3 ms·

> No one is outside of the government's sphere of influence. By sphere of influence I mean payroll and permission to operate. Even so it's not true considering

> No one is outside of the government's sphere of influence. By sphere of influence I mean payroll and permission to operate. Even so it's not true considering anonymous and foreign researchers or pretty much anyone who can clone a git repo on the internet. > What that committe is, is a reunion of many different organisations with different points of view and participation of people from all levels of society. You don't seem to understand how problematic is this idea that there are groups of people who are guaranteed to have the populations best interest in mind. All while in the payroll of the entity they are supposed to audit. I get you trust such a committee but you shouldn't expect everyone doing the same. > This is prejudiced and offensive. Please refrain from this kind of comment. Its not. I am brazilian and have lived over there for a long time. I'm guessing you are too so you are familiar with the term "carteirada" don't you? You on the other hand is condescending: > Not my point, but please tell me how much auditing and verification you do on every single other aspect of your life. I verify signatures for every important software I download. Even if I don't there are tools doing this for me like package managers. My main work basically hovers around verifying data every 10 minutes or so. Chances are your computer boot loader and most of its applications are signed. But somehow for voting we just trust the pros? And this is besides the point. If a normal citizen cannot attest and verify for the trustworthiness of the digital election system that is deciding the future of his life for the next 4 years then the system is flawed and you can't really blame the people who are calling it a sham. > I have no idea what you mean by this. It honestly makes the opposite of sense to me, but if you could elaborate a little, perhaps you'd help me understand. "Don't question. Just trust the authorities" is a scar of a time where such things would put you in jail. The idea that a normal citizen cannot interfere in government affairs and instead leave it to a group of elites is common in dictatorships. I don't even know why are you arguing about this. Why are you trying to convince me into trusting third parties when we agree the best solution is to have government release the source code and let anyone audit it?

cassianoleal 3y ago
> By sphere of influence I mean payroll and permission to operate. But that's te thing, everyone and every organisation needs permission from the government to operate. Even you as an individual do. You have to pay taxes, you have to abide by rules and regulations, you are not allowed to purchase or operate certain substances or equipment unless you have the proper permits etc. In terms of payroll, unless you mean that every single individual in every organisation that's in the committee are somehow being paid by the electoral court, I don't understand your point. Even in the last elections, when the administration was fiercely attacking the whole process, the auditors still came out with a positive analysis of the system. If the government had that much power over them, how come the committee didn't side with the government? > You don't seem to understand how problematic is this idea that there are groups of people who are guaranteed to have the populations best interest in mind. I don't think they're guaranteed to have the best interest of the population. I'm of the opinion that they have a very broad set of points of view, some widely opposed to others, and they still all come out with overall positive analyses of the system. There are proper technical people doing those analyses, and they're just regular people. They could be myself, or yourself. Which is, again, the point I was making about actually knowing someone, a regular individual, who has been part of the committee. > you shouldn't expect everyone doing the same. I don't. I don't expect anything from anyone. You're free to trust or distrust whomever you like. > I am brazilian and have lived over there for a long time. This doesn't shield you from being prejudiced against Brazilians. Surely you've heard the phrase "complexo de vira-lata" (loosely translated, for the foreign audience, "stray dog complex"). Your comment was: That's a very classic brazilian response This is prejudiced. Not only you completely misinterpreted my thoughts, but you then proceeded to attribute your interpretation of them to the fact that I belong to a certain group of people. > I'm guessing you are too so you are familiar with the term "carteirada" Surely am. That's usually when individuals use their position to get around limitations that apply to most people, as if they belong to a superior caste. I don't see how that's related to the voting autit committee. > I verify signatures for every important software I download. Do you verify the entire chain? Or do you trust someone to attest validity of keys at some point? > You on the other hand is condescending Fair point, apologies for the snark. > Even if I don't there are tools doing this for me like package managers. Which again are based on trust. Trust that the developers who signed the packages are in fact trustworthy. Trust that the package manager doesn't contain bugs that could make the verification process moot, or have been compromised otherwise. > Chances are your computer boot loader and most of its applications are signed. By a supposedly trusted entity. I bet you also trust that Intel ME or whatever equivalent your CPU has is not doing anything malicious, or that your BIOS/UEFI system is not working against your interests in any way, right? Have you taken a peek at your browser's trusted CAs? I bet there's scary stuff in there, and you trust them implicitly by using the browser. I'm almost certain you haven't vetted each of those CAs, and even if you did, you're still trusting that they haven't been compromised since then. > But somehow for voting we just trust the pros? Not just for voting, as I have hopefully demonstrated above. > If a normal citizen cannot attest and verify for the trustworthiness of the digital election system As opposed to how it was before? I have some scary stories to tell you about the old school paper ballot counting. > you can't really blame the people who are calling it a sham. I'm not blaming anyone for anything. Just pointing out that in my opinion it's wildly exagerated, and trying to demonstrate why that's how I think. > "Don't question. Just trust the authorities" is a scar of a time where such things would put you in jail. That's not me, I guarantee you that - and I will point out that it's again prejudiced of you to assume so. > The idea that a normal citizen cannot interfere in government affairs My idea actually comes from the opposite point-of-view: that the government serves the "normal citizens". The government cannot be seen as the enemy. They need to be seen as our employees, and the people need to act like such. Yes, that still means we need to push for better public auditing, for better systems, for improvements all around. We absolutely should. After all, they work for us. > Why are you trying to convince me into trusting third parties I'm not. :) > we agree the best solution is to have government release the source code and let anyone audit it That we do! Our difference in opinion seems to be just about how good or bad the current system is.
- irusensei 3y ago
  I don't have a "complex de vira lata". Brazilians are awesome, it's the whole public sphere and its incentives to push down on the population that stinks. :) You are wrong about package trust. It is indeed signed by people but anyone is still able to verify it, even obscure blobs like IME. The same can't be said about the firmware of the voting system audited by a few chosen. Mentioning CAs is a straw since there are degrees of trust. A let's encrypt certificate on acesso.gov.br (I guess in the end they gave up on trying to shove that bogus CA?) just means the host matches the certificate. The contents are malicious. And about where we disagree you trust a set of governmental entities to audit the government while I find the idea preposterous.

