3 ms·

> The build system links unaudited libraries downloaded off the network. How do you know this? I thought it was all inauditable! Also, what does it matter if "

> The build system links unaudited libraries downloaded off the network. How do you know this? I thought it was all inauditable! Also, what does it matter if "the build system links" whatever libraries, if said libraries are not used by the program? Or do you admit that the source code would in fact show that usage? If it's the latter, then I suspect the answer to your very first question should be obvious. > I will not be satisfied until they release all the signed binaries that ran on the machines on election day for the whole world to see. Good stuff! Neither you nor I should be satisfied! Note: As for the rest of what you wrote, I won't engage. I've already seen plenty of your behaviour on this website and it's mostly of the "enraged Facebook/WhatsApp uncle" / "old man shouts at clouds" / "someone is wrong on the Internet" type. If you'd like to discuss more of the above, in objective terms or subjective but civil, I'm happy to do so. Otherwise this is my last comment on this branch of the comment tree.

matheusmoreira 3y ago
> How do you know this? It says so on the military's audit report. They observed network connections during the compilation of the voting machine software. Software libraries that have not been audited are downloaded and linked. > I thought it was all inauditable! I never said that. I only ever claimed the audits were insufficient. Especially TSE's limited "pen and paper" audits. I even gave you an example of an audit I personally would deem sufficient. > Also, what does it matter if "the build system links" whatever libraries, if said libraries are not used by the program? If you link malicious code to your binary, it's pretty much game over. Of course it matters. Are you saying the libraries aren't linked to the voting machine program? How do you know that? > Or do you admit that the source code would in fact show that usage? I admit nothing of the sort. I state that it's precisely the opposite. You can have perfectly good source code and still end up with a malicious result. Earliest example of such a thing is of course the famous text Reflections on Trusting Trust. More recently, there are numerous examples open source software libraries with malicious code shipped to package managers like npm and pypi. Supply chain attacks that have compromised people from this very site. One of the reasons reproducible builds exist is to mitigate exactly that attack, it works by establishing cryptographic relation between the compiled binary and the source code used to build it. > I've already seen plenty of your behaviour on this website and it's mostly of the "enraged Facebook/WhatsApp uncle" / "old man shouts at clouds" / "someone is wrong on the Internet" type. Look who's prejudiced now. If you don't want to reply to me because you don't like me or what I think, I'm okay with that. It's not acceptable for you to paint me as some unthinking moron though. Perhaps I came across as "uncivil" in my words because of my disgust for the status quo but I never did anything of the sort to you. My hatred is reserved for the brazilian institutions which I perceive as total failures. So either refute what I said or leave it be but don't accuse me of being some "enraged WhatsApp uncle".

matheusmoreira 3y ago

> How do you know this? It says so on the military's audit report. They observed network connections during the compilation of the voting machine software. Software libraries that have not been audited are downloaded and linked. > I thought it was all inauditable! I never said that. I only ever claimed the audits were insufficient. Especially TSE's limited "pen and paper" audits. I even gave you an example of an audit I personally would deem sufficient. > Also, what does it matter if "the build system links" whatever libraries, if said libraries are not used by the program? If you link malicious code to your binary, it's pretty much game over. Of course it matters. Are you saying the libraries aren't linked to the voting machine program? How do you know that? > Or do you admit that the source code would in fact show that usage? I admit nothing of the sort. I state that it's precisely the opposite. You can have perfectly good source code and still end up with a malicious result. Earliest example of such a thing is of course the famous text Reflections on Trusting Trust. More recently, there are numerous examples open source software libraries with malicious code shipped to package managers like npm and pypi. Supply chain attacks that have compromised people from this very site. One of the reasons reproducible builds exist is to mitigate exactly that attack, it works by establishing cryptographic relation between the compiled binary and the source code used to build it. > I've already seen plenty of your behaviour on this website and it's mostly of the "enraged Facebook/WhatsApp uncle" / "old man shouts at clouds" / "someone is wrong on the Internet" type. Look who's prejudiced now. If you don't want to reply to me because you don't like me or what I think, I'm okay with that. It's not acceptable for you to paint me as some unthinking moron though. Perhaps I came across as "uncivil" in my words because of my disgust for the status quo but I never did anything of the sort to you. My hatred is reserved for the brazilian institutions which I perceive as total failures. So either refute what I said or leave it be but don't accuse me of being some "enraged WhatsApp uncle".