6 ms·

As anything the EFF writes, this article is heavily biased. There is a huge difference between "technologists fixing a voting system" and "technologists irrespo

by mahouse 11y ago

As anything the EFF writes, this article is heavily biased. There is a huge difference between "technologists fixing a voting system" and "technologists irresponsibly leaking the source code and private certs of a voting system"

frandroid 11y ago
Wow, advocacy organization that supports freedom of speech and democracy writes about freedom of speech and proper use of electoral systems. I am shocked, I tell you, shocked.
wslh 11y ago
That's true but the local government and the company were terrible in how they handled the issues. Even the University of Buenos Aires who did the security review couldn't find basic issues.
- llazzaro 11y ago
  UBA did not review the security. however the security issues were so obvious that it seems strange that they say nothing
  - flebron 11y ago
    Unfortunately they did. You can see the request for review here[1], and the actual review here[2]. I know the guy who actually did it (Righetti), he sent an email to the department a few days ago. The quality of that review was absolutely terrible. [1] https://www.eleccionesciudad.gob.ar/uploads/resoluciones/adenda%20OAT.pdf https://www.eleccionesciudad.gob.ar/uploads/resoluciones/ade... [2] https://www.eleccionesciudad.gob.ar/uploads/OAT%20n%203-15-06012015204749.pdf https://www.eleccionesciudad.gob.ar/uploads/OAT%20n%203-15-0...
    - deleted 11y ago
      [deleted]
    - Fargren 11y ago
      I know the professor who did the review. He sent a mail explaining what actually happened, as opposed to what is shown by the mayor's website. The actual report will not be finished until August, so whatever you are seeing is not the complete report. What you are seeing is a preliminary result concerning a specific part of the system. Unfortunately, even after the actual report si finished, the university will not have permission to make it public. So we may never see the real results.
      - flebron 11y ago
        The report is signed by him, so it's safe to say that report is an accurate recollection of what happened according to him. Having a report on the security of a system be issued months _after_ it is used is completely stupid. This is not simply his fault, it's the entire arrangement which is stupid. The report shows that Righetti had access to the source code. Unless you are trying to say that he did not have access to the files in which _actual_ security vulnerabilities were found, or that the source code he was given was _different_ from the source code which was leaked, which contained egregious vulnerabilities. Keep in mind he pockets hundreds of thousands of dollars in this arrangement. That's the part that adds insult to injury. Further, he does not teach information security or anything similar at university (he teaches networking), when there _are_ people teaching such things at UBA (FCEyN), who would have been better suited for the task.
eis 11y ago
I don't agree with publishing the private certs but if anything ever ought to be open source, then it's a public voting system. If we can't have complete transparency and confidence in voting systems we might as well just give up.
demian 11y ago
I don't agree about publishing the certs, but that's not the main issue. The main issue was a security flaw that allowed somebody to directly download the SSL certs of the voting system from an URL.
emergentcypher 11y ago
Irresponsibly? If this vulnerability exists to download the certs, it should be assumed that somebody else has already downloaded them. Thus, it should be assumed that the voting system is already compromised. Its use should be immediately halted. Voting systems are sacrosanct.
harry8 11y ago
Covering up the ability to manipulate an election is irresponsible. Disclosing an election can be rigged with all the supporting evidence is your absolute duty. Doing anything else is not just irresponsbile, it's morally evil. Covering it up by not disclosing is the action of someone who is LITERALLY an enemy of democracy and freedom.

by mahouse 11y ago

frandroid 11y ago

Wow, advocacy organization that supports freedom of speech and democracy writes about freedom of speech and proper use of electoral systems. I am shocked, I tell you, shocked.

wslh 11y ago

That's true but the local government and the company were terrible in how they handled the issues. Even the University of Buenos Aires who did the security review couldn't find basic issues.

llazzaro 11y ago
UBA did not review the security. however the security issues were so obvious that it seems strange that they say nothing
- flebron 11y ago
  Unfortunately they did. You can see the request for review here[1], and the actual review here[2]. I know the guy who actually did it (Righetti), he sent an email to the department a few days ago. The quality of that review was absolutely terrible. [1] https://www.eleccionesciudad.gob.ar/uploads/resoluciones/adenda%20OAT.pdf https://www.eleccionesciudad.gob.ar/uploads/resoluciones/ade... [2] https://www.eleccionesciudad.gob.ar/uploads/OAT%20n%203-15-06012015204749.pdf https://www.eleccionesciudad.gob.ar/uploads/OAT%20n%203-15-0...
  - deleted 11y ago
    [deleted]
  - Fargren 11y ago
    I know the professor who did the review. He sent a mail explaining what actually happened, as opposed to what is shown by the mayor's website. The actual report will not be finished until August, so whatever you are seeing is not the complete report. What you are seeing is a preliminary result concerning a specific part of the system. Unfortunately, even after the actual report si finished, the university will not have permission to make it public. So we may never see the real results.
    - flebron 11y ago
      The report is signed by him, so it's safe to say that report is an accurate recollection of what happened according to him. Having a report on the security of a system be issued months _after_ it is used is completely stupid. This is not simply his fault, it's the entire arrangement which is stupid. The report shows that Righetti had access to the source code. Unless you are trying to say that he did not have access to the files in which _actual_ security vulnerabilities were found, or that the source code he was given was _different_ from the source code which was leaked, which contained egregious vulnerabilities. Keep in mind he pockets hundreds of thousands of dollars in this arrangement. That's the part that adds insult to injury. Further, he does not teach information security or anything similar at university (he teaches networking), when there _are_ people teaching such things at UBA (FCEyN), who would have been better suited for the task.

eis 11y ago

I don't agree with publishing the private certs but if anything ever ought to be open source, then it's a public voting system. If we can't have complete transparency and confidence in voting systems we might as well just give up.

demian 11y ago

I don't agree about publishing the certs, but that's not the main issue. The main issue was a security flaw that allowed somebody to directly download the SSL certs of the voting system from an URL.

emergentcypher 11y ago

Irresponsibly? If this vulnerability exists to download the certs, it should be assumed that somebody else has already downloaded them. Thus, it should be assumed that the voting system is already compromised. Its use should be immediately halted. Voting systems are sacrosanct.

harry8 11y ago

Covering up the ability to manipulate an election is irresponsible. Disclosing an election can be rigged with all the supporting evidence is your absolute duty. Doing anything else is not just irresponsbile, it's morally evil. Covering it up by not disclosing is the action of someone who is LITERALLY an enemy of democracy and freedom.