4 ms·

As a software developer myself, if an "independent expert" comes out and says that some software system is fully verified, I might trust their allegiance, but I

As a software developer myself, if an "independent expert" comes out and says that some software system is fully verified, I might trust their allegiance, but I probably won't trust their competence. I wouldn't expect the general population to trust them either.

eru 2y ago
What if lots of experts come out that way, including people you already trust otherwise? Eg assume both Bill Gates and Linus Torvalds etc say they have reviewed the code?
- maxdamantus 2y ago
  Then I would ask why the system they're reviewing is different to any other which is meant to be guaranteed-secure (or check that others are asking those questions). We're told every year or so about some SecureBoot vulnerability, which presumably involves code that has been reviewed. The system doesn't only include the code directly related to voting. It also includes OSes and everything involved in the infrastructure for hosting and communication (the Belenios system in particular involves sending private keys by email, and we're also relying on end user systems being uncompromised (who here likes browser extensions?)). It's not feasible to claim that such a system is secure from a remotely controlled attack (eg, by a lone external actor). Most of the attack scenarios against an offline voting system are ones that the general population can at least reason about, and they probably involve multiple insiders that would face a serious risk of being ratted out by one another.
  - eru 2y ago
    See https://news.ycombinator.com/item?id=41158861 https://news.ycombinator.com/item?id=41158861 Sending private keys (by mail or any other way) does sound bad, so the specific system mentioned in the article might not be worth bothering with.
- atoav 2y ago
  If we assume that: - how do you know the code running on these machines on day X is actually the code they tested? - how do you know the code running does the same thing the code they tested does, even if it is the same code (e.g. hardware instructions could be doing different things on the machine, the OS could provide different functionality, other programs could interfere)? - how do you (and for that matter: every single voter) know their vote was counted towards the correct candidates in the whole process towards the end results, which likely involves transmitting data through the internet and/or people carrying USB thumb drives and sticking them into computers I am not saying it can't be done, but I say you can tell appart who knows computers really well (hackers) from those who know it kinda (geeks), by how doable they think this is.
  - baobabKoodaa 2y ago
    The voting system you described is not a verifiable voting system. If you have a verifiable voting system, you don't need to know what code is running on the election machines. That's the whole point of having a verifiable voting system. You asked "how do you know your vote was counted". You can google for examples of how this works in verifiable voting systems.
    - j16sdiz 2y ago
      In a verifiable voting system, voter usually get a recipe that he can verify, in later time, their vote have been counted. But what stop same recipe is handed out twice? Do you do transparent log? Second system to audit those? How general voters are supposed to understand this? Just pick a voting station with lower computer literacy, and you can do whatever you want ..
      - eru 2y ago
        > But what stop same recipe is handed out twice? Cryptography. Your receipt is presumably only valid for yourself. So if you got someone else's receipt, it wouldn't be valid for you. I support paper voting for political elections for most of the reasons you mentioned, but I don't think that automatically makes all arguments for paper voting good and valid, and all arguments for alternative voting systems null and void. And even if political elections are better done on paper, there's plenty of other elections (eg in companies and clubs etc) with different requirements and threats, and they might benefit from the research and experimentation.
- j16sdiz 2y ago
  Reviewed the code -- but did they inspect the machine? Check the network for reliability? Review the crypto for replayability? RNG that's is actually random? How many expert do we need? Do we need cross-domain experts to check if any domain experts missing anything between the gaps? For paper voting, it is literally just check the box is empty before voting and nobody get near the box unexpectedly
  - eru 2y ago
    > For paper voting, it is literally just check the box is empty before voting and nobody get near the box unexpectedly That depends on how complicated your voting system is. Have a look at the complications they have in Australia..

eru 2y ago

What if lots of experts come out that way, including people you already trust otherwise? Eg assume both Bill Gates and Linus Torvalds etc say they have reviewed the code?

maxdamantus 2y ago
Then I would ask why the system they're reviewing is different to any other which is meant to be guaranteed-secure (or check that others are asking those questions). We're told every year or so about some SecureBoot vulnerability, which presumably involves code that has been reviewed. The system doesn't only include the code directly related to voting. It also includes OSes and everything involved in the infrastructure for hosting and communication (the Belenios system in particular involves sending private keys by email, and we're also relying on end user systems being uncompromised (who here likes browser extensions?)). It's not feasible to claim that such a system is secure from a remotely controlled attack (eg, by a lone external actor). Most of the attack scenarios against an offline voting system are ones that the general population can at least reason about, and they probably involve multiple insiders that would face a serious risk of being ratted out by one another.
- eru 2y ago
  See https://news.ycombinator.com/item?id=41158861 https://news.ycombinator.com/item?id=41158861 Sending private keys (by mail or any other way) does sound bad, so the specific system mentioned in the article might not be worth bothering with.
atoav 2y ago
If we assume that: - how do you know the code running on these machines on day X is actually the code they tested? - how do you know the code running does the same thing the code they tested does, even if it is the same code (e.g. hardware instructions could be doing different things on the machine, the OS could provide different functionality, other programs could interfere)? - how do you (and for that matter: every single voter) know their vote was counted towards the correct candidates in the whole process towards the end results, which likely involves transmitting data through the internet and/or people carrying USB thumb drives and sticking them into computers I am not saying it can't be done, but I say you can tell appart who knows computers really well (hackers) from those who know it kinda (geeks), by how doable they think this is.
- baobabKoodaa 2y ago
  The voting system you described is not a verifiable voting system. If you have a verifiable voting system, you don't need to know what code is running on the election machines. That's the whole point of having a verifiable voting system. You asked "how do you know your vote was counted". You can google for examples of how this works in verifiable voting systems.
  - j16sdiz 2y ago
    In a verifiable voting system, voter usually get a recipe that he can verify, in later time, their vote have been counted. But what stop same recipe is handed out twice? Do you do transparent log? Second system to audit those? How general voters are supposed to understand this? Just pick a voting station with lower computer literacy, and you can do whatever you want ..
    - eru 2y ago
      > But what stop same recipe is handed out twice? Cryptography. Your receipt is presumably only valid for yourself. So if you got someone else's receipt, it wouldn't be valid for you. I support paper voting for political elections for most of the reasons you mentioned, but I don't think that automatically makes all arguments for paper voting good and valid, and all arguments for alternative voting systems null and void. And even if political elections are better done on paper, there's plenty of other elections (eg in companies and clubs etc) with different requirements and threats, and they might benefit from the research and experimentation.
j16sdiz 2y ago
Reviewed the code -- but did they inspect the machine? Check the network for reliability? Review the crypto for replayability? RNG that's is actually random? How many expert do we need? Do we need cross-domain experts to check if any domain experts missing anything between the gaps? For paper voting, it is literally just check the box is empty before voting and nobody get near the box unexpectedly
- eru 2y ago
  > For paper voting, it is literally just check the box is empty before voting and nobody get near the box unexpectedly That depends on how complicated your voting system is. Have a look at the complications they have in Australia..