5 ms·

Thanks for the link! It is amazing to see a government app talk about reproducible builds and the importance of it!

by harikb 5y ago

denysvitali 5y ago
To be fair, the app was developed by a private company with government money, AFAIK, but at least it's open source and good in quality :)
- xcambar 5y ago
  A government that can balance what to do internally and can carefully choose their contractors, all the while pushing towards openness, is a dream come true.
  - sschueller 5y ago
    Sadly not the rule at the moment in Switzerland. Lots of mistakes have been made but there is a strong push towards this kind of work. E-Voting and E-Id was a disaster and we hope it gets pushed into this kind of openness and focus on privacy for all future government software.
    - jeffrallen 5y ago
      Some reality from someone who is involved: E-voting was a poorly implemented transparency process to check a not totally terrible (and also, not correct) implementation of a pretty good design. Lessons were learned on the transparency side, and they are on HackerOne now, doing things approximately right. Security is hard and they will probably fail again, but they are failing according to industry standards now, at least. (I was a reviewer of the original system.) e-ID was rejected by the voters as a gift of a service that should have been in government control to private industry for them to make profit on it. There was nothing technically terrible about the design for outsourcing eIDs to private industry, it was just a concept the voters found unacceptable. (I voted no along with a majority of my fellow citizens.)
      - CaptainZapp 5y ago
        It didn't really help that one of the prime candidate company to issue the eId couldn't get even basics, like cert management, straight. I'm quite thankful for Die Republik (slightly leftist daily internet "paper", which is ad free and subscription only) because I think they were quite instrumental in uncovering some of the shenanigans being pulled by those companies.
    - atoav 5y ago
      One thing about e-voting that is often missing in the discussion. No matter how you do it, the most important goal of any voting system is surprisingly not to get a result — the most important goal is to get a result everybody can agree on. This is the fundamental flaw of any e-voting system. Even if you manage to get it secure, how do you transparently proof this to everyone, including those who can't grok cryptography. What about those who don't care and just want to call the election stolen? It is hard enough to convince them with paper ballots, but these are at least physical and they cannot come out of nowhere.
      - dolmen 5y ago
        > Even if you manage to get it secure, how do you transparently proof this to everyone, including those who can't grok cryptography. Even those who can grok cryptography can't check that the implementation matches the specification. No human being can review the complete software running on a computer. Even less a distributed system. But most human beings can understand the paper ballot system.
  - vbezhenar 5y ago
    In my experience government either choses cheapest contractor (will all sort of consequences you can imagine) or bribes are involved (which might lead to a better outcome, surprisingly, but at much higher expenses). I wonder how Switzerland manages to avoid that plague.
    - throwaway8451 5y ago
      I think that I once heard that in Switzerland the second cheapest bidder is the one to get the contract, exactly to discourage someone aggressively underbidding all others. I could not verify that now though.
      - blocked_again 5y ago
        What is the right solution here from a game theory perspective?
        bhaak 5y ago
        Own two companies that agressively underbid all others?
        xcambar 5y ago
        That is deceptively simple. It might just work :D
        z77dj3kl 5y ago
        Auction design is a very active research area and what the "right solution" is, is not so easy to figure out. This has huge applications in... adtech.
  - deleted 5y ago
    [deleted]
wdroz 5y ago
This was developed by Ubique[1] and they aren't at their first app. [1] -- https://www.ubique.ch/ https://www.ubique.ch/

Thanks for the link! It is amazing to see a government app talk about reproducible builds and the importance of it!

by harikb 5y ago

Thanks for the link! It is amazing to see a government app talk about reproducible builds and the importance of it!

To be fair, the app was developed by a private company with government money, AFAIK, but at least it's open source and good in quality :)

xcambar 5y ago
A government that can balance what to do internally and can carefully choose their contractors, all the while pushing towards openness, is a dream come true.
- sschueller 5y ago
  Sadly not the rule at the moment in Switzerland. Lots of mistakes have been made but there is a strong push towards this kind of work. E-Voting and E-Id was a disaster and we hope it gets pushed into this kind of openness and focus on privacy for all future government software.
  - jeffrallen 5y ago
    Some reality from someone who is involved: E-voting was a poorly implemented transparency process to check a not totally terrible (and also, not correct) implementation of a pretty good design. Lessons were learned on the transparency side, and they are on HackerOne now, doing things approximately right. Security is hard and they will probably fail again, but they are failing according to industry standards now, at least. (I was a reviewer of the original system.) e-ID was rejected by the voters as a gift of a service that should have been in government control to private industry for them to make profit on it. There was nothing technically terrible about the design for outsourcing eIDs to private industry, it was just a concept the voters found unacceptable. (I voted no along with a majority of my fellow citizens.)
    - CaptainZapp 5y ago
      It didn't really help that one of the prime candidate company to issue the eId couldn't get even basics, like cert management, straight. I'm quite thankful for Die Republik (slightly leftist daily internet "paper", which is ad free and subscription only) because I think they were quite instrumental in uncovering some of the shenanigans being pulled by those companies.
  - atoav 5y ago
    One thing about e-voting that is often missing in the discussion. No matter how you do it, the most important goal of any voting system is surprisingly not to get a result — the most important goal is to get a result everybody can agree on. This is the fundamental flaw of any e-voting system. Even if you manage to get it secure, how do you transparently proof this to everyone, including those who can't grok cryptography. What about those who don't care and just want to call the election stolen? It is hard enough to convince them with paper ballots, but these are at least physical and they cannot come out of nowhere.
    - dolmen 5y ago
      > Even if you manage to get it secure, how do you transparently proof this to everyone, including those who can't grok cryptography. Even those who can grok cryptography can't check that the implementation matches the specification. No human being can review the complete software running on a computer. Even less a distributed system. But most human beings can understand the paper ballot system.
- vbezhenar 5y ago
  In my experience government either choses cheapest contractor (will all sort of consequences you can imagine) or bribes are involved (which might lead to a better outcome, surprisingly, but at much higher expenses). I wonder how Switzerland manages to avoid that plague.
  - throwaway8451 5y ago
    I think that I once heard that in Switzerland the second cheapest bidder is the one to get the contract, exactly to discourage someone aggressively underbidding all others. I could not verify that now though.
    - blocked_again 5y ago
      What is the right solution here from a game theory perspective?
      - bhaak 5y ago
        Own two companies that agressively underbid all others?
        xcambar 5y ago
        That is deceptively simple. It might just work :D
      - z77dj3kl 5y ago
        Auction design is a very active research area and what the "right solution" is, is not so easy to figure out. This has huge applications in... adtech.
- deleted 5y ago
  [deleted]

wdroz 5y ago

This was developed by Ubique[1] and they aren't at their first app. [1] -- https://www.ubique.ch/ https://www.ubique.ch/