3 ms·

The naivety on the part of the various parties involved here is breathtaking. It is interesting to observe how little distinction non-technical users are aware

The naivety on the part of the various parties involved here is breathtaking. It is interesting to observe how little distinction non-technical users are aware of between high quality and comically buggy software because of the ease of producing flashy UIs these days. They have no idea how the sausage gets made. No idea. I have never seen a stronger case for the need to have third-party certification and testing of software and the people involved in building it.

rglover 7y ago
I wholeheartedly agree with what you propose. Serious question: what do you think that certification looks like?
- peteradio 7y ago
  Veterans form a guild. Entry into guild is prestigious and solemn.
thomk 7y ago
I'm getting voted down for mentioning this in another section of this discussion, but, is this not the perfect use case for open source? The certification is anyone and everyone can double check the source code. If this is a bad idea, I would appreciate the feedback, because, it is my understanding that a big draw of using OSS is transparency.
- flatiron 7y ago
  For something like public voting I agree. But it would be a hard sell to get a lot of companies to pay for software development and release the source because their competitors would get it for free.
  - thomk 7y ago
    I could be wrong, but, I have to believe that there are developers who would donate their time to something as fundamental to democracy as voting. Grassroots, not corporate funded. A corporate funded voting system feels like what we already have.
    - hugey010 7y ago
      You are not wrong. I've had this discussion with other devs but it always ends in a crypto rant of some kind.
- vsareto 7y ago
  How would you know that they actually deployed that repo to production as-is?
  - undersuit 7y ago
    If you control your phone you can control the software. https://f-droid.org/en/docs/Verification_Server/ https://f-droid.org/en/docs/Verification_Server/
    - vsareto 7y ago
      >This is still pretty raw, so expect some tinkering. It also will likely only work on Debian, Ubuntu and other Debian-derivatives. Not there yet, but it's one possibility as long as the company running this server has appropriate levels of security
- ken 7y ago
  "Open source" has a couple different related meanings, and it's not clear exactly which aspect you mean, or how it would help here. - A license which allows the source code to be redistributed under the same terms as it was received? The problem with these boxes isn't that people can't redistribute it. - A collaborative model for creating software? Possibly -- though there have been some high-profile cases of security issues sneaking into these, too. Modern voting machines also seem to have a huge stack of dependencies, which mean the surface area for exploit is much larger than the voting software itself. Would you require a fully open-source stack, and how far down? OSS is great for transparency for the person receiving the software (in this case, the jurisdictions operating the machines), but if those people don't care to audit it (or redistribute it to others who wish to), that doesn't buy them anything. I'd much rather see a rule requiring voting software to be publicly viewable by any voter in the jurisdiction, regardless of the software license it's sold under.
  - thomk 7y ago
    What I mean is a variation of all of the above. Transparency, an open license, collaboration, distribution, best practices and more. Clearly I do not expect districts to independently inspect and verify source code any more that we are inspecting and verifying the web server running this website. Computers (or at a minimum binaries) could be distributed and have self checking as the boot. They could simply be used to tally paper ballots (as others have mentioned) or to transmit votes. The overarching point is if we can do 5 trillion dollars of electronic money transfers worldwide per DAY certainly we can use open source to accurately, securely and transparently count and tally votes. Do we need even more governmental oversight? I would like to see a bulletproof technological solution that I personally can verify if I choose to.
claudeganon 7y ago
The DNC literally argued in court that they have no obligation to conduct fair elections, can just do whatever they want with back room deals and call it legitimate, so I don’t see that happening: https://www.nakedcapitalism.com/2019/08/reminder-dnc-lawyers-to-court-we-do-not-owe-voters-an-impartial-or-evenhanded-primary-election.html https://www.nakedcapitalism.com/2019/08/reminder-dnc-lawyers...
- thomk 7y ago
  That article is unbelivable, eye opening and infuriating.
  - jimmydddd 7y ago
    I guess the gist of it is there's a difference between a Party's Primary election process and a National or State election. The Party is treated like a private club that can do whatever it wants in its Primars to select its candidate for the general election.
    - claudeganon 7y ago
      Right, which is fundamentally incompatible with a two-party democracy.
    - CWuestefeld 7y ago
      The Party is a private club, full stop.
  - redbeard0x0a 7y ago
    And the DNC paid for part of the app+services by Shadowinc.io (As well as Pete, Iowa and Nevada Democratic Parties.
- dragonwriter 7y ago
  The surprising part is that they had to argue that; that was the practice of every major party (only ever two at a time, but more than two over history), openly, until after 1968, and it was PR, not law changes, which got them to even pretend to make some gestures toward fairness.
mtgx 7y ago
Or maybe it worked as intended. The only candidate to make a "victory speech", Buttigieg, was also the only candidate to have paid money to the company that made the app and then kept the app and its security secret. https://www.washingtonexaminer.com/news/buttigieg-campaign-paid-firm-that-developed-voting-app-blamed-for-iowa-caucus-delays https://www.washingtonexaminer.com/news/buttigieg-campaign-p... I wonder if Buttigieg knew something we didn't and this is why he was so confident. The American election system is such a joke, in a dozen different ways. You'd think something like that would count as a conflict of interest, but no, conflict of interest is the name of the political game in the land of the free these days -- in both (and basically only) parties.
aaaaaaaaaaa10 7y ago
"I have never seen a stronger case for the need to have third-party certification and testing of software and the people involved in building it." Are you proposing that every GitHub repository be certified by a third-party and tested before use? Besides, "high quality" software like Google Maps or iOS don't have anything close to "third-party certification".
- jordanpg 7y ago
  I'm saying that if software developers are going to be solving problems that are this closely connected with the public interest and safety then they should be held to industry or regulatory standards on par with the ones faced by engineers building airplanes and bridges.
Miner49er 7y ago
> The naivety on the part of the various parties involved here is breathtaking. Which is why it may be wrong to assume naivety. We don't know yet if this was incompetence/naivety or intentional.

