4 ms·

It isn't that software engineers are bad at their jobs. Information and matter happen to have very different properties when it comes to resisting modification

by shirro 8y ago

It isn't that software engineers are bad at their jobs. Information and matter happen to have very different properties when it comes to resisting modification and showing evidence of tampering at our current level of technology. It isn't that electronic voting systems can't be made more resistant to tampering. The problem is that if tampering is possible it seems more likely to succeed with an electronic system than it would exposing a large number of human agents modifying paper ballots. I live in a country with compulsory voting and paper ballots and we have proportional voting in one house and we still manage to get a concession speech within a few hours typically. If it ain't broken... I don't see what is gained from taking human observers out of the loop and hiding everything under the skirts of a computer system with a sign saying "trust us".

a-priori 8y ago
There's also trade off where the more tamper resistant/evident the system is, the more sophisticated it must be and the harder it is to understand the system. Trust isn't just about engineering like it is for avionics or other high-reliability systems. It's also about independent verification, including by lay people. If it requires advanced cryptography or computer science knowledge to trust the election results. I live in Canada where we do paper ballots everywhere. We also get same-night results on election day. They're just starting to experiment with vote tabulators, and this means that results come in faster now. In fact, in the latest Ontario provincial elections they had a declared winner 20 minutes after polls closed. Especially with tabulator machines I just don't get the point of electronic voting.
bcaa7f3a8bbc 8y ago
Another important difference is computer systems themselves are inherently general purpose [0], unlike a physical machine - An airplane cannot be subverted to calculate the GDP of the United States, but all Turing machines are created equal. Another difference is computer systems are generally open to unpredictable external inputs [0], unlike a physical machine - An airplane is not needed to be designed under the assumption that an adversary would use weather modification to destroy it. [0] Unless specialized designs are used explicitly in hardware and software, similar to those which are found in embedded industrial control systems, which removes these uncertainties to a large extent. But they are rarely used in practice because of its difficulties and cost. As Bruce Schneier written in Cryptography Engineering, One of the biggest differences between security systems and almost any other type of engineering is the adversarial setting. Most engineers have to contend with problems like storms, heat, and wear and tear. All of these factors affect designs, but their effect is fairly predictable to an experienced engineer. Not so in security systems. Our opponents are intelligent, clever, malicious, and devious; they’ll do things nobody had ever thought of before. They don’t play by the rules, and they are completely unpredictable. That is a much harder environment to work in. Many of us remember the film in which the Tacoma Narrows suspension bridge wobbles and twists in a steady wind until it breaks and falls into the water [1]. It is a famous piece of film, and the collapse taught bridge engineers a valuable lesson. Slender suspension bridges can have a resonance mode in which a steady wind can cause the whole structure to oscillate, and finally break. How do they prevent the same thing from happening with newer bridges? Making the bridge significantly stronger to resist the oscillations would be too expensive. The most common technique used is to change the aerodynamics of the bridge. The deck is made thicker, which makes it much harder for the wind to push up and down on the deck. Sometimes railings are used as spoilers to make the bridge deck behave less like a wing that lifts up in the wind. This works because wind is fairly predictable, and does not change its behavior in an active attempt to destroy the bridge. A security engineer has to take a malicious wind into account. What if the wind blows up and down instead of just from the side, and what if it changes directions at the right frequency for the bridge to resonate? Bridge engineers will dismiss this kind of talk out of hand: ‘‘Don’t be silly, the wind doesn’t blow that way.’’ That certainly makes the bridge engineers’ jobs much easier. Cryptographers don’t have that luxury. Security systems are attacked by clever and malicious attackers. We have to consider all types of attack. [1] https://upload.wikimedia.org/wikipedia/commons/transcoded/f/f2/Tacoma_Narrows_Bridge_destruction.ogv/Tacoma_Narrows_Bridge_destruction.ogv.480p.webm https://upload.wikimedia.org/wikipedia/commons/transcoded/f/...
- ryandrake 8y ago
  I don’t know if I agree with this reasoning. Bridges are at risk of being destroyed by any attacker with a truck full of dynamite. Do they defend against this in their designs? Do we blame the bridge engineer if someone destroys it? Do we blame the airplane builder when someone shoots a missile at it and it blows up? Software is one of those few practices where we blame the builder for being careless when the product is deliberately and maliciously attacked.

