Hacker News new | past | comments | ask | show | jobs | submit login
Google promised its contact tracing app was completely private, but it wasn’t (themarkup.org)
510 points by EastSmith on April 27, 2021 | hide | past | favorite | 218 comments



This title is kind of exaggerated. In order to obtain this data you'd need to get the Bluetooth identifiers from the system log. In order to get the system log, you need root or adb. At that point you can just log GPS directly, inject code straight into the COVID tracking app, etc. All bets are off.


This is the interesting thing about it:

The signals that a phone’s contact tracing data generates and receives are saved into an Android device’s system logs. Studies have found that more than 400 preinstalled apps on phones built by Samsung, Motorola, Huawei, and other companies have permission to read system logs for crash reports and analytic purposes.


But again, they also have system privileges on your phone and if they wanted to dump location data or bluetooth scans they could do so trivially.

About the worst that could come of this is an accidental capture in a crash report.


So maybe Google shouldn't have guaranteed privacy of this app on a phone OS where such a promise is impossible to deliver?


Basically any device can be seen as compromised if anyone malicious had hardware or root access - including the manufacturer. If you don't trust your manufacturer, you have far bigger problems than bluetooth IDs in the log.


I consider Facebook malicious, and I've just learnt that their pre-installed app basically has root on my Android.

How is that not the story here?


No, the Facebook app most likely does not have any special permissions. These are typically granted by manufacturers based on their own signing keys.


A preinstalled fb app does not have any special permissions.


How are you even remotely surprised by that? If you are expecting any privacy or security from a combo of Facebook and Android, you've been asleep for the last 13 years.


But that's just it. I DON'T trust Google one iota.


Then if you have an Android phone, you have no reason to believe your location data is private from Google, with or without the contact tracing app.

I'm not saying this isn't a problem, I'm in the same boat here, just that the contact tracing app doesn't really add to it.


Then you shouldn’t have an Android device. This isn’t complicated.


I don't have an Android device presicely because of this. I don't use Google Chrome, search, etc. I block all GA,Tagmanager,blahblahblah as well.


Great, this “issue” is irrelevant to you and your off-topic rant adds exactly nothing to this discussion of a clearly defined risk. For other people who have made a relevant device choice, the point stands that it’s a non-issue since there’s no additional risk.


As someone in a similar boat without an android, I think it adds to the discussion. It makes me feel warm and fuzzy inside to see such rants.


Hardly. Your privacy also depends on what devices your neighbors use. Bluetooth/Wifi/etc packet broadcast, etc. Apple does _some_ things to midigate privacy risks for their users, but not enough.


This. My wireless networks, MAC addresses etc are collected on Google's end by my neighbors' Google devices for things like advanced location tracking.


But note that now Apple has fake mac addresses (for wifi though) for this reason.


Google's advanced location tracking logs access point ESSIDs and MAC addresses. Whatever Apple is doing won't stop that.


Actually, Google and Apple teamed up on a contact tracing concept. Even when it was first annouced, the fact that G was attached meant that I wasn't interested. Apple's involvement only lessened the distrust slightly to me, but not enough for me to want to bother with it.


The only option you have is a phone like the Nokia 3310 then. Android and iOS are equally bad, just in different quantities of bad in different areas.


In regards to privacy they are not equally bad. And for this contact tracing app they aren’t equally bad.


They are equally bad just in different ways to different people.


Just like a Nokia. Do any manufacturers even make their own OS anymore?


buy an iphone?


This seems like saying they shouldn't have guaranteed privacy because someone could be looking over your shoulder while you type your password. Maybe that's true, but it also seems like a uselessly impractical way to interpret things.


What type of guarantees did they promise?


I imagine for semi-criminal actors, injecting code or "accidentally" using systen data, are still two different scenarios. I mean, state actors could also just follow you around, or place agents as friends and family... so why bother about anything?


> About the worst that could come of this is an accidental capture in a crash report.

So.. this data is exposed and available even though they said would/could never leak. Seems pretty cut and dry to me. It is a black and white issue. Accidental disclosure is still a disclosure.


It's accidental exposure to someone who already had root and could record the data themselves.


I think there's a practical difference between what an app could do with root permissions and what is widely understood to be likely or acceptable. The "anything the app could do it is doing" model isn't really the right model to apply for vendor apps that are generally trusted by consumers (and observed by security researchers). We're not talking malware with root; we're talking the regular system health and monitoring apps that vendors install.

So it's real unlikely that MotoCare is intentionally trying to de-anonymize someone's COVID-19 data by code injection or continuous GPS logging. It is extremely likely and expected that the app is periodically grabbing the syslog as a crash report, and that means Google's claim of keeping your data private now has to implicitly assume that MotoCare, without doing anything special other than its regular behavior, is also keeping your data private. That's not a claim Google should be implicitly making on behalf of MotoCare (let alone on behalf of every app that could hypothetically be installed on your system and is understood to be well-behaved in the sense that it just reads the syslog).

It's really incumbent on a privacy-protecting application to not put private data in the syslog. If it's in the syslog, it's not private (even though it's more private than, say, a notification on the homescreen).


Link to studies?



Google did claim that the identifiers are ephemeral. They may be hard to access but they aren't ephemeral. This sets up the possibility of post-hoc attacks.

Sure, if you get root, all bets are off generally, but now if you get root, you can figure out identifiers used before you got root, which isn't what Google said was possible.


The identifiers are ephemeral.

About 10 minutes for a given RPI (what gets broadcast over Bluetooth), 1 day for a TEK, and 14 days of local TEK history. The generated RPIs aren't retained, and the TEKs - which can be used to re-derive the RPIs - never leave the device unless you choose to report a diagnosis. All of this is destroyed after 14 days. This report doesn't change any of this.

I recommend reading the GAEN cryptography spec: https://blog.google/documents/69/Exposure_Notification_-_Cry...

The issue here is that privileged apps that are bundled with the OS could snoop on the system log to capture new RPIs when they're generated in real-time. Which isn't great... but privileged apps can already do much worse. If one of these apps is malicious, they could just log your GPS position directly (for example).

Heck, an application with root could just read the 14-day TEK history directly off disk. Once we're talking privileged apps and processes running as root, all bets are off. You need to be able to trust the device's firmware.


> but privileged apps can already do much worse. If one of these apps is malicious

One of these apps (google play service) downloads Ads non stop, mine wifi and gps data and send to a central server, etc. All against user wishes ...or even knowledge!

At which point do you draw the line for an app to be malicious?


In this case, "malicious" clearly means "interested in misusing the private data under discussion."


It's the fact that it logs other people's data, not just it's own, that makes it less than perfect anonymity.

But then again... You'd need to have a list from the "other side", to actually deanonimize this data. At that point, you can just get WiFi and Bluetooth physical addresses.


I've seen this described as "the security vulnerability is on the other side of the airtight door", which I found was both poetic and apt. It's apparently pretty common in bug bounty submissions.


Replace "apparently" with "definitely".

The number of bounty submissions that I've seen which come in the form of "I can read a program's private data using root" is too high to count.


Yeah it's a ridiculous assertion.

It's basically arguing that because the phone knows it's own identity it's not private.


Isn’t it saying that a bunch of preinstalled apps also have access to this info?


And what is the most common privacy-violating preinstalled app? Facebook.


Different kind of pre-installed.


On iOS, none of that is even possible with physical access. Nothing that you’re saying sounds hard for a malicious actor to pull off. The interesting thing is that you’re getting is a historical log without the need to install anything.


> Nothing that you’re saying sounds hard for a malicious actor to pull off.

A malicious actor would need to be your phone manufacturer, Google or someone with a root exploit (jailbreak in iOS terms) or this "vulnerability" would be completely useless.

All of those parties could just as easily push code to your device any number of other ways that could do far worse than reading your logcat for BT IDs.

I understand the concern, but if you're at the point where you can't trust the parties who push automatic updates with high privilege levels but you do need to be concerned about reading logcat your threat model here is pretty strange.


Isn't the difference based on time though? The device manufacturer can push a patch, but they would get access to the information after the patch, whereas access to the log gives you information from before the patch. Or have I misunderstood?


The device manufacturer has access to the device (at the hardware level even) the moment they start building it. They don't need to push a patch to gain access, they could access your logs at any point throughout the lifespan of the device.


I think we're talking about different things. If a manufacturer wants to eavesdrop on my device then they need to push a patch to my device. They can only get information about what happens after they push this patch. They can do it at the start of the life of the device, but they'd have to do it then.

However, if important data is retained in logs, then the manufacturer could grab the data from the logs. They can get information from a time before they decided to look into you.

It's like a wiretap vs access to a diary. A wiretap only gives you information after the tap has been installed, whereas getting your hands on someone's diary would give you access to previous information too.


