3 ms·

Unless I can take home the voting machine & verify that the software running on the machine is in fact the claimed software this doesn't mean anything. You coul

Unless I can take home the voting machine & verify that the software running on the machine is in fact the claimed software this doesn't mean anything. You could just as easily publish one set of software and have the machine run something completely different.

SketchySeaBeast 4y ago
That's my struggle with this as well - what are you going to do, show me a checksum on the monitor to somehow "prove" that the software is the same?
- sidewndr46 4y ago
  Given that they could just as easily fake the checksum, they might as well use a 1-bit checksum. The security of a 1-bit checksum is just as good as a 256-bit checksum in that scenario.
  - SketchySeaBeast 4y ago
    Yeah, that's why I wrote it "prove" - it's not proving anything. There's absolutely no way they can prove that the code in that box is the same as on the repo, not to mention all the other upstream issues - it has to send that count somewhere to be aggregated, and now we're even further removed from all the possible points of "failure".
starkd 4y ago
They can automate the installation of the current code onto the machine, which is in turn also open source.
- _-david-_ 4y ago
  They are going to have 24 hour cameras pointed to the machines after the installation, including during shipment right? If not somebody could change the software. Even with cameras somebody could manipulate it probably.
  - starkd 4y ago
    Or simply have multiple people sign off on which software version gets installed.
    - _-david-_ 4y ago
      What happens if somebody manipulates the software after the install?
ratg13 4y ago
Personally I think the software is largely irrelevant. As long as the machine prints a paper receipt that I can verify is correct before it is stored, the code that creates the receipt doesn't really matter.
- pessimizer 4y ago
  Will you be satisfied with that slip of paper if your vote was never included in the official count because the software was bad?
  - ratg13 4y ago
    There will always be minor issues that can be amplified even in non-technical solutions (see also: the 'hanging chad' fiasco of the 2000 US election) Giving voters the ability to inspect their ballots and the criteria by which they are considered valid at least gives the voter the control over making sure things are correct.

SketchySeaBeast 4y ago

That's my struggle with this as well - what are you going to do, show me a checksum on the monitor to somehow "prove" that the software is the same?

sidewndr46 4y ago
Given that they could just as easily fake the checksum, they might as well use a 1-bit checksum. The security of a 1-bit checksum is just as good as a 256-bit checksum in that scenario.
- SketchySeaBeast 4y ago
  Yeah, that's why I wrote it "prove" - it's not proving anything. There's absolutely no way they can prove that the code in that box is the same as on the repo, not to mention all the other upstream issues - it has to send that count somewhere to be aggregated, and now we're even further removed from all the possible points of "failure".

starkd 4y ago

They can automate the installation of the current code onto the machine, which is in turn also open source.

_-david-_ 4y ago
They are going to have 24 hour cameras pointed to the machines after the installation, including during shipment right? If not somebody could change the software. Even with cameras somebody could manipulate it probably.
- starkd 4y ago
  Or simply have multiple people sign off on which software version gets installed.
  - _-david-_ 4y ago
    What happens if somebody manipulates the software after the install?

ratg13 4y ago

Personally I think the software is largely irrelevant. As long as the machine prints a paper receipt that I can verify is correct before it is stored, the code that creates the receipt doesn't really matter.

pessimizer 4y ago
Will you be satisfied with that slip of paper if your vote was never included in the official count because the software was bad?
- ratg13 4y ago
  There will always be minor issues that can be amplified even in non-technical solutions (see also: the 'hanging chad' fiasco of the 2000 US election) Giving voters the ability to inspect their ballots and the criteria by which they are considered valid at least gives the voter the control over making sure things are correct.