chrome://on-device-internals reports "Model Name: v3Nano Version: 2025.06.30.1229 Folder size: 4,072.13 MiB" on a random Windows machine I just checked.
I clicked on a few red team "scenarios" if you want to call them that, a few of the tiles look like output of regular tools vaguely related to each but the rest - including the main "terminal" thing - seems more on the fictional side to the point I don't see this being educational.
There's plenty of training material out there these days actually using these tools in contained but realistic environments, if education is the goal just go for those.
Yeah that's fair, especially your last point. In a perfect pandemic-fighting world we could just have an app that did that, the decentralized model adopted won't be that specific. It would be more something along the lines of uncle dave getting a notification. I share your concern on initial adoption, especially since I could not find hard data on places that already implemented apps. I would expect an initial rush and then a plateau instead of WhatsApp like growth as some people expect. As for your specific questions I can only offer a few points on two of them given what we know about the current plan here in Germany, that highly depends on the country and I honestly have not looked at how health authorities work in the US very much.
> What happens if the app flags them as possibly infected? Can they call a hotline to give them information or is it just some automated crap they hear?
The new vendors here in Germany were especially chosen with the argument that they are able to operate 24/7 human phone support. With the decentralized approach they'll get a lot of people flagged and at the moment it seems like the app would suggest to them to call up that number (or likely offer that as an alternative to the other established contact points). Those phone contacts could then talk them through the next steps or, should testing become too limited at any point, through an assessment if testing makes sense for them / voluntary self quarantining can be done / ...
> It works using bluetooth. How much power drain on their batteries are they willing to accept?
In centralized models as proposed by PEPP-PT/ROBERT(France) or NHSX(UK) there's a few ways explored to minimize battery usage on Android, the APIs on the iphone require the screen to be turned on for this use case and must subsequently be horrible for battery usage. The decentralized model that was adopted adopted by many countries is supported by Google/Apple as OS vendors with battery usage and interoperability with other Bluetooth usage in mind, I doubt there will be much of an impact (at least not any that would drive significant user numbers away from voluntary use).
When discussing the paper I linked this article says "That sounds hard. The good news is that, done well, this measure alone could stop the epidemic. But even if you don’t do it well, it contributes." and correctly calls for combination with other measures. That's my main point, even if it's not as good as manual contact tracing the allegation that this is "tracing app" vs. anything else is just a pointless debate that Schneiers post seems to further. Like the article you posted seems to say, we should improve manual tracing and testing as well but I haven't seen anything in there that would support the Schneier viewpoint on first glance. Looks like an interesting read for later though, thanks for sharing!
> I'm not against a tracing app, but lots of unsolved questions aren't even discussed openly.
Weird, I see the points you made brought up in many discussions that are tad more professional than a Twitter argument.
Your first point is addressed by the fact that these apps are developed in tandem with health authorities. You don't just get locked away for two weeks because your phone popped up a notification. Just like there's stages for isolation there's ways to make this more compatible with regular life and still maintaining an impact on hindering the spread of this pandemic, e.g. getting you tested quickly instead of automatic isolation. Of course from an epidemiological standpoint one might argue that immediate isolation would be advisable but I doubt that would go over well in most democracies. The job loss argument seems like the economic impact argument brought up a lot over the last few weeks. On a population scale, an asymptomatic superspreader is likely far more expensive than somebody not going to work for a few days until they got tested so it could/should be addressed by policy makers. If your politicians can't figure out how to make mandatory sick leave happen during an active pandemic I'm not convinced a contact tracing app is the problem.
The debate on voluntary or mandatory usage will surely be interesting, though I don't see how making it mandatory would not lead to people actively avoiding it's use and thus lessening the efficacy.
That completely depends on your definition of useful, how people react to a "hit" in the application, and a bunch of other factors honestly.
Figure 3 from the paper I linked contains a heatmap [0] that shows the simulated impact on r in different isolation scenarios vs. completely manual contact tracing. That's where those widely cited 60% adoption come from. In my, non-epidemiologist, view what matters more is that a) the gradient in this is better than completely manual contact tracing and b) I have yet to see anything that suggests it did not help in Singapore. While their product lead [1] is a biased source, he correctly points out that working in tandem with health authorities is critical for these efforts. If these apps aren't made only for technologies sake I do not really see how they would hurt. They have 20% there, quite some experience with outbreaks, and didn't replace it yet so I'd figure 20% would be a good enough data point for other countries to evaluate the approach on the scale of a population. And afterwards they would have to be re-evaluated constantly, just like any other measure politicians and epidemiologists currently propose to address the pandemic. We imho don't have enough data yet to even remotely answer "this amount helps", "this is how good they are" but I don't really see how that justifies these "this isn't perfect so it is dumb" reactions in the other direction.
