3 ms·

I don't want to counterargument all of your points because they are totally paranoid and just feeds the disinformation that Bolsonaro and his followers spread t

I don't want to counterargument all of your points because they are totally paranoid and just feeds the disinformation that Bolsonaro and his followers spread throughout the election year. You could use any number of arguments, you could say that the current government is actively pushing for censorship and state-wide surveillance, you could criticize the fact that the supreme court judge had the power to decide what was allowed and what wasn't during the election (which is a huge red flag and surprisingly Moraes only acted towards content that had little to no truth to it) and he's now pushing for TSE (Supreme Electoral Court) to have this permanent power to decide what is allowed and what isn't on the internet. > Last year the brazilian armed forces released a report saying that the voting machine software's makefiles download unaudited proprietary libraries straight off the internet and links them against the final binary. I'm sure the HN community can appreciate the insanity of that. Brazilian journalists didn't. The same Aremd Forces that was heavily politicized and most of them, if not all, were supporting Bolsonaro and all the stupid shit he spat out during the election year, the same armed forces that celebrated when that stupid Oswaldo Eustaquio said the voting machines had a huge security flaw in it and he couldn't even write proper code, which turned out to be a SIMULATION of the voting machine obtained from a repository on GitHub. The voting machines are audited every election year, TSE invites the political parties to audit them and strongly recommends them to invite over technical people to find issues with them. They found a couple of issues in the last year which had no impact on the election and wouldn't have. EDIT: as someone pointed out in another comment, the armed forces didn't participate in ANY of the public auditing sessions and were pushing for their own audit just so they could come up with something to feed the lie Bolsonaro was spreading that the voting machines aren't secure and shouldn't be used for elections.

matheusmoreira 3y ago
Well, are they wrong? When we filter out all the noise, that's what it comes down to. Are they wrong? > They found a couple of issues in the last year which had no impact on the election and wouldn't have. "A couple of issues" ? Does the voting machine software's build system NOT download unaudited proprietary manufacturer shared objects from the internet? Because that's the conclusion I came to after I read that document. That's a clear supply chain attack vector. The same type of attack vector that plagues Javascript and Python developers, many of whom post here on this very site. Yet this is supposed to be "conspiracy theory". Am I wrong about this? So far I haven't seen anything to make me think I am. Do you have any critical information I'm missing? When faced with this, the TSE judge just archived it with some "thanks for the code review" comment and that was the end of it. Then he says the system's "unquestionable". Then he fines Bolsonaro's party 22 million for the "bad faith" of questioning it. I don't trust it for a second.
- xinayder 3y ago
  https://www.gov.br/defesa/pt-br/centrais-de-conteudo/relatorio-das-forcas-armadas-nao-excluiu-a-possibilidade-de-fraude-ou-inconsistencia-nas-urnas-eletronicas https://www.gov.br/defesa/pt-br/centrais-de-conteudo/relator... they said they couldn't point to any security risks that would invalidate the whole process. I would like to read more about these findings, I can't find them anywhere and feel like I can only find them in alternative media sites.
  - matheusmoreira 3y ago
    Read the actual armed forces report. Would you like me to upload it somewhere? Page 4, they recommend that access be given to the libraries referenced by the code. In other words, those libaries weren't audited. Page 5, they say they noticed that the internet was accessed during the software compilation process for the purpose of downloading third party libraries. They outright say that this is an attack vector. The rest of the document more or less verifies that everything is as expected after the final binary has been cryptographically signed. This is expected, any tampering necessarily occurred before the binary was signed. Auditing source code doesn't matter given the nature of the attack vector. Protesters asking for source code will be embarrassed when they publish it and nothing is found. I'll only be satisfied if they publish the actual signed binary which ran on every machine on election day, the whole world looks at it with reverse engineering tools and finds nothing. Then I'll accept brazilian elections as legitimate.
    - xinayder 3y ago
      I read the report and there's nothing there that can be used to argument in favor of what you're saying. On the same report they point out 3 improvements for releasing the source code: - provide access to git or the VCS they use - allow usage of tools that do dynamic code analysis on compiled code - provide access to 3rd party libs referenced in the source code They didn't say the machines that compile the source code had internet access; they explicitly stated those machines had network access (which is completely different); they might have access to local network and it's expected so they can fetch the libraries needed for compilation. I can't deny that a supply chain attack might be possible by corrupting one of these 3rd party libs, but there wasn't anything on their report that is as bad as you make it out to be. Also, I can agree that the auditing should be more transparent, but I can't help but think that imagine if the army had access to the whole source code, how they would try to come up with a supply chain attack just to mess up the elections to favor their candidate? EDIT: I know this is a biased website but read what TSE replied to the army's auditing: https://www.brasildefato.com.br/2022/11/10/tse-responde-a-nova-investida-de-militares-contra-urnas-eletronicas-sistema-e-seguro https://www.brasildefato.com.br/2022/11/10/tse-responde-a-no... EDIT2: just to clear out, there were several different auditors when they had the auditing session, including universities and the federal police, the source code was provided to these auditors in 2021 and none found the issues the army pointed out. It's even pointed out by TSE that the army had access to the source code at the same time the other auditors had. EDIT3: https://noticias.uol.com.br/politica/ultimas-noticias/2022/11/09/especialistas-comentam-relatorio-defesa-urnas.htm https://noticias.uol.com.br/politica/ultimas-noticias/2022/1... There's nothing to worry about. There were public tests that provided full access to the source code and the army boycotted these tests, then they produced their own report, bringing up issues that could definitely be done during those public tests they decided not to participate.