cassianoleal 3y ago

> By sphere of influence I mean payroll and permission to operate. But that's te thing, everyone and every organisation needs permission from the government to operate. Even you as an individual do. You have to pay taxes, you have to abide by rules and regulations, you are not allowed to purchase or operate certain substances or equipment unless you have the proper permits etc. In terms of payroll, unless you mean that every single individual in every organisation that's in the committee are somehow being paid by the electoral court, I don't understand your point. Even in the last elections, when the administration was fiercely attacking the whole process, the auditors still came out with a positive analysis of the system. If the government had that much power over them, how come the committee didn't side with the government? > You don't seem to understand how problematic is this idea that there are groups of people who are guaranteed to have the populations best interest in mind. I don't think they're guaranteed to have the best interest of the population. I'm of the opinion that they have a very broad set of points of view, some widely opposed to others, and they still all come out with overall positive analyses of the system. There are proper technical people doing those analyses, and they're just regular people. They could be myself, or yourself. Which is, again, the point I was making about actually knowing someone, a regular individual, who has been part of the committee. > you shouldn't expect everyone doing the same. I don't. I don't expect anything from anyone. You're free to trust or distrust whomever you like. > I am brazilian and have lived over there for a long time. This doesn't shield you from being prejudiced against Brazilians. Surely you've heard the phrase "complexo de vira-lata" (loosely translated, for the foreign audience, "stray dog complex"). Your comment was: That's a very classic brazilian response This is prejudiced. Not only you completely misinterpreted my thoughts, but you then proceeded to attribute your interpretation of them to the fact that I belong to a certain group of people. > I'm guessing you are too so you are familiar with the term "carteirada" Surely am. That's usually when individuals use their position to get around limitations that apply to most people, as if they belong to a superior caste. I don't see how that's related to the voting autit committee. > I verify signatures for every important software I download. Do you verify the entire chain? Or do you trust someone to attest validity of keys at some point? > You on the other hand is condescending Fair point, apologies for the snark. > Even if I don't there are tools doing this for me like package managers. Which again are based on trust. Trust that the developers who signed the packages are in fact trustworthy. Trust that the package manager doesn't contain bugs that could make the verification process moot, or have been compromised otherwise. > Chances are your computer boot loader and most of its applications are signed. By a supposedly trusted entity. I bet you also trust that Intel ME or whatever equivalent your CPU has is not doing anything malicious, or that your BIOS/UEFI system is not working against your interests in any way, right? Have you taken a peek at your browser's trusted CAs? I bet there's scary stuff in there, and you trust them implicitly by using the browser. I'm almost certain you haven't vetted each of those CAs, and even if you did, you're still trusting that they haven't been compromised since then. > But somehow for voting we just trust the pros? Not just for voting, as I have hopefully demonstrated above. > If a normal citizen cannot attest and verify for the trustworthiness of the digital election system As opposed to how it was before? I have some scary stories to tell you about the old school paper ballot counting. > you can't really blame the people who are calling it a sham. I'm not blaming anyone for anything. Just pointing out that in my opinion it's wildly exagerated, and trying to demonstrate why that's how I think. > "Don't question. Just trust the authorities" is a scar of a time where such things would put you in jail. That's not me, I guarantee you that - and I will point out that it's again prejudiced of you to assume so. > The idea that a normal citizen cannot interfere in government affairs My idea actually comes from the opposite point-of-view: that the government serves the "normal citizens". The government cannot be seen as the enemy. They need to be seen as our employees, and the people need to act like such. Yes, that still means we need to push for better public auditing, for better systems, for improvements all around. We absolutely should. After all, they work for us. > Why are you trying to convince me into trusting third parties I'm not. :) > we agree the best solution is to have government release the source code and let anyone audit it That we do! Our difference in opinion seems to be just about how good or bad the current system is.

irusensei 3y ago
I don't have a "complex de vira lata". Brazilians are awesome, it's the whole public sphere and its incentives to push down on the population that stinks. :) You are wrong about package trust. It is indeed signed by people but anyone is still able to verify it, even obscure blobs like IME. The same can't be said about the firmware of the voting system audited by a few chosen. Mentioning CAs is a straw since there are degrees of trust. A let's encrypt certificate on acesso.gov.br (I guess in the end they gave up on trying to shove that bogus CA?) just means the host matches the certificate. The contents are malicious. And about where we disagree you trust a set of governmental entities to audit the government while I find the idea preposterous.