That's good points Schneier does not make in this post imho. The conditioning / slippery slope argument also applies to countries that currently go with the, imho, more sensible architecture of DP3T. We've seen worrying calls for including a bunch of additional features in Germany, e.g. (voluntary) epidemiological data collection and an "immunity pass" (not from the government yet but still, worrying). I think the privacy community, at least in my bubble of the internet, was excited that the scientific consensus of DP3T > PEPP-PT/ROBERT/(the NHS approach) won out over lobby interests and from their perspective was deemed the safer option.
It's not like they aren't discussing the broader implications of digital contact tracing from a bunch of angles, and I see calls for evaluating the proportionality and efficacy of these apps on Twitter pretty much daily. OTOH I don't really see how shallow dismissals of "it's plain dumb" like this blog post help the overall discussion honestly.
> [...] and Bluetooth -- just aren't accurate enough to capture every contact.
Did I miss his paper on the matter? There's dozens of groups working on this and even with a regular free space model the results seem "good enough" in <2m,15min scenarios for an additional data point.
Most of this seems to leave out that digital contact tracing is not a cure all but a tool to help manual efforts. I somewhat hate the simplification people bring here, that every additional identified contact helps, but dismissing it as "plain dumb" seems rather shallow as well. Sure, false negatives will be a thing, the false negative rate of not doing digital contact tracing at all would be higher by definition. Most of what he outlined can occur in manual contact tracing as well and we still do that, simply because it's necessary.
I haven't seen anything so far that would suggest that digital contact tracing in the poster child Singapore had any of the negative impact he brings to the table here and studies like Ferretti et al. [0] seem to make a pretty good case why it would at least not hurt the overall epidemiological goal.
> It's not accurate enough for you to quarantine yourself for two weeks. And without ubiquitous, cheap, fast, and accurate testing, you can't confirm the app's diagnosis. So the alert is useless.
The time frame and assumptions on testing capability is US centric I assume? If you can get a quick test it would not be two weeks, it's likely quick tests will become more prevalent if this sticks around long enough and testing capability will be raised to sufficient levels. Otherwise yes, false positives would quickly diminish usage.
Of course some of his points are valid and need to be addressed by OS vendors, apps and policy makers, and evaluation of efficacy will be just as critical as teaching the public that having an app does not mean things can go back to normal. There's also plenty of opportunity for abuse even with the commonly decentralized architecture that is at the moment widely agreed upon but none of that supports the allegations of this particular article imho.
The comments similarly bring up things like "surface transmission" as if that mattered at all. If you treat a contact tracing app as an additional data point it becomes much more sensible.
Since you're bringing up the website... I don't get this marketing strategy. The cryptocurrency angle is just as off putting as telling me as a potential customer that my data will be stored on janky servers in unreliable places, no matter if the uptime is the same. OP even claims they have reliability and experience I'd consider but those aspects sure send signals that make me not want to deal with that stack.
Just looking at the website for Sia I see a bunch of fluffy marketing stuff, fair enough, that's normal these days. But where is the selling point? https://sia.tech/technology tells me my data is stored securely and in a redundant manner, great, just like any storage provider. That is followed by "Renters And Hosts Pay With Siacoin" and talks about payment channels, which links to a wikipedia article and not something that tells me how I would even pay them, not to even talk about how much (I saw the calculator thingy on my way to that site, the messaging is still weird).
The "Getting started" call to action is a similar experience, a bunch of downloads, cool - I don't even know if you're right for me yet. I'm five levels deep into the "Getting started guide" linked there and so far found that I'd apparently have to deal with weird crypto exchanges to pay somebody for this, plus I couldn't use most of my pretty standard tooling anymore (at least not without involving one of those proxy things on the getting started page that cover a few use cases, some of which seem to be operated by others?).
