6 ms·

Seriously curious, there were only 1,765 precincts. Couldn't they just create a Google Forms link share it to the field people sending the results back? It wou

by alpb 7y ago

Seriously curious, there were only 1,765 precincts. Couldn't they just create a Google Forms link share it to the field people sending the results back? It would be only 1765 lines in a Google Sheets doc, and would be practically free. (Not to mention more secure than a custom implementation by semi-incapable development contractors like in this case.)

whalesalad 7y ago
Where is the fun in that? Gotta throw an elastic kafka beanstalk at it behind a series of microservices that serve the frontend as multiple single page apps composed into one umbrella via iframes.
- insane_dreamer 7y ago
  If you don’t at least have a kubernetes cluster, you’re doing it wrong.
- outworlder 7y ago
  > Where is the fun in that? Gotta throw an elastic kafka beanstalk at it behind a series of microservices that serve the frontend as multiple single page apps composed into one umbrella via iframes. Had they done any of that, it might even have worked. I don't think their stack is as exciting as that.
secabeen 7y ago
They legitimately wanted more security than that, with two-factor and other similar systems to prevent hostile actors inserting bad data.
- zamadatix 7y ago
  Google probably does 2 factor better than $smallapp. I'd probably take more than 1 form per report though (I think that falls under "similar systems" stuff you mentioned).
  - wcfields 7y ago
    Although a little kludgey, it does cross of the boxes: - Only allow one entry per GSuite ID in Google Forms - Enforce yubikey 2FA on GSuite. - Issue each captain a Pixel 1 with Google MDM for remote wiping and app deployment. - Turn off all other apps (Docs, Fi, Photos, etc...) in GSuite.
    - runawaybottle 7y ago
      Wouldn’t all of this be more elegant using Graphql?
      - ilaksh 7y ago
        Are you serious or making a joke? Not saying it can't be serious. But it might be a joke. I can't tell anymore.
        tmpz22 7y ago
        If that’s not a joke I’m quitting this industry and becoming a carpenter
        runawaybottle 7y ago
        I was hoping to get a few chuckles, sure.
- basch 7y ago
  It sounds like they made their account the day of the vote, how does 2 factor prevent someone from registering an account in your place?
zweep 7y ago
Well you did see people just Tweeting the results from their precinct in all of this which managed to produce a good picture of what was going on. So you don't even need a collaborative document!
- AndrewBissell 7y ago
  Of course, those tweeted images included PIN numbers which might have been useful to someone wanting to gum up the API with requests.
thedance 7y ago
It would be actually free in addition to being practically free, and it would come with multi-factor authentication, authorization, and abuse protection that is undoubtedly in another league compared to what this company barfed out.
dreamcompiler 7y ago
They could have used RFC 1149 [0] and gotten a more accurate count quicker. [0] https://tools.ietf.org/html/rfc1149 https://tools.ietf.org/html/rfc1149
commandar 7y ago
Both state parties used apps developed by Microsoft for the 2016 caucus. The Sanders campaign complained vociferously about it and the move away from MS was one of a number of "reforms" intended to placate those concerns. https://thehill.com/policy/technology/267302-sanders-campaign-questions-microsoft-involvement-in-iowa-caucus https://thehill.com/policy/technology/267302-sanders-campaig...
- dragonwriter 7y ago
  While Sanders raised complaints about both the opaque results and Microsoft's role, other candidates also raised complaints about the opaque results; the move to allay all those complaints wasn't “move away from Microsoft” (a move to a historically Clinton linked and currently Buttigeig linked firm wouldn't allay Sanders bias complaints, anyway, on it own), but the transparency requirements imposed by the DNC that required. Now, this necessitated a new app, since the Microsoft one provided previously didn't address the new reporting requirements. But it was the reporting requirements, not moving from MS to a firm that had even clearer reason to suspect anti-Sanders bias, that was intended to negate the complaints of Sanders and other candidates about the 2016 cycle.
munk-a 7y ago
This really gets me - you have to go out of your way to build a solution that won't work for 1,700 users[1]. I have seen systems that would collapse under less users but they are few... and all of them were train wrecks. 1. Ignoring like... stupid high information transmission systems where clever solutions may be required to concurrently stream data to even dozens of customers - the data here was measurable in bytes, _maybe_ kilobytes.
- jjeaff 7y ago
  It doesn't appear that data transmission rates or quantity of users had anything to do with issues with the app. It was a bug in the code that was probably not apparent until being used in a live environment.
  - schwartzworld 7y ago
    This is explicitly wrong. It turned out they distributed the app on the free tier of TestFairy, meaning that they were limited to 200 users https://www.theverge.com/2020/2/4/21122737/iowa-democractic-caucus-voting-app-android-testfairy-screenshots-app-store https://www.theverge.com/2020/2/4/21122737/iowa-democractic-...
    - cambalache 7y ago
      Hahaha I can hardly believe it.It is amateur hour deluxe
    - jjeaff 7y ago
      That's not really a scale issue either. Just poor deployment planning.
adrianmonk 7y ago
Last time I tried, a few years ago admittedly, Google Docs didn't perform well when you have large numbers of people trying to access a single document. It obviously scales great for total number of users, but I don't think having everybody hit one document is a mainstream use case that's necessarily well-supported.
- viggity 7y ago
  There are google forms that you can setup that populate a spreadsheet. People don't need access to see the spreadsheet. One problem is that you have to authenticate it is the legit precinct captain, presumably they have some pin/password that they'll enter that is unique to their precinct. You can't prevent people from entering the wrong stuff, you'll have to cull the spreadsheet, but still, it seems pretty damn manageable.
  - alpb 7y ago
    ^ this. P.S. I work at Google and internally sheets is used thoroughly to survey large numbers of employees and it can view large sheets for a lot of people in "read-only" mode pretty well.
  - adrianmonk 7y ago
    That's exactly what I did when I had performance problems. I also had some processing that happened whenever someone submitted a form. I found that I hit a performance limit when many people tried to submit the form in a short period of time. I eventually found that if I changed how the spreadsheet was structured, a lot of problems were drastically reduced. I forget the details, but I think I switched to having one sheet that just collects form submissions and does nothing else, then another sheet that uses Javascript to pull data off the first and do the computations. That way processing was moved offline from form submission. But the general point is, you can't just write a spreadsheet, collect thousands of form submissions, and have no issues. You can't just assume "Google scales everything". N people interacting with N (or 2N or 3N if you share with a few) spreadsheets is an embarrassingly parallel problem. N people interacting with 1 spreadsheet is not.
RickJWagner 7y ago
Or 'shard' it into 40 sheets of 45 rows each. Deputize 40 administrators, give them each the 45 phone numbers for their districts. At the appointed time, have the administrators direct-dial each of the 45 numbers and quickly note the results. Combine the results from the 40 as they come in. Secure and effective. It'd probably take 3 hours to wrap it all up.
dpau 7y ago
guess what infamous shadow inc is using for its job applications forms? airtable. oh the irony. https://shadowinc.io/jobs/front-end-engineer/ https://shadowinc.io/jobs/front-end-engineer/
kraigie 7y ago
How would the salespeople make their money then?
bakuninsbart 7y ago
You could have sent someone with a sealed letter by taxi from every precinct, and it would have still been cheaper.
iudqnolq 7y ago
Back-of-the-envelope math going backwards from the $60,000 the Iowa Democratic Party paid for this app suggest that Shadow put in less than a handful of person-months of work. (Presume $100,000 base salary, 1.4x overhead for a salaried employee, $0 profit, all employees working on the project are developers, and no code reuse with any other project. Some of these assumptions are clearly false, but I think it gives a reasonable guess at an upper bound). However, seeing as the developers they hired didn't bother changing the default manifest and forgot to prefix a URL with HTTPS, I hope they Shadow at least wasn't paying them that much?