rglover 7y ago

I wholeheartedly agree with what you propose. Serious question: what do you think that certification looks like?

peteradio 7y ago
Veterans form a guild. Entry into guild is prestigious and solemn.

thomk 7y ago

I'm getting voted down for mentioning this in another section of this discussion, but, is this not the perfect use case for open source? The certification is anyone and everyone can double check the source code. If this is a bad idea, I would appreciate the feedback, because, it is my understanding that a big draw of using OSS is transparency.

flatiron 7y ago
For something like public voting I agree. But it would be a hard sell to get a lot of companies to pay for software development and release the source because their competitors would get it for free.
- thomk 7y ago
  I could be wrong, but, I have to believe that there are developers who would donate their time to something as fundamental to democracy as voting. Grassroots, not corporate funded. A corporate funded voting system feels like what we already have.
  - hugey010 7y ago
    You are not wrong. I've had this discussion with other devs but it always ends in a crypto rant of some kind.
vsareto 7y ago
How would you know that they actually deployed that repo to production as-is?
- undersuit 7y ago
  If you control your phone you can control the software. https://f-droid.org/en/docs/Verification_Server/ https://f-droid.org/en/docs/Verification_Server/
  - vsareto 7y ago
    >This is still pretty raw, so expect some tinkering. It also will likely only work on Debian, Ubuntu and other Debian-derivatives. Not there yet, but it's one possibility as long as the company running this server has appropriate levels of security
ken 7y ago
"Open source" has a couple different related meanings, and it's not clear exactly which aspect you mean, or how it would help here. - A license which allows the source code to be redistributed under the same terms as it was received? The problem with these boxes isn't that people can't redistribute it. - A collaborative model for creating software? Possibly -- though there have been some high-profile cases of security issues sneaking into these, too. Modern voting machines also seem to have a huge stack of dependencies, which mean the surface area for exploit is much larger than the voting software itself. Would you require a fully open-source stack, and how far down? OSS is great for transparency for the person receiving the software (in this case, the jurisdictions operating the machines), but if those people don't care to audit it (or redistribute it to others who wish to), that doesn't buy them anything. I'd much rather see a rule requiring voting software to be publicly viewable by any voter in the jurisdiction, regardless of the software license it's sold under.
- thomk 7y ago
  What I mean is a variation of all of the above. Transparency, an open license, collaboration, distribution, best practices and more. Clearly I do not expect districts to independently inspect and verify source code any more that we are inspecting and verifying the web server running this website. Computers (or at a minimum binaries) could be distributed and have self checking as the boot. They could simply be used to tally paper ballots (as others have mentioned) or to transmit votes. The overarching point is if we can do 5 trillion dollars of electronic money transfers worldwide per DAY certainly we can use open source to accurately, securely and transparently count and tally votes. Do we need even more governmental oversight? I would like to see a bulletproof technological solution that I personally can verify if I choose to.

claudeganon 7y ago

The DNC literally argued in court that they have no obligation to conduct fair elections, can just do whatever they want with back room deals and call it legitimate, so I don’t see that happening: https://www.nakedcapitalism.com/2019/08/reminder-dnc-lawyers-to-court-we-do-not-owe-voters-an-impartial-or-evenhanded-primary-election.html https://www.nakedcapitalism.com/2019/08/reminder-dnc-lawyers...

thomk 7y ago
That article is unbelivable, eye opening and infuriating.
- jimmydddd 7y ago
  I guess the gist of it is there's a difference between a Party's Primary election process and a National or State election. The Party is treated like a private club that can do whatever it wants in its Primars to select its candidate for the general election.
  - claudeganon 7y ago
    Right, which is fundamentally incompatible with a two-party democracy.
  - CWuestefeld 7y ago
    The Party is a private club, full stop.
- redbeard0x0a 7y ago
  And the DNC paid for part of the app+services by Shadowinc.io (As well as Pete, Iowa and Nevada Democratic Parties.
dragonwriter 7y ago
The surprising part is that they had to argue that; that was the practice of every major party (only ever two at a time, but more than two over history), openly, until after 1968, and it was PR, not law changes, which got them to even pretend to make some gestures toward fairness.

mtgx 7y ago

Or maybe it worked as intended. The only candidate to make a "victory speech", Buttigieg, was also the only candidate to have paid money to the company that made the app and then kept the app and its security secret. https://www.washingtonexaminer.com/news/buttigieg-campaign-paid-firm-that-developed-voting-app-blamed-for-iowa-caucus-delays https://www.washingtonexaminer.com/news/buttigieg-campaign-p... I wonder if Buttigieg knew something we didn't and this is why he was so confident. The American election system is such a joke, in a dozen different ways. You'd think something like that would count as a conflict of interest, but no, conflict of interest is the name of the political game in the land of the free these days -- in both (and basically only) parties.

aaaaaaaaaaa10 7y ago

"I have never seen a stronger case for the need to have third-party certification and testing of software and the people involved in building it." Are you proposing that every GitHub repository be certified by a third-party and tested before use? Besides, "high quality" software like Google Maps or iOS don't have anything close to "third-party certification".

jordanpg 7y ago
I'm saying that if software developers are going to be solving problems that are this closely connected with the public interest and safety then they should be held to industry or regulatory standards on par with the ones faced by engineers building airplanes and bridges.

Miner49er 7y ago

> The naivety on the part of the various parties involved here is breathtaking. Which is why it may be wrong to assume naivety. We don't know yet if this was incompetence/naivety or intentional.