by shirro 8y ago

a-priori 8y ago

There's also trade off where the more tamper resistant/evident the system is, the more sophisticated it must be and the harder it is to understand the system. Trust isn't just about engineering like it is for avionics or other high-reliability systems. It's also about independent verification, including by lay people. If it requires advanced cryptography or computer science knowledge to trust the election results. I live in Canada where we do paper ballots everywhere. We also get same-night results on election day. They're just starting to experiment with vote tabulators, and this means that results come in faster now. In fact, in the latest Ontario provincial elections they had a declared winner 20 minutes after polls closed. Especially with tabulator machines I just don't get the point of electronic voting.

bcaa7f3a8bbc 8y ago

Another important difference is computer systems themselves are inherently general purpose [0], unlike a physical machine - An airplane cannot be subverted to calculate the GDP of the United States, but all Turing machines are created equal. Another difference is computer systems are generally open to unpredictable external inputs [0], unlike a physical machine - An airplane is not needed to be designed under the assumption that an adversary would use weather modification to destroy it. [0] Unless specialized designs are used explicitly in hardware and software, similar to those which are found in embedded industrial control systems, which removes these uncertainties to a large extent. But they are rarely used in practice because of its difficulties and cost. As Bruce Schneier written in Cryptography Engineering, One of the biggest differences between security systems and almost any other type of engineering is the adversarial setting. Most engineers have to contend with problems like storms, heat, and wear and tear. All of these factors affect designs, but their effect is fairly predictable to an experienced engineer. Not so in security systems. Our opponents are intelligent, clever, malicious, and devious; they’ll do things nobody had ever thought of before. They don’t play by the rules, and they are completely unpredictable. That is a much harder environment to work in. Many of us remember the film in which the Tacoma Narrows suspension bridge wobbles and twists in a steady wind until it breaks and falls into the water [1]. It is a famous piece of film, and the collapse taught bridge engineers a valuable lesson. Slender suspension bridges can have a resonance mode in which a steady wind can cause the whole structure to oscillate, and finally break. How do they prevent the same thing from happening with newer bridges? Making the bridge significantly stronger to resist the oscillations would be too expensive. The most common technique used is to change the aerodynamics of the bridge. The deck is made thicker, which makes it much harder for the wind to push up and down on the deck. Sometimes railings are used as spoilers to make the bridge deck behave less like a wing that lifts up in the wind. This works because wind is fairly predictable, and does not change its behavior in an active attempt to destroy the bridge. A security engineer has to take a malicious wind into account. What if the wind blows up and down instead of just from the side, and what if it changes directions at the right frequency for the bridge to resonate? Bridge engineers will dismiss this kind of talk out of hand: ‘‘Don’t be silly, the wind doesn’t blow that way.’’ That certainly makes the bridge engineers’ jobs much easier. Cryptographers don’t have that luxury. Security systems are attacked by clever and malicious attackers. We have to consider all types of attack. [1] https://upload.wikimedia.org/wikipedia/commons/transcoded/f/f2/Tacoma_Narrows_Bridge_destruction.ogv/Tacoma_Narrows_Bridge_destruction.ogv.480p.webm https://upload.wikimedia.org/wikipedia/commons/transcoded/f/...

ryandrake 8y ago
I don’t know if I agree with this reasoning. Bridges are at risk of being destroyed by any attacker with a truck full of dynamite. Do they defend against this in their designs? Do we blame the bridge engineer if someone destroys it? Do we blame the airplane builder when someone shoots a missile at it and it blows up? Software is one of those few practices where we blame the builder for being careless when the product is deliberately and maliciously attacked.