I'm not sure comparing walled gardens is that benefitial here. Most larger firms will either have consultancies on retainer or in-house personnel that can generate these reports anyway.
> They are being frustrated by consultants who want to keep their billable hours up, and extraneously restricting access under guises such as "this person doesn't have enough training to touch the system," because it keeps them in paid work.
I'm not sure why there's quite a few people pointing these aspects out in here. As opposed to the person using that data to keep their own billables up? "this person doesn't have enough training to touch the system," seems like a perfectly valid thing to say given what these systems do and is certainly not unique to SAP. The learning curve might be steep, the documentation looks ancient, the ecosystem might seem unapproachable, but at the end of the day this isn't that different to similarly scaled products from players like AWS or MS for example. They might have more approachable lower tiers and are nicer in quite a few technical aspects but other than that? It's often consultants and "certification or gtfo" as well. It's not like the consultant costs come as a surprise to anybody in these industries. Sure, it's their own little sub industry but you could say the same about these other ecosystems as well, that's not special - it is just how a few of these sub sectors are structured.
I do, especially at SAP itself there was and is lots of interesting work hidden under all the crud. For the rest, relative wages and job security seem to be the driving factors for young graduates to join the space these days. The day to day there isn't really worse or more or less boring than any other B2B integration gig. Consultancies and working at the larger ones also suck for their very own reasons. That'd be the case with SAP or without. They hire business type people because the technical challenge of these projects is minimal compared to other aspects. Sure, most of these projects could often use a bit more of technical seniority, expertise, and overall strategy. But I think it's too easy to attribute failures solely to that, it's a mixture of problems, just like any large scale failure in the space.
While I get that sentiment I don't really see the ecosystem much worse than vendor lockin at any of the modern PaaS providers from a tech perspective. They always allowed integrators relatively extensive API access to their table model, last time I had to integrate that years ago the only hurdle was a bit of interfacing between the report / ABAP world and exposing it as a web service. Even management / security facilities were, albeit usually clunky, what you expect from a modern ecosystem. These days they seem to offer relatively modern and off the shelf APIs for quite a few of these tasks, especially for their cloud based offerings. I'm not sure that they see it as a threat, rather they want to be the single point of truth and lots of projects (completely separated from any tech aspect) would circumvent that.
Now was that a pain? Yes, sure. Especially the whole legal/certification/consultant crap you need to buy into alongside the software. But honestly, at least here in Germany, SAP ABAP/Java developers and consultants are easy to come by. Most of the problems I've seen in SAP related integrations are process related, not as much tech. If you're dealing with a customer that's already up and running in that ecosystem chances are that they already know their pain points, it's not really any different than any other large B2B integration in the space.
> The EU doesn't prevent the "bad" startups from existing. They just prevent them from starting in the EU, which means the EU misses out on a lot of the potential upside.
To me that sentence just isn't logical. Yes, they'd prevent some them from starting in the European market with their exact original business model if they were starting out now (and not like half of them in the last millenium). None of them started out here back in their time so that sounds more like a question of market penetration than benefit for the startup culture anyhow. With the GDPR they will hopefully also prevent said market penetration for bad actors when the time comes for the next generation of startups.
If GDPR is the sole reason and, subsequently, the US chooses to foster such businesses to win in a market, more power to them. Your examples might be huge successes, but many of them are at this time considered to be either unethical (Facebook, for the most part; Google had their share of negative attention) or plain illegal (Uber for example still hasn't managed to really start out in Germany, let's throw in AirBNB for good measure - I think they were founded in about the same year - huge financial hit that leads users to break laws and contracts left and right).
The calculation of long term cost and benefit is honestly the point where this discussion switches from economical concerns to political, at least for me since I'm not versed enough in macroeconomics to begin to judge that and would always place society over monetary concerns. I'm sure neither of us can win over the other so I'd suggest we leave it at that.
Okay, let's say there is enough data and you are absolutely correct. How does that invalidate the "Even if it did, the trade-offs are worth it." response?
The US-EU funding disparity was always there, in my book this leads to less people copying ethically dubious startup patterns from their US counterparts. If GDPR is the sole reason for the decline... doesn't the benefit of the population, of quite a few countries, outweigh the impact on a few startup folks and their investors?
The vendor list contains your own product and you, as in the company you co-founded, pretty clearly sells IDP software. https://idp-software.com/vendors/konfuzio/