by alpb 7y ago

whalesalad 7y ago

Where is the fun in that? Gotta throw an elastic kafka beanstalk at it behind a series of microservices that serve the frontend as multiple single page apps composed into one umbrella via iframes.

insane_dreamer 7y ago
If you don’t at least have a kubernetes cluster, you’re doing it wrong.
outworlder 7y ago
> Where is the fun in that? Gotta throw an elastic kafka beanstalk at it behind a series of microservices that serve the frontend as multiple single page apps composed into one umbrella via iframes. Had they done any of that, it might even have worked. I don't think their stack is as exciting as that.

secabeen 7y ago

They legitimately wanted more security than that, with two-factor and other similar systems to prevent hostile actors inserting bad data.

zamadatix 7y ago
Google probably does 2 factor better than $smallapp. I'd probably take more than 1 form per report though (I think that falls under "similar systems" stuff you mentioned).
- wcfields 7y ago
  Although a little kludgey, it does cross of the boxes: - Only allow one entry per GSuite ID in Google Forms - Enforce yubikey 2FA on GSuite. - Issue each captain a Pixel 1 with Google MDM for remote wiping and app deployment. - Turn off all other apps (Docs, Fi, Photos, etc...) in GSuite.
  - runawaybottle 7y ago
    Wouldn’t all of this be more elegant using Graphql?
    - ilaksh 7y ago
      Are you serious or making a joke? Not saying it can't be serious. But it might be a joke. I can't tell anymore.
      - tmpz22 7y ago
        If that’s not a joke I’m quitting this industry and becoming a carpenter
      - runawaybottle 7y ago
        I was hoping to get a few chuckles, sure.
basch 7y ago
It sounds like they made their account the day of the vote, how does 2 factor prevent someone from registering an account in your place?

zweep 7y ago

Well you did see people just Tweeting the results from their precinct in all of this which managed to produce a good picture of what was going on. So you don't even need a collaborative document!