Ah, thanks for the clarification, that makes sense. I was jumping to the assumption that the manufacturer was malicious from day one.


On iOS, you have to trust Apple and everyone who writes code for Apple, directly or indirectly.

If any Apple code that runs as root is evil, then your location data can be stolen in exactly the same way.

In the case of Android, the equivalent is code written by Google, the OEM, the chipset maker, and anyone those people gave root access to (which is often a long list of 'sponsorware' apps).

Overall, the class of vulnerability is the same, but Apple just does a far better job of vetting and controlling the list of people/code.


> Overall, the class of vulnerability is the same, but Apple just does a far better job of vetting and controlling the list of people/code.

This as well as the extreme lack of trust for anything Google. Apple has an incentive to keep the privacy kick going, Google is already figuring out a way around Apple nuking ad identifiers. Trust is important.


And people complain incessantly that they don't really own their iphones because they cannot install their own code on it. You can't win.


Sandboxing exists.


Of course it does. Sandboxing even exists on Android. The criticism here is that if you have some system that has root and can poke through sandboxes that you can access this data.

You either have full access or you don't.


That wasn't my point. It was that iPhones need not limit apps to the "App Store" in the name of protecting the system, since it can sandbox apps, wherever they come from.


If the non-app-store-installed apps are sandboxed then they cannot actually run everything that tinkerers want and the same criticism persists. The "we don't own our phones" crowd wants root.


That's a different complaint though. Just allowing sandboxed, sideloaded, apps would enable a whole host of new apps such as emulators, plus it would allow apps to provide their own monetization (e.g. Fortnite).


There’s a far larger number of iPhone users that either don’t know what root is, or don’t care. And your parent post is incorrect, Apple denies apps all the time.


How is this an instance of "you can't win"? Not "owning" your phone is a downside of iOS's approach, and avoiding the security issue as parent commenter mentions is an upside (ie a "win"). This martyr complex over phone OSes is very 2010.


He means as a phone manufacturer you can't win, either you have an open OS and get criticised for not locking it down or you have a locked down OS and get criticised for not opening it up.


This is just true in general. People complain about everything these days.


How is this prevented in ios if you have root (=jailbreak)?


I get that this might not be useful from a technical point of view for this crowd, but it's not exaggerated at all even if the point of failure isn't Google and the app; if we want to be serious about fixing privacy issues, we can't just wave away vulnerabilities that we've accepted for a long time out of pure convenience and apparent difficulty to solve.


It’s a little surprising how much effort went into things early in the pandemic that didn’t pan out.

Official contact tracing in the US is a complete dud and had negligible impact on the spread. People informing their fiends/family “hey I just got Covid you should probably test/isolate” was what practically can make a difference.

Ventilators were the critical thing until we realized they were a very sub optimal treatment.

All the surface cleaning was a massive waste too... and the chemicals used in some places destroyed a bunch of furniture.

Masks, fresh air, don’t go out when sick or after close contact with someone when sick. Simpler things that make the most difference.


All the surface cleaning was a massive waste? How about was and continues to be. At least where I live in Ontario, stores still won't let you touch products, require hand washing, wipe down all the carts, etc. It's all theatre that doesn't really do anything to stop the spread of covid but has the benefit of making it look like they are doing something.

Another example is that while schools are closed now again (because they aren't safe), the government until a few weeks ago was bragging about how safe schools were because of their extensive cleaning procedures, which did nothing to make schools safe since ventilation was the key!


Maybe it was/is a dud for COVID-19, but there does appear to be many gains from this outside of COVID-19. Infectious diseases that ARE highly transmissible on contact has been dramatically reduced.

Am I suggesting we continue with this level of rigor for cleaning after the pandemic has ended? No. But it does highlight how much "healthier" we can be as a society with a little more emphasis on general hygiene.


>But it does highlight how much "healthier" we can be as a society with a little more emphasis on general hygiene.

The counter-argument to this is that excessive hygiene also seems to (quite probably) cause health problems [0]. There appears to be some tension between protecting the weak and protecting the herd, so it's not at all clear that this increase in sanitization will ultimately be a net gain for public health (to say nothing of environmental impact).

[0] I leave it to the curious to run a few google scholar searches. "hygiene hypothesis" is a good start, pointing to relationships between excess (or more exactly, a wrong kind of) cleanliness and poor development of the intestinal microbiome.


It almost definitely reduces the spread of flu. I highly doubt it continues post-covid though. Some people seem to love the idea of wearing masks indefinitely though so I think we'll see more of that.


You're definitely right, with the caveats that other posters have pointed out that there might be benefits from less cleaning as well. My big concern isn't that we're cleaning, but that we're cleaning too much and using that as a justification for doing less of anything else.


In Portland retail stores require you to hand sanitize every time you enter which becomes a bit cumbersome if you enter a few stores during a trip. And yes, the extra effort has a cost, because I've been told to sanitize in front of employees who are interacting with groups of customers at close distance (while masked tbf). At the end of the day humans have a small set of things they can juggle in their minds and that focus should be on ventilation, spacing, and masking instead of wasting focus on unnecessary surface cleaning.


There's a go-kart track near me... and they have someone who goes around after each session and sprays some kind of fog on the karts. I presume it's a "sanitizer" but if you look how sanitizers work, they still take time to act and it takes a decent quantity of it to work. Meanwhile the steering wheels are covered in pourous foam / plastic / rubber, which is soaking up everybody's sweat, germs and bacteria... and some how this fog, which is safe for the person spraying it to stand in, sanitizes the entire kart in under a few seconds and leaves behind no residue...


Still better are the two-person crews in full gear spraying this fine mist over airport lobby chairs and furniture (and people sitting nearby) while wearing enough PPO to look like late stage Chernobyl responders.

Security performance theater.


Perhaps they should add a mitred hat, some beads, a censer, and a droning chant...

Change it from theater to ceremony!


The Bluetooth contact tracing would have been amazing, the design was smart, privacy preserving, and worked.

The issue was a few things:

- Opt-in instead of opt-out

- People (even those on HN) not understanding how it worked and loudly and wrongly stating that it was a privacy nightmare. See this thread: https://news.ycombinator.com/item?id=25629304

Unfortunately this lead governments and others to just buy data from brokers/3rd party app collectors and such that are not privacy preserving. A pretty frustrating situation.


Completely agree with this. And the opt-in problem was twofold, you needed to opt in to receive notifications (and in California this option wasn't even available until like 6 months after the frameworks were available) and also needed to remember to manually upload your result to the system after testing positive. The testing centers should have been asking for people's contact tracing id info and they should have been the ones reporting results into the system. (They already have your full name/contact info when you book an appointment, and the contact tracing id is anonymous, so again this is not sacrificing your privacy any further).

It seems like a major factor in why this idea was never taken seriously by governments was that professional contact tracers are still using the playbook from 70 years ago from the polio era where the only thing you try is cold calling people's home phones. The public health field seemed entirely uninterested in technological solutions, even though it seems incredibly obvious that these could have had massive benefits over the old fashioned way of doing things.

As with several other things that happened over the course of this pandemic, I really just can't wrap my head around why the "experts" were so willing to just let half a million deaths rack up in the US rather than trying any new ideas. I would be interested to read more about contact tracing now though, and if any of them have changed their mind by this point.


Agreed - the cold calling was a joke and only really started after community transmission was super widespread anyway.


One problem seems to be that no proponent of the technology actually acknowledges that there _are_ ways in which it can be used to track people.

Personally, I use an iPhone, and (for the sake of argument) trust Apple's software. However, I absolutely don't trust Google's software, including their implementation of this technology. My understanding is that all the Android phones around me will store all the nonces which my phone sends out. I then publish a list of all my nonces if I find out I get sick. If Google wants to invade my privacy, Android phones can upload all the nonces alongside the location where the nonce was seen.

If Google wants to track people, Google can use their wide network of Android devices to get an accurate location history of every non-Android user who gets sick.

Or at least that's my understanding of the technology. It might be incorrect. Maybe there's some way to somehow ensure that the nonces I publish aren't associated with me. But again, I haven't seen anyone who encourages the use of the technology take this seriously, and none of the "explanations" of how the tech works go in-depth enough.

I do use the exposure notifications feature on my phone, but it does worry me.


Bluetooth contact tracing had absolutely no chance of ever working.

15% of adults don’t own a smartphone.

47% of children don’t own a smartphone.

Of the 85% of adults who own a smartphone, 20% don’t carry it with them.

At absolute best 50-60% of Americans would be walking around with a contact tracing app. And that is if it was forcibly installed, and forcibly enabled.

The tracing is pointless even before we get into the technical flaws.

When you’re indoors, 6 feet is irrelevant. The air is circulating.

Bluetooth signals penetrate walls and glass.

The end of all this is a system that absolutely no one would trust on the positive or negative. Seriously think about whether you would consider an “all green” to unequivocally mean you were safe. Or that a “red alert” was actually cause for concern.