matheusmoreira 3y ago

Well, are they wrong? When we filter out all the noise, that's what it comes down to. Are they wrong? > They found a couple of issues in the last year which had no impact on the election and wouldn't have. "A couple of issues" ? Does the voting machine software's build system NOT download unaudited proprietary manufacturer shared objects from the internet? Because that's the conclusion I came to after I read that document. That's a clear supply chain attack vector. The same type of attack vector that plagues Javascript and Python developers, many of whom post here on this very site. Yet this is supposed to be "conspiracy theory". Am I wrong about this? So far I haven't seen anything to make me think I am. Do you have any critical information I'm missing? When faced with this, the TSE judge just archived it with some "thanks for the code review" comment and that was the end of it. Then he says the system's "unquestionable". Then he fines Bolsonaro's party 22 million for the "bad faith" of questioning it. I don't trust it for a second.

xinayder 3y ago
https://www.gov.br/defesa/pt-br/centrais-de-conteudo/relatorio-das-forcas-armadas-nao-excluiu-a-possibilidade-de-fraude-ou-inconsistencia-nas-urnas-eletronicas https://www.gov.br/defesa/pt-br/centrais-de-conteudo/relator... they said they couldn't point to any security risks that would invalidate the whole process. I would like to read more about these findings, I can't find them anywhere and feel like I can only find them in alternative media sites.
- matheusmoreira 3y ago
  Read the actual armed forces report. Would you like me to upload it somewhere? Page 4, they recommend that access be given to the libraries referenced by the code. In other words, those libaries weren't audited. Page 5, they say they noticed that the internet was accessed during the software compilation process for the purpose of downloading third party libraries. They outright say that this is an attack vector. The rest of the document more or less verifies that everything is as expected after the final binary has been cryptographically signed. This is expected, any tampering necessarily occurred before the binary was signed. Auditing source code doesn't matter given the nature of the attack vector. Protesters asking for source code will be embarrassed when they publish it and nothing is found. I'll only be satisfied if they publish the actual signed binary which ran on every machine on election day, the whole world looks at it with reverse engineering tools and finds nothing. Then I'll accept brazilian elections as legitimate.
  - xinayder 3y ago
    I read the report and there's nothing there that can be used to argument in favor of what you're saying. On the same report they point out 3 improvements for releasing the source code: - provide access to git or the VCS they use - allow usage of tools that do dynamic code analysis on compiled code - provide access to 3rd party libs referenced in the source code They didn't say the machines that compile the source code had internet access; they explicitly stated those machines had network access (which is completely different); they might have access to local network and it's expected so they can fetch the libraries needed for compilation. I can't deny that a supply chain attack might be possible by corrupting one of these 3rd party libs, but there wasn't anything on their report that is as bad as you make it out to be. Also, I can agree that the auditing should be more transparent, but I can't help but think that imagine if the army had access to the whole source code, how they would try to come up with a supply chain attack just to mess up the elections to favor their candidate? EDIT: I know this is a biased website but read what TSE replied to the army's auditing: https://www.brasildefato.com.br/2022/11/10/tse-responde-a-nova-investida-de-militares-contra-urnas-eletronicas-sistema-e-seguro https://www.brasildefato.com.br/2022/11/10/tse-responde-a-no... EDIT2: just to clear out, there were several different auditors when they had the auditing session, including universities and the federal police, the source code was provided to these auditors in 2021 and none found the issues the army pointed out. It's even pointed out by TSE that the army had access to the source code at the same time the other auditors had. EDIT3: https://noticias.uol.com.br/politica/ultimas-noticias/2022/11/09/especialistas-comentam-relatorio-defesa-urnas.htm https://noticias.uol.com.br/politica/ultimas-noticias/2022/1... There's nothing to worry about. There were public tests that provided full access to the source code and the army boycotted these tests, then they produced their own report, bringing up issues that could definitely be done during those public tests they decided not to participate.