AndrewBissell 7y ago
Of course, those tweeted images included PIN numbers which might have been useful to someone wanting to gum up the API with requests.

thedance 7y ago

It would be actually free in addition to being practically free, and it would come with multi-factor authentication, authorization, and abuse protection that is undoubtedly in another league compared to what this company barfed out.

dreamcompiler 7y ago

They could have used RFC 1149 [0] and gotten a more accurate count quicker. [0] https://tools.ietf.org/html/rfc1149 https://tools.ietf.org/html/rfc1149

commandar 7y ago

Both state parties used apps developed by Microsoft for the 2016 caucus. The Sanders campaign complained vociferously about it and the move away from MS was one of a number of "reforms" intended to placate those concerns. https://thehill.com/policy/technology/267302-sanders-campaign-questions-microsoft-involvement-in-iowa-caucus https://thehill.com/policy/technology/267302-sanders-campaig...

dragonwriter 7y ago
While Sanders raised complaints about both the opaque results and Microsoft's role, other candidates also raised complaints about the opaque results; the move to allay all those complaints wasn't “move away from Microsoft” (a move to a historically Clinton linked and currently Buttigeig linked firm wouldn't allay Sanders bias complaints, anyway, on it own), but the transparency requirements imposed by the DNC that required. Now, this necessitated a new app, since the Microsoft one provided previously didn't address the new reporting requirements. But it was the reporting requirements, not moving from MS to a firm that had even clearer reason to suspect anti-Sanders bias, that was intended to negate the complaints of Sanders and other candidates about the 2016 cycle.

munk-a 7y ago

This really gets me - you have to go out of your way to build a solution that won't work for 1,700 users[1]. I have seen systems that would collapse under less users but they are few... and all of them were train wrecks. 1. Ignoring like... stupid high information transmission systems where clever solutions may be required to concurrently stream data to even dozens of customers - the data here was measurable in bytes, _maybe_ kilobytes.

jjeaff 7y ago
It doesn't appear that data transmission rates or quantity of users had anything to do with issues with the app. It was a bug in the code that was probably not apparent until being used in a live environment.
- schwartzworld 7y ago
  This is explicitly wrong. It turned out they distributed the app on the free tier of TestFairy, meaning that they were limited to 200 users https://www.theverge.com/2020/2/4/21122737/iowa-democractic-caucus-voting-app-android-testfairy-screenshots-app-store https://www.theverge.com/2020/2/4/21122737/iowa-democractic-...
  - cambalache 7y ago
    Hahaha I can hardly believe it.It is amateur hour deluxe
  - jjeaff 7y ago
    That's not really a scale issue either. Just poor deployment planning.

adrianmonk 7y ago

Last time I tried, a few years ago admittedly, Google Docs didn't perform well when you have large numbers of people trying to access a single document. It obviously scales great for total number of users, but I don't think having everybody hit one document is a mainstream use case that's necessarily well-supported.

viggity 7y ago
There are google forms that you can setup that populate a spreadsheet. People don't need access to see the spreadsheet. One problem is that you have to authenticate it is the legit precinct captain, presumably they have some pin/password that they'll enter that is unique to their precinct. You can't prevent people from entering the wrong stuff, you'll have to cull the spreadsheet, but still, it seems pretty damn manageable.
- alpb 7y ago
  ^ this. P.S. I work at Google and internally sheets is used thoroughly to survey large numbers of employees and it can view large sheets for a lot of people in "read-only" mode pretty well.
- adrianmonk 7y ago
  That's exactly what I did when I had performance problems. I also had some processing that happened whenever someone submitted a form. I found that I hit a performance limit when many people tried to submit the form in a short period of time. I eventually found that if I changed how the spreadsheet was structured, a lot of problems were drastically reduced. I forget the details, but I think I switched to having one sheet that just collects form submissions and does nothing else, then another sheet that uses Javascript to pull data off the first and do the computations. That way processing was moved offline from form submission. But the general point is, you can't just write a spreadsheet, collect thousands of form submissions, and have no issues. You can't just assume "Google scales everything". N people interacting with N (or 2N or 3N if you share with a few) spreadsheets is an embarrassingly parallel problem. N people interacting with 1 spreadsheet is not.

RickJWagner 7y ago

Or 'shard' it into 40 sheets of 45 rows each. Deputize 40 administrators, give them each the 45 phone numbers for their districts. At the appointed time, have the administrators direct-dial each of the 45 numbers and quickly note the results. Combine the results from the 40 as they come in. Secure and effective. It'd probably take 3 hours to wrap it all up.

dpau 7y ago

guess what infamous shadow inc is using for its job applications forms? airtable. oh the irony. https://shadowinc.io/jobs/front-end-engineer/ https://shadowinc.io/jobs/front-end-engineer/

kraigie 7y ago

How would the salespeople make their money then?

bakuninsbart 7y ago

You could have sent someone with a sealed letter by taxi from every precinct, and it would have still been cheaper.

iudqnolq 7y ago

Back-of-the-envelope math going backwards from the $60,000 the Iowa Democratic Party paid for this app suggest that Shadow put in less than a handful of person-months of work. (Presume $100,000 base salary, 1.4x overhead for a salaried employee, $0 profit, all employees working on the project are developers, and no code reuse with any other project. Some of these assumptions are clearly false, but I think it gives a reasonable guess at an upper bound). However, seeing as the developers they hired didn't bother changing the default manifest and forgot to prefix a URL with HTTPS, I hope they Shadow at least wasn't paying them that much?