This has absolutely no chance at working. And despite what you’re saying about privacy, it is the mere existence of a tool like this that is alarming. It’s baked into the operating system, with no visibility into how it might be used in the future.


I just don't want to be tracked, ever, for any reason, by anyone. It doesn't matter how the system works or how private it is. It still normalizes surveillance to those who participate, and I won't :)


> I just don't want to be tracked, ever, for any reason, by anyone.

Curious what this means to you in practice? I'm trying to imagine what zero tracking looks like... and wondering if I misunderstand what you mean by "ever, for any reason, by anyone." or if you're really serious about your wish and mean it as literally as it sounds.

You don't want your doctor to have records of your previous visits? (Prefer to be offered the Covid Vaccine every time from now on?) You don't want the ability to have any personal bank / investment accounts? Our HN account & posts are being "tracked", what's an alternative to this discussion? How should governments manage the basics of things like social security or driver's licenses? How would anyone even contact you or employ you without some kind of telephone number or internet address that can be tracked? How would you find gainful employment, and do you want to re-negotiate your compensation daily?

Framing all information storage as "tracking" and all information retrieval as "surveillance" seems to turn a blind eye to the many benefits we enjoy, while stoking a general and vague fear. I think I'm more privacy conscious than most, and I think we have some massive privacy issues at the moment, but I have to recognize the benefits I enjoy at the same time and seek to find a reasonable and practical balance. So, I accept some tracking, and what I want is always opt-in by default and control over who tracks what.


You'll be tracked, it'll just be worse and not in a way that protects your privacy.

You'll also be generally ignored by people that care about solving these problems.

You'll also make it harder for people that care about the distinction between pragmatic solutions that protect privacy and simple solutions that don't.

When your response to both is the same the response from governments is: "the privacy people are going to complain no matter what, so just ignore them".

Your comment is basically an example of the kind of misleading knee-jerk response I was talking about. The bluetooth alerting design is not tracking, but your response to it is more likely to lead to solutions that are.

Clever technological solutions can allow us to preserve privacy and still do important hard things. The bluetooth exposure notification design is an example of that, people that care about privacy should be excited about it.


You’re totally ignoring my point. I’m not talking about the tech. It affects the way people in general will think about having tech track them.


I understand it, I just don't find it compelling.

Second order effect arguments are often weak, in this case - not using a cleverly designed system that doesn't track them because it could make some theoretical person more comfortable with the idea of tracking in general doesn't hold up to me.

The point of this is that it doesn't track them, but still achieves the goal of exposure notifications.

It's like the seat-belts are worse argument - if people wear seatbelts they'll drive more dangerously therefore seatbelts are bad. These type of second order arguments can sound contrarian or smart, but they rarely hold up to scrutiny. (Similarly masks are bad because they make people touch their face or w/e nonsense was pushed early on in the pandemic).

The average person is tracked completely by modern web companies, telcos, and random apps and they give up that willingly already - how does privacy preserving contact tracing make that worse? I don't buy it.

It's more likely using services that preserve privacy by design get people to understand why they're different than everything else, and why that's valuable. When you dismiss them along with the bad ones you make it harder for people to make that distinction.


Your point of view will drive the deployment of fully passive tracking, where you have absolutely no say in how/when/which data is collected. Things like pervasive cameras, cell tower dumps, etc., will become the norm whether you want it or not, but with the added downside that you have not say in it.


We are back to the cookies argument. Keep them because at least users are in control, lest fingerprinting becomes the norm.


> Official contact tracing in the US is a complete dud and had negligible impact on the spread.

The problem with contact tracing in the US definitely wasn't an excess of effort: https://www.nature.com/articles/d41586-020-03518-4

And more generally, I think it's great that lots of effort went into things that were then superseded by things that worked better. Sitting around waiting for perfect knowledge would have meant a much larger death toll. Indeed, the knowledge about better treatments came because people tried a great number of things and then doubled down on the ones that worked. Trying things is never wasted effort if at the time they were a good guess about what might work.


> Official contact tracing in the US is a complete dud and had negligible impact on the spread.

I am a US citizen, I simply have lost confidence in any promise made by any tech company in regards to my privacy and roll back to War Games - the only winning move is not to play. We have lost all confidence that any data shared will be kept private, there is little oversight or penalty for abuse of it.


I agree 110% -- The best solution is to stop using their products; put down the smartphones, remove FAANG & co. from your life entirely.

You end up less lonely, less depressed, less tracked, and oddly, somehow now I feel better informed.


Po-Shen Loh's NOVID app from CMU held some promise.


Indeed, Novid did have promise. Po's work should be celebrated.

The problem is that Novid depends on self-report. Self-report is not reliable, or else we'd have seen success around this kind of self-reported contact tracing, which does not model reality accurately at scale.

The problem is that a surveillance network is perfect for this kind of healthcare application, where the balance of power is toward the invisible surveiller and does not depend on the surveilled being compliant.


I think a lot of people think this way even outside of tech.


> It’s a little surprising how much effort went into things early in the pandemic that didn’t pan out.

Is it?

Thousands of people began dying from a novel mass pandemic, while years of complacency ensured governments weren't prepared for this inevitability.

Who would be surprised that they threw everything they could against the wall?

The real question is: will we learn anything from this going forward?


What is there to learn? Events like this are rare enough that it's hard to justify any overhead for dealing with them in the off-period and it inevitably gets cut. Same as with that extreme weather event taking down the Texas grid.


>What is there to learn?

Lots actually. Just like Edision found 999 ways not to make a light bulb. We also learned (re-learned) that common sense is not so common, and that people are just really not into being told what to do.

>Events like this are rare enough

Things that used to be "rare" are occurring more frequently to be considered "rare". Maybe more into the area of "uncommon". The Texas grid example is something so stupid to have allowed to happen after it just happend 10 years prior and with a simple (yet expensive-ish) solution. COVID-19 has had warnings of its level of spread for years with SARS, bird flus, etc. Those in charge of disaster prevention/recovery have failed us.


You are arguing ethics, I am arguing motivation. Disaster strikes, some mitigation is put in place, but then it's a long time till the next one. Which means plenty of time for enterprising opportunists to redirect the resources somewhere else because nobody really cares while times are good.

There won't be any lessons learned because in 20 years there will be a more pressing need for something else, and slashing funds for pandemic prevention will be a quick way to win some votes. This pattern will never stop repeating because it can't.


> COVID-19 has had warnings of its level of spread for years with SARS, bird flus, etc.

To me this was all "boy who cried wolf" stuff. I certainly remember media fear porn about SARS, about the expected severity of the next upcoming flu season, etc. It never amounted to anything significant in reality.


But here we are with COVID-19. Each of those flus were slightly worse than the previous leading up to where we are now. It's not that the scientists/doctors were wrong to make the warnings. Similar in how NWS is not wrong to issue Severe Weather warnings as frequently as they do. All it takes is the one time to have had advance warning and to not use it.


We just lived through two timelines. SARS-CoV-1 in 2003, which was successfully controlled, and SARS-CoV-2 in 2020, which wasn't.

COVID has caused three million deaths and counting, with widespread disruption to society. How could you look at that and say the reaction in 2003 was overstated?


You skipped right over the avian and swine flu pandemics, which weren't controlled and evidently barely registered.

Also, the widespread disruption to society has virtually all been from the lockdowns, not the pandemic.


Are they rare enough? SARS wasn't that many years ago and was caught before becoming a pandemic, but that certainly wasn't a guarantee. Huge disease pandemics aren't black swans. They are common events throughout pretty much all human history.


Neither extrem weather events, nor pandemics are expected to be freak events in the coming years. SARS1 was a warning shot.

I don't think pandemic monitoring and response preparation are a that expensive, even if you use them just once a decade or two.

And lots of failings highlighted by the pandemic are of a general nature concerning infrastructure debt. If health care wasn't run at max human capacity for "cost effectiveness" we may not have to talk about triage. If broadband internet access and digital literacy were a thing, WFH would run more smoothly.


Nature has its ways of managing unsustainable population growth. Basically, starvation or disease. Maybe humanity is just at that point, and there's not a lot we can do absent some really breaking changes to how we live, work, and produce what we need.


Sure there's a lot to be learned.

Even something as basic as having a national stockpile again, learning that we should have a decent manufacturing base for these kinds of critical items, and all the lessons about how to communicate with the public regarding health recommendations. There's plenty to be learned.


One thing we should learn and should have already known before the pandemic is that public health officials shouldn't be deliberately lying to the public. Unfortunately, Fauci has no remorse and hasn't apologized. He thinks he did the right thing which is a huge problem.

Another thing is that we should have more explicit goals. Fauci is still not giving an explicit answer and pretty much just says that we'll just know when to go back to normal. Then they wonder why there is vaccine hesitancy.


