Edit: This is not questioning this particular app. A lot of govt are making their tracing app open source [1]. Since making it open source is supposed to increase trust hence the question.
[1] India app: https://github.com/nic-delhi/AarogyaSetu_Android
For second: we can easily see that the app doesn't use GPS or similar, which is a nice indication
For third: Germans overall trust their government to not lie as much as other governments
For forth: Researchers will reverse the app
The only way this thing can work is, if the population trusts it, installs it and keeps their phone on. If the population doesn't trust it, it's doomed. It's in the self-interest of the project to be trustworthy and transparent.
If you understand German you might enjoy this podcast with two of the developers: https://ukw.fm/ukw030-die-corona-warn-app/
The following points you go on about are mostly irrelevant.
That combined with an Android based on AOSP and trust issues should be reduced (while the bad government can still track you using cell towers and for that app one could still place Bluetooth beacons everywhere and the server's could still store more information (while the only keys transmitted are those of infected, which is quite little) ... so yeah, pick your level of conspiracy
Trust is good, control is better. But in this case the fault is certainly with shitty app stores and mobile OS.
I think the restrictions we see on mobile devices will at some point be the death of reasonable software for mobile. Yes, yes, I can run my own binaries if I jump over X hurdles but I have given up on mobile development years ago. It was zero fun in my opinion.
For the ones with basic trust, they do a lot. Way more than most others. (Just look at the transparent dev process, the depth of documentation etc.)
That said, I never said anything about not using the app. I will certainly try it, although I think we are at a pandemic stage when it doesn't matter that much anymore. Maybe for the next one.
This becomes philosophical, but the contract certainly contained security requirements (whether those are "adquante" can be argued) and they certainly required audits, which were done. But yes, the health minister is not an IT security expert, thus details are delegated.
> If they could get more info from people, they would try.
As the French try and Norwegians tried with their central approaches. If they wanted they could have made it closed source (like anything else they did before, thus nothing special) could have done more hand wavy design documents, could have done development away from a public repo with public issue tracker, ...
They (and yes, this was to a notable part driven by the engineers, but supervisees could easily overruled) conciously made it open and transparent.
There is hardly anything more they could have done within that project. (Spying activity by German intelligence/BND, "state trojans" (Quellen-TKÜ), ... etc are serious topics and yes, some "security experts" (i.e. Wolfgang Schäuble) demand mandatory tracking apps, but don't see that as being far from a mainstream oppinion in the government.
The reason we got this transparency is the implicit demand for open solutions, not because of generous overlords. You could make tracking mandatory but it would certainly be a huge failure in the end. So they reacted to a demand and I have more where that came from. To repeat, I have no issues how it was handled here. Baby steps...
German here. I don't trust my government to not lie (based on past evidence). However, I don't think the government is competent enough to execute this particular type or lie (or even creative enough to come up with it in the first place).
How do you know you can trust instagram/google maps/ any other common app on your phone?
I would trust German government way more than i trust just about any corporate entity I can think of.
However, since this is a tracing app and being open source would imply "look, our app is clean, check our code if you do not trust us". Off-course making it open source has other benefits too.
> How do you know you can trust instagram/google maps/ any other common app on your phone?
I don't. If I am using it I know that I have no way to validate or enforce what happens with my data.
To add, there are currently discussions underway in the German parliament to give our secret services (namely the notorious Verfassungsschutz) the power to compromise IT systems (Bundestrojaner). I'd trust even the government not that much these times.
As for conpromising IT systems, arent they just going to bw on a level playing field with NSA and others?