sources contract tracing iOS and Android apps
github.com/NHSXPosted May 7, 2020, 6:47 PM UTC
10227
github.com
What do people think about the code? I wasn't sure what to expect?
9
The iOS code looks very good from a first glance. Well organized, good test coverage, and like everything the NHS does it has good support for accessibility features. Though I don't think they're making use of the new APIs Apple added to the newest iOS 13.5 Beta.
Also all the dependencies to Firebase and AppCenter seem a bit iffy considering the privacy debate around these kinds of apps.
20
Nope, the UK NHS is going for a centralised approach, not the system being designed by Apple and Google. Details of the approach and some of the whys here:
https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contact-tracing-app
I think Firebase is primarily being used for push notifications. I believe it was chosen above whatever Apples native offering is because it will work on both iOS and Android.
16
Doesn't firebase work by connecting to APS? I was under the impression that you can only send push notifications to iOS via Apple.
3
Yes you can only send Push Notifications through Apple. That said, because Firebase is essentially abstracting that away they only need to worry about sending notifications to Furrbase, and not to multiple services or worry about different types of devices.
4
I’d imagine it was a decision not to use new APIs - this app needs to work on older versions of iOS if it’s going to have anything like the install base it needs.
2
Though I don't think they're making use of the new APIs Apple added to the newest iOS 13.5 Beta.
No, they are trying to send Bluetooth signals in the background to communicate with other phones. That doesn't work very well on iOS...
1
Don’t know the first thing about Kotlin... but looking at the Android it looks like very clean code to my untrained eye. A nice surprise really, nothing jumps out at me as bad.
15
That is what I thought as well
1
It is not Rust, so it is trash...
-32
Rust is trash, ugliest syntax I've ever seen in my life
0†
There's still no way to prove that the version on the app stores are running the code that's been publicised.
5
There actually is. It’s called building the apps and the comparing the output. You will easily be able to see if there are any differences in the code.
3
I imagine that's fairly simple for Android but how about iOS?
2
Not great but possible.
3
Well at least it looks better than the dreadful modelling software developed by Imperial College
https://lockdownsceptics.org/code-review-of-fergusons-model/
-1†
Odd comparison to make.
3
Two pieces of software, both used by the UK government as part of their covid 19 work. I thought the different qualities of the code made an interesting comparison. Apparently not many people agreed!
4
Scientists write shitty code, it is known. (also they said the code wasn't ready for release and was shitty, they were then told it doesn't matter and to release it anyways.)
2
I had wondered how they were tracking contact. Given Apple and Google said it couldn't be done.
Bluetooth device detection. That's clever. It seems so obvious now.
-17
Given Apple and Google said it couldn't be done.
Apple and Google are both planning on doing literally the exact same thing and have been this whole time.
36
I thought the issue was that Apple don't allow the right access to the bluetooth system when the app is not in the foreground, looking at the Android code it seems they have made it work:
/*
When the iPhone app goes into the background iOS changes how services are
advertised:
1) The service uuid is now null
2) The information to identify the service is encoded into the manufacturing data
in a unspecified/undocumented way.
The below filter is based on observation of the advertising packets produced by an
iPhone running the app in the background.
*/
14
No. Just no.
-18
An observation: the minimum SDK version is 24 - that means Android 7+ is supported.
Based on one of the points in their blog post
I was expecting them to go even older, to Android 5+. There most definitely are people within the UK still using 4+ devices, and there are still plenty of devices on Android 5/6.
For anyone (like me) who doesn't know what that means for timing:
Android 7 game out in mid-2016. Although cheaper devices often ship with other than the latest Android so it's quite possible people bought devices in 2017 that came with Android 7.
https://en.wikipedia.org/wiki/Android_version_history#Android_7.0_Nougat_(API_24)