Feasible solutions are better than perfect solutions


The Ebola outbreak should have primed us for this.


> Ventilators were the critical thing

Ventilators are still a critical thing, but they are a last resort, not a normal treatment. The reason they were a big deal was because with a large enough spike we would run out of them (availability-wise) and I don't think people understand what that would do to the psyche of the populace.


No, in March last year doctors were prematurely jumping to ventilators because of a confusing hypoxia-like symptom: blood oxygen levels dropping into "you should already be dead" levels. Ventilator use dropped off once this stopped and they switched to other treatments for the less serious cases.


Could you elaborate or link a source. I have a hard time believing acting on lethal blood oxygen levels somehow does not apply if infected with SARS2.


Some excerpts from here: https://www.statnews.com/2020/04/08/doctors-say-ventilators-...

> What’s driving this reassessment is a baffling observation about Covid-19: Many patients have blood oxygen levels so low they should be dead. But they’re not gasping for air, their hearts aren’t racing, and their brains show no signs of blinking off from lack of oxygen.

> [..]

> An oxygen saturation rate below 93% (normal is 95% to 100%) has long been taken as a sign of potential hypoxia and impending organ damage. Before Covid-19, when the oxygen level dropped below this threshold, physicians supported their patients’ breathing with noninvasive devices such as continuous positive airway pressure (CPAP, the sleep apnea device) and bilevel positive airway pressure ventilators (BiPAP). Both work via a tube into a face mask.

> [..]

> But because in some patients with Covid-19, blood-oxygen levels fall to hardly-ever-seen levels, into the 70s and even lower, physicians are intubating them sooner. “Data from China suggested that early intubation would keep Covid-19 patients’ heart, liver, and kidneys from failing due to hypoxia,” said a veteran emergency medicine physician. “This has been the whole thing driving decisions about breathing support: Knock them out and put them on a ventilator.”

> [..]

> To be “more nuanced about who we intubate,” as she suggests, starts with questioning the significance of oxygen saturation levels. Those levels often “look beyond awful,” said Scott Weingart, a critical care physician in New York and host of the “EMCrit” podcast. But many can speak in full sentences, don’t report shortness of breath, and have no signs of the heart or other organ abnormalities that hypoxia can cause.

> [..]

> One reason Covid-19 patients can have near-hypoxic levels of blood oxygen without the usual gasping and other signs of impairment is that their blood levels of carbon dioxide, which diffuses into air in the lungs and is then exhaled, remain low. That suggests the lungs are still accomplishing the critical job of removing carbon dioxide even if they’re struggling to absorb oxygen. That, too, is reminiscent of altitude sickness more than pneumonia.


Also in the article

> None of this means that ventilators are not necessary in the Covid-19 crisis, or that hospitals are wrong to fear running out.


You should look it up for yourself, there are tons of articles saying that respirators were being used too quickly when things like putting the patients facedown were a better solution in most cases. This is before much was known about the virus and doctors were using the tools they knew about. Obviously they are still being used but much more sparingly than initially.


Sadly this is the case now in India....


In India availability of ventilators is couple of steps ahead.

We have run out of hospitals (we have too few anyway), run out of beds, ambulances, stretchers, oxygen cylinders.

Doctors and nurses too. They are falling sick and dying in large numbers.


Contact tracing is an sort of interesting solution

It works great when you have just a few cases and are highly motivated to stop them from spreading (Asia/Oceania)

and it doesn't work at all, when you have a lot of cases and have no interest in doing what's necessary to contain them (Americas/Europe)

Mass-market contact tracing, in hindsight, was completely pointless. I'm not personally aware of anyone who has been informed accurately of potential infection via a Bluetooth app.


Are you sure? My take on why mass market contact tracing didn't pan out was that it was insufficiently implemented/used. If it were on every phone and on by default, perhaps even mandated, would it still not have worked? I know that many people take significant issue with that approach, but it would have made more of a difference, right?


There are a number of prerequisites, for this to work, that were not mandated in the US and Europe.

If someone is informed of a potential or likely infection, but then typically [chooses to/is able to] go about their day the same as usual, then what's the point of tracing them?

Initial modelling that showed contact tracing to potentially work assumed: 80% uptake, over 70s to be isolated in any case, and people to strictly follow isolation rules, none of which was considered politically possible in the West: https://www.bbc.com/news/technology-52294896


Adoption was by far the biggest problem. If Apple/Google just shipped it in the OS and made it opt out, I bet it would have had a significant impact. Not like turning the US into Australia, but even a 10% reduction in covid cases worldwide could have saved 300k lives.


Yeah, a lot of it might not be politically or culturally possible. As far as I can tell, it was always technically possible to have very good automated contact tracing, though.


I think in Germany it fails, because reporting positive tests fails. Nobody doubts, if the app was promoted and reporting working flawlessly, it would hugely contribute to managing the spread.


Also remember how the CDC didn't advise wearing a mask for the first month or two of the pandemic? We came around to that, too.


.NET Rocks did a great Geek Out podcast on that which explained it in layman's terms - https://www.dotnetrocks.com/?show=1720

If I recall, the CDC was recommending treatment that worked against past similar viruses. This one turned out to be spread in a completely different way than typical.


This excuse doesn't make any sense. Their messaging at the time was "masks aren't effective, plus we need them for healthcare workers to care for pandemic patients". If they're not effective, why would healthcare workers need them? Higher viral loads put you at higher risk, but the messaging decidedly wasn't that masks are only protective at high viral loads. Let alone the incredibly basic prior on respiratory diseases' vector being limited by _covering up the sources of spread_.

The initial recommendation, the flip-flop, and attempts to explain it away have been universally incoherent, because the real reason is that the CDC and FDA combine the worst of the federal government's bureaucratic inefficiency with medical culture's innumeracy and blind status quo bias.

Leaving aside the failures of pandemic preparedness stretching back multiple administrations (the PPE stockpile had been depleted since 2013, and I don't need to describe the trump admin's failures..), it would have been trivial to do what we eventually did, and what many other countries did: recommend face coverings of any sort, and encourage people to save n95s for medical personnel. The insane route we ended up taking had people hoarding n95s anyway and deeply poisoned the well of trust in public health authorities in general and masks in particular (helped along by our president).


1. Convincing the public to wear effective masks, correctly and consistently was known to be very difficult. Still is.

2. Most epidemiologists it the US, at least, believed that corona- and similar viruses were transmitted by larger droplets generated by coughing or sneezing. These droplets would not remain airborne long, resulting in the advice for social distancing and surface cleaning. The "flip-flop" occurred very shortly after it was demonstrated that they were transmitted by aerosol particles.

3. This event primarily demonstrates the difficulty of communicating science---a "this is the best advice we can give now based on our limited understanding" is treated as permanent, universal truth by the general public; any later changes in that advice is "insane" and "deeply poisons the well" of trust.


> The "flip-flop" occurred very shortly after it was demonstrated that they were transmitted by aerosol particles.

This is both false and doesn't make any sense.

1) There was ample evidence of the distinct _possibility_ of airborne transmission, certainly by March. Medical culture has a severe problem with confusing "absence of evidence" and "evidence of absence", and the cost-benefit tradeoff of mask recommendations given what we knew back then was crystal-clear (and there were people loudly and consistently saying so throughout).

2) The CDC and Surgeon General (of "Seriously people, STOP BUYING MASKS" fame) have claimed[1] that the "flip-flop" was due to a change in concern about asymptomatic spread. It's not a coincidence that this is the _third_ distinct (and often mutually-contradictory!) excuse I've heard on this thread: because the real reason is basically down to systemic cultural rot in the field (especially at a scale that large and politically-influenced) and no one wants to admit that.

> 3. This event primarily demonstrates the difficulty of communicating science---a "this is the best advice we can give now based on our limited understanding" is treated as permanent, universal truth by the general public; any later changes in that advice is "insane" and "deeply poisons the well" of trust.

Scientific consensus changes all the time, and no stigma is (or should be) associated the work on the earlier, less accurate model. That's just what science _is_. I'm not sure if you're being intentionally obtuse or accidentally so, but my point is obviously that the initial no-masks assessment was insane, and based on a shoddy interpretation of both the science of the virus and the fundamentals of how public policy works.

[1] https://www.axios.com/surgeon-general-reversal-face-mask85e2... .


The concern for asymptomatic spread is coincident with the concern about aerosol particles. This is because coughing or sneezing are symptoms.

The medical culture also has a bit of a problem with crying wolf---the community has to take care not to do so because randomly changing things can easily cause more damage than it prevents. In particular, the community tends to want to avoid prescribing major behavioral changes without good reason.

Do you remember, say, roughly this time last year here on HN? Hydroxychloroquine was the biggest topic in any COVID discussion. And "why aren't the stupid, rotted, insane medical community providing a cheap, known-safe medication as a prophylactic to everyone?" was the question everyone here was asking. After all, there was the distinct possibility that it could help.

Turns out that the supply was constrained, that it has side-effects, and that it doesn't work. Yay for the medical community, right? Everyone celebrating the success of science? Apparently not: "Medical culture has a severe problem with confusing 'absence of evidence' and 'evidence of absence', and the cost-benefit tradeoff...." But as soon as the ongoing, large-scale trials started dropping hydroxychloroquine from their protocols, the issue disappeared, with no admission that anyone had been wrong.

You are absolutely right that "scientific consensus changes all the time, and no stigma is (or should be) associated the work on the earlier, less accurate model." And yet it does: their earlier assessment is "insane"; it represents "systemic cultural rot".

Your Axios link gives me a 404; do you mean "Surgeon general defends reversal on face mask policy (12 Jul 2020)" (https://www.axios.com/surgeon-general-reversal-face-mask-d38...) or possibly "Where the science stands on using face masks against coronavirus (25 Jun 2020)" (https://www.axios.com/coronavirus-face-mask-science-e9df446b...). The latter article points to:

"Assessment of Fabric Masks as Alternatives to Standard Surgical Masks in Terms of Particle Filtration Efficiency (17 April 2020)" (https://www.medrxiv.org/content/10.1101/2020.04.17.20069567v...)

"Association of country-wide coronavirus mortality with demographics, testing, lockdowns, and public wearing of masks (Update June 15, 2020)" (https://www.researchgate.net/publication/342198360_Associati...)

"CDC to make updated recommendation on masks (22 Jun 2020)" (https://www.wwlp.com/news/health/coronavirus/cdc-to-make-upd...)

"Physical distancing, face masks, and eye protection to prevent person-to-person transmission of SARS-CoV-2 and COVID-19: a systematic review and meta-analysis (27 Jun 2020)" (https://www.thelancet.com/journals/lancet/article/PIIS0140-6...)

"Community Use Of Face Masks And COVID-19: Evidence From A Natural Experiment Of State Mandates In The US (August 2020)" (https://www.healthaffairs.org/doi/pdf/10.1377/hlthaff.2020.0...)

That is (a) exactly what I am saying, and (b) actually a little later than I can date the change---I've previously seen (and posted, IIRC) scientific discussion in mid-April to May about the changing consensus on transmission and mask effectiveness.

When you write "it's not a coincidence that this is the _third_ distinct (and often mutually-contradictory!) excuse I've heard on this thread", you do realize that there are multiple people involved in this thread and that some of them are simply wrong. But of course I would be saying that because I'm just making excuses and covering up rot, trying to cover up that everyone except the genii software engineers here on YN are complete idiots.


> 2. Most epidemiologists it the US, at least, believed that corona- and similar viruses were transmitted by larger droplets generated by coughing or sneezing. These droplets would not remain airborne long, resulting in the advice for social distancing and surface cleaning. The "flip-flop" occurred very shortly after it was demonstrated that they were transmitted by aerosol particles.

That makes even less sense, masks only stop the heavier droplets. The virus is small enough to go right through cloth masks when aerosols, or get carried out the sides of surgical marks by your breath.

But I remember the aerosol realization happening around summer/fall last year, way after the mask flip-flop anyway.


Masks are the only thing that might stop aerosols, which remain airborne for a long period of time.


How?

As aerosols you need an N95 mask to actually filter them out:

* The virus is small enough that they go right through regular cloth masks; the theory on these was that the cloth masks would catch the too-large-to-pass-through droplets and the virus would get stuck inside the droplet.

* Aerosols are as light as and easily carried by the air, which is why they hang in the air for a long period. Because they're so easily carried by the air, any mask that your breath can escape the sides of, such as a surgical mask, will carry the aerosolized virus out the sides without catching it. It's the same phenomena that stops butterflies from hitting car windows [0]. The larger droplets are like the denser bugs that aren't carried safely away by the air, those will get caught by these masks.

Really, ventilation is the best way to deal with aerosols. Open a window and get them out of the room entirely.

[0] https://physics.stackexchange.com/questions/631854/how-can-a...


#3 especially, most people don't really understand science and think statements are absolute so the first time they heard "no masks necessary with what we know currently" became "no masks" and "well we've discovered that masks will help" and people heard "we lied to you before, now you need masks because we're trying to control you and take away all your freedoms" at least that's what happened with the Trump crowd.


> masks aren't effective, plus we need them for healthcare workers to care for pandemic patients

I noted this at the time as well, but I read it (perhaps between the lines a bit) as more like: masks probably help, but if you all go panic-buy masks like you do TP, there will be none left for healthcare workers, who need them more than you do.


That's possible, but the route we went with got us the worst of both worlds. There were gov'ts that simply told the entire country to use scarves or sew string to cloth and put it over their mouth. Lying about the efficacy of all masks to preserve a specific kind is just about the stupidest approach to the problem I can imagine.

Note that even if your theory is correct, it also means that public health authorities have been continually lying to us after their mask flip-flop, with the Surgeon General claiming in April that it's because they didn't know asymptomatic transmission was possible. This is, of course, horseshit, as there were Chinese reports of asymptomatic transmission as early as January.

The only theory which fits all the evidence is the one I laid out: asymptomatic transmission did not have a solid, high-quality study behind it yet, and medical culture has serious problems doing anything but rounding priors and weak evidence down to "zero evidence" instead of doing the difficult work of choosing the best option under uncertainty. It's ludicrous to claim that telling people to put scarves over their face would deplete , and that this cost-benefit suddenly flipped the moment the level of evidence for mask efficacy rose from "no-brainer if you're capable of modeling uncertainty" to "has a specific high-quality study supporting it in narrow conditions".


"The only theory which fits all the evidence is the one I laid out: asymptomatic transmission did not have a solid, high-quality study behind it yet, and medical culture has serious problems doing anything but rounding priors and weak evidence down to "zero evidence" instead of doing the difficult work of choosing the best option under uncertainty."

Yup. See also how long it took before the medical community came around to accepting that it's an airborne virus, despite very early evidence from China and South Korea to that effect.


They also at one point early on said that wearing a mask if you have COVID can prevent you from spreading it, it just won't protect you from getting it at all. This was simultaneous with the recommendation that laymen not wear masks, but also with the recommendation that everyone should behave as if they have COVID because of asymptomatic spread. The messaging not only raised red flags based on both Asian SARS experience and just using common sense, it was also internally contradictory.


> Their messaging at the time was "masks aren't effective, plus we need them for healthcare workers to care for pandemic patients". If they're not effective, why would healthcare workers need them?

Isn't it simple statistics? If you're on a ward with 10 people who are ill and coughing at you you'll need a mask. If you're walking about in the street, not getting closer than 2m to anyone, and not spending much time in close proximity to anyone, the mask isn't doing much.


> Isn't it simple statistics? If you're on a ward with 10 people who are ill and coughing at you you'll need a mask.

I addressed this in my comment:

> Higher viral loads [and longer exposure] put you at higher risk, but the messaging decidedly wasn't that masks are only protective at high viral loads. Let alone the incredibly basic prior on respiratory diseases' vector being limited by _covering up the sources of spread_.

"Medical workers need masks more because they have more exposure" is not the same thing as "masks don't work for the general public", and brazenly and badly lying to the public has costs that have been demonstrable throughout the pandemic (helped along by our dear insane President over the course of the pandemic).

> If you're walking about in the street, not getting closer than 2m to anyone, and not spending much time in close proximity to anyone, the mask isn't doing much.

This is a general-purpose argument which explains away the existence of community spread, which we know was happening (33m US cases later...). Especially given what we now know about air vs surface transmission, people were clearly spreading it to each other last spring in ways that masks would have mitigated. Knowing what we now know about the difficulty of outdoor spread, people by definition were not universally adhering to what you're describing. Leaving aside the non-compliant (some portion of whom would have worn masks despite violating indoor gathering guidelines), many people were unable to avoid this: nursing homes, grocery stores, meatpacking plants, and all manner of essential workers[1] were clearly enough to drive robust spread.

[1] Here's a list of just how expansive the "essential worker" category was in NYS: https://www.lawandtheworkplace.com/2020/03/new-york-state-ma....

(Note that I don't mean that as a criticism, just a note that your postulated world of 100% of people never coming within 2m of anyone, including outside, is not reflective of reality)


> This is a general-purpose argument which explains away the existence of community spread,

But that wasn't people waking past each other in the street, that was people working with each other in poorly ventilated spaces.

Public health officials during the early stages fully expected all the other recommendations they were making to be taken up: proper lockdowns, vigorous test and trace with good quality supported isolation.

If you're looking at "late lockdown with poor test and trace" then yes, you're right, not pushing masks doesn't make much sense. But it's odd to focus on the mask advice and not the late lockdowns.


> But that wasn't people waking past each other in the street, that was people working with each other in poorly ventilated spaces.

Yes, this is my point. There were tons of people (most people?) who didn't/couldn't live their lives without coming into contact with other people's spread, and these people were not recommended to wear masks either.

This was particularly true in the beginning of the pandemic, when the non-scientifically-literate and non-digital-natives had yet to adapt to which behaviors were safe[1]. Masks were a simple, common-sense, zero-cost recommendation which predictably ended up being sound.

> Public health officials during the early stages fully expected all the other recommendations they were making to be taken up: proper lockdowns, vigorous test and trace with good quality supported isolation.

If you don't see this as gross incompetence, I don't know what to tell you. Assuming perfect compliance with specific measures and throwing defense in depth out of the window is shockingly stupid from multiple perspectives: scientifically, epistemically,

> it's odd to focus on the mask advice and not the late lockdowns.

I don't know anyone who defends locking down late. I know plenty of people who defend the severe and constant failures of our public health authorities. It's a much more interesting topic with much more profound implications. What's particularly fascinating about it is the _manner_ in which people defend these failures: Talk to a dozen people, and you'll get 13 highly-confident, mutually-contradictory and individually weak excuses. It strongly suggests to me that there's some weird psychological underpinning to this behavior, and that the expressed excuses are just window dressing.

(To be clear, I don't intend this as a jab against you, but as a phenomenon that's interesting in the aggregate. Your comments in particular are more thoughtful than most I come across on this topic)

[1] In the very early, high-uncertainty days of the pandemic, I had a (highly-educated and successful) uncle in his late 70s tell me not to get takeout and to wipe it down thoroughly if I did, right before saying that he only ever left the house to go to the _grocery store_. I tried telling him he had it precisely backwards (yes, this was clear from the evidence even that early), but his model stuck in his mind like a superstition and fear is a strong deterrent to changing one's mind.


My understanding is that it is not atypical for SARS though? I thought that was the main reason Asia was big on masks, which should have suggested that we ought to at least consider masks.

My guess is it was some combination of uncertainty about effectiveness in the general public and wanting masks to be available for healthcare workers, so they ran with the messaging they did. IMO if they didn't want to make a statement that could lead to hoarding in the early days they should have just said nothing about masks until production was ramped up. Masks are such a minimally invasive preventative measure that given uncertainty about their effectiveness you would normally err on the side of encouraging.


The other downside of such statements is excessive belief: "wearing medical-grade masks correctly might help" is understood as "wearing anything over your face will provide perfect protection".


Can you point to any countries that encouraged mask use where that ended up being the general sentiment? It's not like encouraging mask use means restrictions on shopping, dining, etc. wouldn't also exist.

Besides, you could make the same argument for something like wearing a helmet while bike riding. I'm sure there are situations where false peace of mind is a problem, but I don't see why we should assume mask wearing would be one of them.

At the time they were obviously operating with limited information, but it's crazy to me that people continue to defend the early pandemic mask messaging. They screwed up, it happens, but it should be acknowledged and there should be a post mortem.


Most "N95" masks that are generally available (i.e. those from Home Depot) have the rubber flapper valves for exhalation. Think they do anything much useful medically?

How many people have you seen wearing clear plastic face shields or bandannas tied around their face like Ol' West banditos, with the bottom open? How about with the mask pulled down below their nose? (Disclaimer: I did that the other day; I was at the optometrist and my breath was fogging up the lens thingy.)

The early pandemic mask messaging was wrong. A postmortem might very well find that they made the best recommendations they could based on what they knew.[1] Unless you've already decided that they screwed up because they're lying idiots.

[1] See https://news.ycombinator.com/item?id=26138301: "(I note that there was a meeting of epidemiologists in March, 2020, where famously, no one wore masks. How far are you willing to to go to lie?)"


Based on what they knew, or what they should have known? I never said they were idiots, but Asian countries already had data on mask use during SARS. I also don't think they were lying about what they thought at the time, moreso they were misleading about their level of uncertainty on the topic. If they really did think masks were useless with high probability then I think they missed some preexisting literature.


That's not true. Masks have worked against other viruses too - it's just something the western epidemiological community has always been slow to adopt, despite empirical evidence.


Yeah, because there were problems making sure there was sufficient supply for medical staff.


- Medics exist to protect patients, not the other way around.

- They didn't say: "we need to prioritize medics", they said "masks have no effect" and sometimes "masks are BAD for you".

- They have doctors in Japan/Taiwan/China too, but they said from the beginning there to wear masks.


> Medics exist to protect patients, not the other way around.

Tough to do that if they're dead.


That doesn't mean that misleading the public about the effectiveness of masks in the early pandemic was the right way to go about it. The CDC came out and said that masks wouldn't protect the wearer.

I also saw blog posts from people in public health departments at respectable universities about how masks on laymen have no effect because we can't wear them right/will touch our face too much to adjust them. Whether they believed that at the time is unclear to me, but that was the theory being pushed by a bunch of experts to explain the CDC guidance.

I think we were overestimating the transmission risk from surfaces/face touching at that time. I also think we underestimated the effectiveness of basic cloth masks thinking that only filters would be useful. COVID is more likely to spread via larger droplets than some other viruses. However a closer look at literature from Asia on the previous SARS pandemic should have suggested that masks are more likely than not worth promoting.

So I have to wonder if they considered what would happen if/when they had to flip the story once masks became more available. I doubt they expected it to become such a critical part of the pandemic response, otherwise they probably would have been more careful with messaging. Of course these decisions were made under a lot of pressure with not much time to strategize - I just hope they learn from this and reconsider a bit how they communicate. Because I do think this exacerbated the anti-mask issue. IMO they could have even avoided Trump making it political if one of the day 0 rallying cries was to ramp up mask production.


> about how masks on laymen have no effect because we can't wear them right/will touch our face too much to adjust them. Whether they believed that at the time is unclear to me, but that was the theory being pushed by a bunch of experts to explain the CDC guidance.

This is even more hilariously stupid than it sounds, as the same studies showed that only 10% higher a proportion of medical personnel than the general public can properly fit their masks. And yet it would be insane to claim that it's useless for medical personnel to wear PPE.


It's a pity they didn't ask our advice; we could have told them exactly what to do to minimize damage.


Given the impression I've gotten from your habit of replying with midwit snark to my comments, I don't suggest that you try doing so.

But yes, there are plenty of fields full of intelligent, quantitative people that are better at basic scientific literacy and modeling uncertainty than our public health infrastructure has shown themselves to be. This isn't just theoretical; every single "heterodox" conclusion I was exposed to that was based on the science instead of whatever the fuck goes on at the CDC/FDA ended up becoming CDC/FDA policy, several months later.

Medical culture's innumeracy[1], religious adherence to omission bias, and refusal to model reality outside of the exact parameters of an RCT is potentially adaptive for the normal clinical context. But it's an extremely poor fit for a pandemic, and has cost thousand and thousands of lives over the course of this one.

It's a travesty that the CDC, FDA and WHO couldn't collectively manage to provide information a fraction as useful as accurate as (eg) Alex Tabarrok's freaking Twitter account.

For someone of your, uh, limitations, it's probably better to slavishly follow public health advice, in the absence of the ability to do any critical thinking. For anyone with a median IQ, understanding when political/bureaucratic/cultural failures are cause for skepticism of public health conclusions is a must.

[1] Famously, studies show 80% of doctors unable to do the most basic of statistics relevant to their job, like being able to interpret the chances of breast cancer given a positive mammogram. Over half of the doctors surveyed were off by a factor of NINE in their estimate (90% vs 10%). This isn't a random medical-themed math game with no clinical relevance; one's risk of breast cancer is influenced by multiple factors and false positives mean invasive procedures like biopsies that themselves are not riskless.


That's literally exactly the problem when experts mislead the public. Particularly if it was intentional to save mask supplies or prevent other stupid behavior, that completely erodes trust and it becomes a game of "what is the expert actually trying to say" when future statements are made.

If it was a mistake due to incomplete information, then it happens, but discussion about what went wrong should be encouraged and there should be transparency (perhaps at a later date) about what could be done differently in the future. Experts are going to be right more often than laypeople, but they are still sometimes wrong, and if that can't be acknowledged it's a systemic problem.

Ironically, blasting the US for pausing the J&J vaccine was highly upvoted on HN, even though that was also expert decision making, and it was actually in the midst of the issue without the benefit of hindsight. I wonder why the topic of early pandemic mask messaging seems to attract downvotes on HN.


> Ironically, blasting the US for pausing the J&J vaccine was highly upvoted on HN, even though that was also expert decision making, and it was actually in the midst of the issue without the benefit of hindsight. I wonder why the topic of early pandemic mask messaging seems to attract downvotes on HN.

I suppose for the same reason that so many consider mask requirements an unacceptable intrusion on their most sacred freedoms: it's become heavily politicized, most people only "care" about issues to the extent that they're able to signal tribal membership, and moral indignation isnt any less addictive when it's detached from reality.


I mean that's definitely true, but I'm not even sure what political camp should be angered by this particular discussion. It's decidedly pro-mask, although I guess if warped it could be read as excusing anti-masker behavior. The only other thing I can think of is people that were toeing the party line back then getting upset by being (sort of) called out.

I don't think anti-mask is a popular sentiment on HN, so I doubt that is driving the vote. But this isn't the first time I've seen downvotes on this topic. And it's not like HN loves authority or the biomedical research establishment in general.


> It's decidedly pro-mask, although I guess if warped it could be read as excusing anti-masker behavior

This is exactly it. Anti-maskers/anti-restrictionists seized on the stupidity of our early mask policy (and subsequent flip-flop to sanity) as evidence that restriction policy isn't in the interests of public health, but just a power grab by elites. Denying that this ever happened lets their simpleton counterparts stick to a simple narrative, where masks have always and obviously been a good idea and any deviation from the maximalist consensus needs to be crushed without any equivocation or weakness.[1]

By contrast, the "war" right now is against vaccine hesitancy[2]. There are no Trumpists or other hated subcultures that are gung-ho on vaccines, so the J&J pause is interpreted simply as "scaring people away from vaccines" during a time when we need vaccines (this is unfortunately correct[3])

For a person infected with tribal-brain, consistency with reality is more or less irrelevant. HN is heavily-populated or at least influenced by subcultures (Bay Area, tech) that have been religiously adherent to the appearance of compliance and performative self-abnegation as a response to the pandemic (like a milder version of the Flagellants during the Black Death).

[1] Hence also the ritualistic obsession with masking in places where it isn't necessary. My girlfriend gets uncomfortable that I often take my mask off outdoors when we're walking around, despite it being clear for almost a year that there's minimal risk from doing so, especially when walking swiftly (on top of that, we're both fully-vaccinated). She acknowledges this is irrational, but it's not too difficult to try to meet her in the middle and so I keep it on more often than I'd like.

[2] Fascinatingly, US vaccine willingness now polls at ~61% while % vaccinated is 55%. We're effectively in the phase where demand is the challenge.

[3] https://mobile.twitter.com/FT__Dan/status/138753181546475110...


> HN is heavily-populated or at least influenced by subcultures (Bay Area, tech) that have been religiously adherent to the appearance of compliance and performative self-abnegation as a response to the pandemic (like a milder version of the Flagellants during the Black Death).

Spot on. Some people like following rules, and lording their compliance over others. None of this precludes the goodness of following pandemic rules, however.


That Twitter thread was interesting, thanks! Looks like later in the thread they seem to suggest mRNA vaccine hesitancy hasn't necessarily increased, so I don't think it's as concerning as the first graph makes it seem. But we are lucky in the US to have pretty good supply of the mRNA versions.

Regarding 2, hopefully restrictions introduced by airlines, clubs, sporting events, theme parks, etc. will push anybody on the fence to get a vaccine over the coming months. Once things really start to open up I imagine FOMO can be a real driver.


Medical staff don't use cloth masks, there would be no issue to recommend those.


That was more a political and logistics issue than well reasoned health position. Any reasonable person knows that wearing a mask will help stop the spread of an airborne disease. It's why doctors, nurses, and surgeons wear them. Basic knowledge of either physics or biology will inform a person of this.


When the CDC says "Don't wear a mask, it won't help you", that has the effect of degrading trust in the CDC. People who know that's BS won't trust the CDC in the future, and people who don't know that's BS will lose trust when the CDC flip-flops and says that maybe masks actually are helpful. I think that contributed to the politicization of mask wearing in the US.


The noble lie. Never works. Contributes to populism.


The upside is that it tells us who the morons and bad actors are. If a person repeats this "guidance", you immediately know they either have chosen not to think the situation through at all, or they are trying to push some agenda because their stated position makes no sense. Noise in a signal is a signal.


I still can't believe the amount of people that make the "like using a chain-link fence to stop mosquitos" analogy...


I think this is a consequence of “make your product for the customer”. I think it should’ve been obvious that Americans weren’t Koreans or Kiwis in attitude, numbers, or behavior, and so the solutions requiring that level of cooperation and attention should’ve never left the drawing board. As we’ve seen and as should’ve been obvious: Americans are resistant to authority for one. Solution that get too overbearing too quickly can work, but they have to keep that in mind when considered. At the public health level I hope the architects of these policies at least recognized that fact, even if the whirlwind of spins and politicization in the public made it seem like everything was failing spectacularly.


I am personally convinced that US contract tracing results were suppressed. Massive amounts of data was collected and I believe it was possible to compile data from it about the situations and activates where transmission was known to occur.

My guess is that the data could be used to argue against the public health policies of the same organizations that were collecting it. I looks forward to some of the data analysis released in the coming years.


In my kid's high school (in Virginia, US), we have detailed contact tracing for all positive COVID tests.

Contact tracing is done, and it seems to be done fairly thoroughly here.


Another example: instead of contact tracing with PCR tests, skip the tracing part and have everyone regularly take much cheaper antigen tests a couple times a week.

As a result of the lack of vision, there was no urgency in the US to approve over-the-counter antigen tests and they only became available in pharmacies last week.


We are doing that in the UK and it's pretty controversial, with many credible medical/epidemiology experts saying it's a bad idea.

One risk is people assuming a negative test means they don't have covid.

Personally I think they're a good idea, but it really depends on people understanding and following the guidance. The tests are not overly simple to administer.


> Ventilators were the critical thing until we realized they were a very sub optimal treatment.

Ventilators and ICU beds are the shortages people are/were talking about, but the real issue is staff to operate the ventilators and care for the people in the ICU beds.

You can work to quickly manufacture more equipment and it was done, but training people to do ICU nursing isn't fast; especially when in-person learning is inadvisable. Even if you train up non-ICU nurses to do ICU nursing, you need to train replacements for what they were doing (or go without). We don't have a lot of spare nursing capacity, especially when there is near-worldwide excess demand.


> Official contact tracing in the US is a complete dud and had negligible impact on the spread. People informing their fiends/family “hey I just got Covid you should probably test/isolate” was what practically can make a difference.

Contact tracing has worked superbly in Australia and New Zealand.

The fact that the US fucked things up completely doesn't mean that they were worthless techniques; rather than the US didn't want to stop people dying badly enough to make proper use of them.


> It’s a little surprising how much effort went into things early in the pandemic that didn’t pan out.

It's not surprising at all!

We had a choice between taking actions some of which might be wasted (like manufacturing large quantities of vaccines that hadn't yet completed the approval process, or creating a contact tracing app that might or might not prove useful), or not taking any actions until we were done investigating.

No vaccines have yet been approved for Covid-19. There are, however, several which have received temporary authorizations for emergency use.

I think we made the right choice. Waste a few resources, if need be, because we don't know for sure which approaches will pan out. But the ones that DO pan out will (HAVE) save hundreds of thousands of lives, perhaps millions.


Funny. I doubt the horsehoe crab population being decimated at an industrial scale when a synthetic alternative was available, but langishing unapproved would agree.

https://www.nationalgeographic.com/animals/article/covid-vac...

3+ different vaccine production lines. 1 species as a supply bottleneck, and no one giving a damn that there needs be affordances made to not potentially drive a species to extinction.

I'm normally not big on environmentalist concerns as a first order thing because it tends to get you tuned out in some circles but the scale becomes absolutely impossible to ignore in this case.

Then you had other potential routes for treatment completely ignored due to the fact they're biologics and cannot be patented. Echinaecia purpurea among them. (Came in handy for me early on), and vitamin C to keep immune cell exhaustion at bay.

No one ever heard about or researched any of it, nor was anyone comfortable bringing it up lest one get dog-piled as a "disinfo-spreading quack". Gotta wait for Big Pharma to bail you out doncha'know?

The entire thing has just been one massive shitshow. It's a Catch-22. There's no way to define anything as medically sound except to have a company go balls-to-the-wall double-blind cert study, but no one will do that for something that can't be patented or have an industrial business model built around it.

The externalities are a bit on the extreme side in my view.


Americans really do get the short end of the stick. Having to pay full whack to fund healthcare development while single payer systems just take the result at bargain basement prices.

The only solution is to fund basic science research directly and remove the perverse incentives, but (as an outsider) it seems America does not have the political will to do anything so bold right now.


There is some slow movement in that direction, but there is a lot of opaqueness that has to be worked through and have public scrutiny turned it's way.

At the end of the day though, no matter how you slice the pie of dollars, the motivation of a majority of the market is to make more money. Not to solve problems one and done. Always remember, healthcare is an industry first and foremost; cures aren't good business. Just look at what Wall Street has to say on the matter.

https://science.slashdot.org/story/18/04/14/0059236/is-curin...

So Market mechanisms don't really work unless you structure things correctly; which includes building a prize pool to pull from for each actor to further the state of the art. Try doing that in the U.S. and people will get all bent though because all that capital ends up locked away instead of lining everyone's pockets..


"The only solution is to fund basic science research directly"

Which country would do the funding?


Preferably, all of them. More selfishly, funding basic science has economic advantages (plus you get to keep the smart people).


> It’s a little surprising how much effort went into things early in the pandemic that didn’t pan out.

It is? We were dealing with an unknown disease.

> Official contact tracing in the US is a complete dud and had negligible impact on the spread. People informing their fiends/family “hey I just got Covid you should probably test/isolate” was what practically can make a difference.

What is this based on? Contact tracing in the US wasn't executed much, but that doesn't mean it wouldn't have had a large impact. I don't regularly exercise, therefore exercise wouldn't have a large impact?


> [...] and the chemicals used in some places destroyed a bunch of furniture.

and several throats due to the excellent advice of a smart person.


Re ventilators specifically, remember that we had basically no treatment for severe Covid last March. The best we could do was sedate you, force air into your lungs, and hope for the best. Now we know that dexamethasone helps in severe cases, we have monoclonal antibody treatments, and generally we are better able to treat someone who would have needed a ventilator if we'd treated them last March.

In general, I'm with the Tyler Cowen thought bubble: whatever we spent on actual treatments which didn't work out, it wasn't enough.

Some of your criticisms are pretty incontrovertible. The Less Wrong zeitgeist in April 2020 (perhaps even earlier) was that surface cleaning was dubious - https://www.lesswrong.com/posts/riB8m9PBvXJziFYMv/on-covid-1... - much like they were extremely early on the "loss of taste and smell" train (https://www.lesswrong.com/posts/ACyGvQchWzGjGkKgS/march-coro...).


The latest research indicates that Methylprednisolone is more effective than Dexamethasone.

https://doi.org/10.1177%2F0885066621994057

https://covid19criticalcare.com/covid-19-protocols/math-plus...


Even better! (I merely stated two treatments I knew of which were found to be effective well after the point when we were making ventilator-related decisions. I am doubtless unaware of many more.)


> Ventilators were the critical thing until we realized they were a very sub optimal treatment.

The ventilators kept people alive long enough to allow their immune system to take over and fight the virus. When you have a severe respiratory illness you will likely need a ventilator.


Just because something didn't work in USA doesn't mean it "didn't pan out". Contact tracing has been used to track down contacts very rapidly in my country and presumably several others.


People wouldn't even wear masks, even more wouldn't have had a "government tracker" willingly in their pocket whether it not it was innocuous and anonymous or not.


Contact tracing would have worked if there wasn't an exponential amount of community spread in the US compared to other countries.


It would be interesting to see a metric for which countries did well with contact tracing and which didn't. Many countries tried it, and gave up. Some countries tried it and succeeded. A few countries didn't try at all.


Do we know what kind of users info are contained in these logs? It seems a bit misleading.


Headline seems to be conflating two different kinds of promises. My recollection is that the promise was that Google and the government wouldn't (couldn't) track you with the data. That appears to be generally true. Finding a bug that exposes some data is unfortunate, but it seems the be an unintentional mistake.

tl;dr, they didn't try to do anything evil, they just failed to be 100% perfect.

Also as /u/arsome points out elsewhere, the other apps that can read this data could get better data more easily through another method anyway.


just seems like google witch hunt from some random app security firm.

Would rather hear from some of the notable developers of say the Canada Covid Alert App about what they think about this


My region never got access to this app, so I’m curious

For those who have it, did it change your behavior? Did you have contact and it made you avoid crowded spaces? Did you get tested because of contact logs?


I don't know of anyone in the USA who has used these apps. They never really took off. Since they rely on a "network effect" to be useful... even if you installed one, few people you came in range of would have it installed.

https://apnews.com/article/us-news-smartphones-coronavirus-p...


I tried it, it was state specific and required self reporting positive cases to alert others. I suspect the heavy opt in nature made it much less useful. I'm curious if it was useful in some areas


I have had it installed since it became available in California. I received one exposure notification on April 11th from an exposure on April 1, which seems too late to be useful. I immediately tested and it was negative.


And here is what the exposure notification looks like: https://imgur.com/a/qyLHxUQ


Why do you think this was too late?

14 days is the the CDC's window for contact tracing and self-isolation, based on how long it takes symptoms to show up after exposure. This seems in line with that.


11 days after the exposure, if contracted I'd have a ~95% chance of already showing symptoms and exposing others. There is a higher chance I'd have realized I have COVID before the exposure notification system told me I was exposed. So not too helpful.

But if my thinking is wrong, please correct me.

[1] - As per the CDF on pg. 5 of https://bmjopen.bmj.com/content/bmjopen/10/8/e039652.full.pd...


Brit here. I refused to install the NHS Covid app until they revamped it to improve privacy. I once received a notice that my device recorded a beacon which was later submitted as from a infected person, but it didn't require me to take action as it was otherwise outside of criteria (either distance or duration). They eventually removed these warnings as they are not helpful.

If it informed me that I had to quarantine and/or get tested I would definitely do so.


I installed the contact tracing app as soon as it was available, and still have it running. I've never gotten a contact from it. Some of that is probably me being careful and not being around others much, and some of it is probably that almost nobody else is running it.


people often forget the other half: the confirmed cases need to be uploaded. in Italy, that was the biggest weak point, even places with a fairly wide install base didn't get much benefit since the ausl didn't had the processes in place to share the test results, as the ingress effort was fragmented and left to be implemented with local resources, a mess of regional responsibilities and uncertain protocols, i.e. https://corrieredelveneto.corriere.it/veneto/politica/20_ott... (source in italian)


+1 to this in NY


I've been using the German version since it came out in July, I think. It's working great in that I've never been warned even once, but my social interactions also have been limited to going to the supermarket on Saturdays for a bit more than one year now. So probably it was correct to never warn me. Adoption is also low, so you really can't tell.


I installed it immediately. However I've never got a notice, but I've also never tested positive so it's hard to say how well it worked, or know how many around me had it too.

It did give me a little peace of mind when I went grocery shopping however.


I had it installed up until this week (just got vaxed, frequently turn off bluetooth and rarely leave the house). Never got a notification, just a lot of warnings to leave my bluetooth on while sitting in my living room...


I’ve been using it here in Hong Kong ever since the government made it mandatory. I did have to get tested after someone in my gym tested positive.


Side topic , how does Google get so highly detailed traffic congestion patterns without transferring gps coordinates from the phones ? Or if they do, where do they tell the users of phones that they do that (I had several pixel phones and never saw that) ? Is it buried in some fine print ?


shock and awe


I'm shocked!

Shocked I say!


Surprising absolutely nobody that had a modicum of intelligence.


The last entity in the world I would want to trust with all of my location data is google.


Which is why Apple/Google engineered this to not use GPS location data, instead each phone locally kept track of nearby bluetooth IDs. Which made the app scale quadratically rather than linearly with usage (10% adoption means 1% of possible transmissions caught), which made it basically useless without large scale adoption that it never got.

Google/Apple timidly did some basically useless engineering, when they could have instead made a significant dent in limiting the spread of covid.

If they were going to make the timid, quadratically scaling decision, they should have boldly made it opt out. A quadratic scaling, privacy preserving protocol plus a timid opt in strategy might have cost 30k lives if it ubiquitous/automatic contact tracing would have stopped 10% of the spread.


> Google/Apple timidly did some basically useless engineering, when they could have instead made a significant dent in limiting the spread of covid.

Are out suggesting they actually should have used GPS data instead? Can you imagine the kind of holy hell that would have brought on them?

> If they were going to make the timid, quadratically scaling decision, they should have boldly made it opt out

I think the biggest problem is that hospitals and regions had to have their own databases for the ids


...to which the scorpion replies: "I couldn't help it. It's in my nature."


This is trite, inaccurate, and proves you didn't read the article whatsoever.


This article is full of such FUD. Everyday HN feels less and less Hacker Newsy.

Disc: Googler.


Maybe I'm stupid but I thought the whole point of a Traffic Analysis app would have been to violate privacy.


The protocol was designed for privacy. In that it seems to have done okay if the worst thing we can complain about is that manufacturer apps that can already see your location, your email, your search history, and your pictures, could also read your generated codes.


Yeah, I wasn't going to touch this shit. Especially when all these people who were going on and on about privacy suddenly decided to about face, it made me very suspicious. No way.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: