Slashdot Mirror
More E-Voting Software Leaks Surface
Christopher Soghoian writes "Sound like something you've seen before? Wired News reports that the software which runs Sequoia's AVC Edge voting machines has been accidentally placed on another company's publicly available FTP server, although this time it's the binary, rather than the source that's been leaked. Machines running this software were used in California's Riverside County for the 2000 presidential election and for last month's California gubernatorial recall election. The system also has been used in counties in Florida and Washington state."
I dont know a whole lot about cyrpto, but if its a big deal if a binary got leaked, perhaps the software isn't that secure to begin with. We all know security through obscurity doesn't work.
Selling software wont make you money, selling a service will.
How do you "accidentally" put software on a public FTP server ... this is ridiculous. Makes me glad to not be an American :)
This sentence no verb
This wouldnt be a problem if they used OSS to vote. The problems could be caught and fixed before a vote...and nobody has to keep the info secure.
Bottles.
If these systems were really secure, then finding out the code shouldn't be important. Just because I know the RSA 128-bit algorithem, doesn't mean that I can break it in a second!
Also, why isn't the federal government coming out with a standard software framework for voting?
This seems obvious to me, at least.
Not that I trust my government to be the best coders, but heck... get the DOD on it. They are pretty good at these problem domains.
Maybe they'd run it off of source forge....
-hampton2600.
"I don't want to start a holy war here..."
They seem to have added a hasty requirement for a password (and its been configured! admin/admin isnt getting in). Anyone cracked an account or have a mirror of the binary?
When life gives you crap, Make Crapade.
Sluggy Freelance.
I was reading the headline and I thought I read it as "ubernatorial election", made me ponder for a moment.
Yeah, because if the federal government does it, it is efficient, reliable, and effective.
...but I lack the prehensile tail.
(sigh)
from the article
Neumann, the security expert, said, "This means that anyone could install a Trojan horse in the MDAC that won't show up in the source code." Jaguar employees, Sequoia employees or state election officials could insert code that wouldn't be detectable in a certification review of the code or in security testing of the system, he said.
Now all we need to do is write a trojan to get Tux elected president!!
Karma -2 (Not Funny)
I think that no matter how many assurances there are (and there aren't a whole lot right now) we're never going to be able to take care of lingering doubts about the security and fairness of e-voting.
Right now, voting software is obviously not ready for primetime and the companies that make it need to have some sort of oversight committee making sure they're not playing games or royally fucking things up.
There was enough of a commotion in FLA about hanging chads that people's confidence in machines are shot. And those are relatively simple compared to secure e-voting software!
It seems that the more we try to "high-tech" the voting process, the more problems and uncertainty we will introduce into the system.
So, right now I'm leaning towards a really low tech solution: simple paper and pen for ballots.
I know I'm a geek and supposed to love technological solutions. And I do, but with something as important as voting, until they get it to be as reliable as pen and paper, I say screw the machines because as a geek, I also know how unreliable software can be.
Humorless sig goes here.
A file was placed in the wild and if hackers got hold of it and figured out ways to alter the results it would be a bad thing.
And this would be better with an Open Source solution?
Let's see, the software is written on a Microsoft base, is closed source and... shudder... appears to be prone to tampering. Just like Diebold and I would imagine every other vendor's software.
We need to get the source in the open, and more importantly, we need to have these machines give paper ballot reciepts as well as an internal audit tape like those found on ATMs...
There is a bill in the House (H.R. 2239) that already has a lot of support and addresses a lot of these issues. Please urge your representative to support it as well.
Never quite understood why someone can't get the source code from the resulting binary file, it's not even logical... Or am I missing something here ?
( RTFMers shall be impaled and BBQ'ed )
United States of America, good ol' backers of world peace.
Don't worry. The impact on you foriegners is expected to be negligible, it only affects who helms our foriegn policy and is trusted with the nuclear weapons.
:).
Sleep tight
and for last month's California gubernatorial recall election
more like 'Rise of the eVoting Machines'.
> Also, why isn't the federal government coming out with a standard software framework for voting? ... get the DOD on it.
Yeah, have the military run the elections. Great idea...NOT.
Earlier today I posted the lists.tgz archive of Diebold's damning mailing list exchange to Freenet, as has been requested repeatedly in threads related to the electronic voting issue.
L d0 68BtICKg/lists.tgz
The key is:
CHK@sgOjWAy4g-0bf0m5biyqnEzWloENAwI,OXw8OfHPfsm
If I can obtain the AVC Edge binary, I will do the same with it.
Let loose the DMCA notices, boys. It won't do you a damned bit of good now.
can be found here: http://www.programmersheaven.com/zone1/cat252/1308 3.htm
:)
I guess in 2 days we'll know who really won the California recall vote.
there's no place like ~
on this subjeckt
Geminatron
Anyone else notice the over-use of the word Trojan in the article. It's almost used as a buz word. The article read like the writer, "security expert", and h4x0R had no real idea of what they were talking about.
Sounds like some kid found an open FTP an put the spoils on kazaa, that's all.
Underwhelmed and still to lazy to register,
Frank
Just look at Schwarzenegger's past statements about Adolf Hitler.
I'll probably embarrass myself even more by my answer, but here goes.
:) I'm sure 50 other Slashdotters will expand/correct/make fun of me, but I figure since no one else is answering, I'll take a stab at it.
You can often get a fair bit of source from a binary, but it all depends on what language the source was originally from, what platform it was written for, etc.
More importantly (as I understand it) is how it was compiled, etc. Source code isn't just translated line by line into machine code. Especially with today's optimizing compilers, there's a lot of automagic going on.
Now, you usually can get the assembler directives out of a binary (ahh, disassemblers are fun), but even this is dicey. I know from playing around with Atari 2600 roms that often you can't know precisely what parts of the code do what, iirc because code and data were often intermixed in irregular ways. Even if you get the full assembly code, have fun reading it if it's more than a few thousand lines.
Having said that, there's a lot of incredible stuff a skilled person can do with disassemblers, but it all comes down to the source->machine code translation. There's a lot of factors that come into play here, and it's not just a simple inversion of some always used process.
There, can I be less specific?
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Vote Buying.
Every time someone suggests Ballot Receipts, I wonder whether they don't understand the concept of "free and fair elections", or just don't want them to happen.
Here's a hint: "secret ballot". It's one of the key concepts of democracy.
They'd be cheaper, faster, easier to use, better looking and would work infinitely better. Think different, think better, think Apple.
Vote by slashdot poll! Ah always wahnted tuh see cowboah neal in governimint
This sentence no verb
To go from, say, a C language file to an exe, .c),
the compiler first loads the C file (ending in
and all the files it refers to,
and then parses all of it into an internal
structure.
this structure is then optimized:
loops are unrolled, functions are inlined,
and info that is mention but isn't needed
is stripped out.
the resulting structure is then
written out as a series of assembly
instructions, which are then
converted to the numeric codes
the processor understands.
this is the exe.
to go backwards, it's (generally)
trivial to take an exe and get a
plaintext file containing the assembly
instructions (this file usually ends in '.a')
it's the optimization step that causes
issues: one of the main things the computer
doesn't need which is stripped out is
variable names, comments, etc.
without them, there's no context.
you can figure out the algorithm from the assembly,
but you can't easily figure out what
it's operating on.
to make things worse, other optimizations
may alter the code for faster execution,
making it even harder to figure out.
Occasionally, mistakes are made...
Microsoft slipped up a while back,
and released a windows patch which had
the 'debugging info' left in it.
All this really amounts to is the variable
names, function names, etc...
which is bloody useful.
Making this process even worse is that
some (rare) executeables are self modifying,
which makes them MUCH harder to predict.
in summary, it's not that hard to get
back to C code, assuming the program
was even written in C. You'd just have
variable names like 'var0001', 'var0002'
'func0001', etc.
It's basically the difference between
having a nice nested tree structure
which you can compartmentalize and analyze,
versus one long list of instructions,
which the computer may start and stop
execution of at any point.. sorta like DNA.
Here in Brazil, were we have had last year the largest elections using proprietary-software-equiped-polls, it seens that there have been more than a
couple of frauds last year.
The latest news are these ones (In Portuguese. Use
the fish to read in English).
There have surfaced accuatins of votings being sold at R$10,00 (~U$3.30) each one, and of a candidate that had more than 1000 votes while they were being counted ending up with zero votes.
I just hope they get to the only one true: these eletronic polls, as they are, are nothing but election-buying machinnes.
-><- no
Embrace the wu-wei
Do not un-BIND your RH 6.2,
Leave it it it's natural state
for it is in acting through inactio...
what's this letter from my ISP about a bank in Bolivia?
As I've said before, the agencies responsible for buying this equipment and software should bear a good deal of the blame for anything that goes wrong. It seems to me that some gross negligance or incompetence is going on here. If the government was hiring a private company to do security related work, you bet that they would have standard procedures set out, vetting, interviews, background checks etc. by people who are actually familiar with the security area. Yes I know it doesn't always work, but they give it a decent shot and show a degree of competence. If a problem with security clearances of this magnitude came to public light, you'd bet that they would be announcements of an "inquiry". However as soon as it comes to "computer stuff" it seems like government agencies suddenly try to express how incompetent they really are. A lot of the weaknesses in this software should be blatently obvious by an audit by a computer security professional. As it is the articles I've read suggest that they only audited the source code the companies themselves wrote rather than the whole program ('hey wait a minute what's all this MS stuff? We need to audit this whole thing you know'), only audited for reliability rather than security and didn't even take the audits seriously anyway. It increasingly seems like they made a token gesture at an audit and them simply trusted the companies' word on the matter. And now that things like this are coming to light they are burying their heads in the sand. Sure they are unlikely to be tech experts but can't they just apply the basic principles of security clearances and audits to this software? And surely being 'experts' on managing elections they should realise the importance of a paper trail, since they must be familiar with all the stuff that goes wrong in elections that most of us never hear about? I mean what is about "computers" that suddenly make government employees act like incompetent idiots? They seem to be able to act at least somewhat competent in non-computer areas, but suddenly stick some technology in and it's like they suddenly don't know what to do and any previous expertise they had in the field eg. managing elections suddenly disappears into thin air.
Yeah, because if the federal government does it, it is efficient, reliable, and effective.
Blah blah -- the government boondoggle meme strikes again. Yes, it has its roots in some truths, and that's why it exists. But...
The problem is, there are in fact examples of government programs and agencies working and working well. Our, poor, terribly innefficient government programs are responsible for creating the world's best military. My locality might be an exception, but we've got incredible public library resources that I'm so happy with I'm *glad* when I get library fines. The Interstate Highway system makes cross country travel effecient and quick -- which keeps the cost of goods lower -- at least, those you buy that were shipped from somewhere else.
Yep -- I know, private firms were involved in the creation of each of those things. Doesn't change the fact that some branch of our poor, incapable, incompetent government commissioned and managed those projects.
And yes, I know -- the DMV is frustrating to deal with. But I can tell you that the service of the DMV and even the IRS looks positively stellar compared to any number of private entitities -- several health insurance companies, Sprint, Microsoft Customer support, and the hosting company I called last week (no, not some dinky provider either -- I'm talking freakin' Interland here). All of whom should have, in theory, been erased by the invisible hand or otherwise kicked in the pants by the market. But in fact, these beaurocracies are no better than most mediocre government beaurocracies.
So it's fun to repeat, but remember to look at the facts while you're thinking about it. Our beloved commercial driven-to-efficiency-by-the-market companies have produced an absolute steaming heap of bovine excrement when it comes to an e-voting product. And yes, it's still taxpayer subsidized, because our governments are paying for these products -- and not just the costs, but also the profits.
Libertarianism is rich wolves and poor sheep playing gambler's ruin for dinner.
president_choice_for(VOTER_NUMBER,'Bush')
NO SIG
This story is yet another crack in the armor (paper machete) of the new age of voting. The trouble is that the people trying to usher in the new age of voting are forgetting that the new age has ignorance, corruption, greed and hidden agendas as the standing guard. Not to mention the bystanders of activists, the Just and the uninformed held on the sidelines by a velvet rope called lack of media interest.
Who is to say that despite the binary or non binary...whatever.. that this leak was done just to undermine the credibility of the new system(s). Seems to me that in this case the ends justify the means because not only am I questioning them, I'm also starting to wonder if having a central authoriy in place would not be a great idea after all.
But who do we trust now? We can't trust the voters, can't trust Chad, and now it seems as though we can't trust the election system at all.
Let's keep in mind that patents are in place to keep lawyers employed and keep them litigating. -CatGrep
Think about it: The USA has a president who got in after a series of shenanigans through the courts. Never mind counting the votes.
With this "black-box" technology, the option to count the votes is not even there. There is no way to publically check the output from these machines to verify concordance with the voters' wishes.
We have no recourse against an electoral candidate who has found a means to subvert these devices to their own ends, and given the unscrupulousness of (probably the majority of) politicians, sooner or later that's going to happen.
The company was NOT a USA company
Tech Public Policy stuff
So, it seems like states will use just about anything someone puts in front of them. I'm going to write my own voting software called iVictory. Then, because it has the "i" in front of it, state legislators will think it's as good as their pretty white music devices, and totally use it. Once my diabolical software is in place, I will run for office.
I will then go on to become supreme ruler of the universe.
Need Free Juniper/NetScreen Support? JuniperForum
I asked him: "Since you make money on your hardware what's the problem with open sourcing your software?" He hemed and hawed but then said: "Our programmers are not good enough that we want to let the world see our code!"
I got a little irate and said: "Well its our votes getting counted." He then said: "Well there is something else. Its running on Win98 and we can't fix those security holes!"
At that point I told him: "I think I prefer hanging chad."
This is from Lynn Landes ecotalk.org... I am sure she won't mind.
SEQUOIA VOTING SYSTEMS INC. http://www.sequoiavote.com
Article - August 4, 2003 - Sequoia Voting Systems, a pioneer in direct recording electronic voting systems and a leading provider of voting equipment and services in the United States, will partner with VoteHere, Inc. of Bellevue, Washington, a leading supplier of secure electronic voting technology, to provide a new level of electronic ballot verification to customers of the AVC Edge touch screen voting system. http://www.votehere.net/news/archive03/080403.htm
? % of U.S. vote count: According to its website, Sequoia technicians "managed thousands of electronic elections for 14 years in 16 states." http://www.sequoiavote.com/aboutSequoia.php
Company description: Full service. "Through its nationwide network of offices, Sequoia has equipped and supported elections in thousands of jurisdictions - with populations ranging from a few hundred voters to over three million." http://www.sequoiavote.com/aboutSequoia.php
Ownership: 85% De La Rue www.delarue.com 15% Jefferson Smurfit Group http://www.smurfit.ie/ / source: http://moneyextra.uk-wire.com/cgi-bin/articles/200 205290701145655W.html
"De La Rue (London, UK) is the world 's largest commercial security printer and papermaker, involved in the production of over 150 national currencies and a wide range of security documents such as travellers cheques and vouchers. Employing almost 7,000 people across 31 countries, the company is also a leading provider of cash handling equipment and software solutions to banks and retailers worldwide helping them to reduce the cost of handling cash. We are also pioneering new technologies including tailored solutions to protect the world 's brands through to government identity solutions in secure passports, identity cards and driver 's licences. De La Rue has a 20% shareholding in Camelot - the operator of the UK National Lottery." source: http://www.delarue.com/about/ http://moneyextra.uk-wire.com/cgi-bin/articles/200 205290701145655W.html
"The Jefferson Smurfit Group... (Ireland) is one of the largest European-based manufacturers of containerboard, corrugated containers and other paper-based packaging products. In addition to wholly owned operations, the Group has interests in several associated companies, the principal of which is Smurfit-Stone Container Corporation (SSCC). Spanning 4 continents and 30 countries, JSG and its associates employ some 68,000 people and are significant players in Europe, Latin America and North America." source: http://www.smurfit.ie/ (see below for Madison Dearborn Partners buy out information)
Chicago-based Madison Dearborn Partners has received antitrust approval from the Federal Trade Commission for its proposed acquisition of Jefferson Smurfit Group PLC..http://stlouis.bizjournals.com/stlouis/storie s/2002/07/15/daily68.html Madison Dearborn Partners ("one of the largest and most experienced private equity investment firms, lots of communication stuff - http://www.mdcp.com/portfolio.asp ) has ownership stakes in Milnot Holding Corp. http://www.milnot.com/ and Outsourcing Solutions Inc. http://stlouis.bizjournals.com/stlouis/stories/200 1/05/07/daily28.html in St. Louis. Jefferson Smurfit Corp., the American division of Ireland-based Jefferson Smurfit Group PLC holding company, was based in St. Louis prior to its 1998 merger with Stone Container Corp. The merged company became Smurfit-Stone Container Corp. based in Chicago. Jefferson Smurfit holds about 29.5 percent of Smurfit-Stone. Jefferson Smurfit (NYSE: JS) is one of the largest manufacturers of container board and corrugated containers and recycles wastepaper in about 600 facilities worldwide.
Madison Dearborn Partners: Council Tree Hispanic Investors II, LLC Longmont, Colorado CTHI indirectly owns approximately 18% of Telemundo, one of two Spanish-language broadcasting
[NT]
Why the hell are all these problems cropping up? Voting is simple enough, add one to the vote counter of a candidate/issue, like this:
vote++;
(WARNING: The code above is probably owned by SCO too, so just to be safe, I'm mailing a check for $699 tomorrow morning)
Is this really so hard? I'm working on my own OSS voting program. You can see the early version at herrvinny.com. It supports multiple choice (you can select several options together, or just one option), write in, no choice, etc. Anyone in UW-Madison want to help me test it, let me know.
Anyway, from my experiences writing this program, it doesn't seem so hard. And my program is done in Java, so all you little Java == SUV people out there are just plain wrong, the program works great.
Anyone have a mirror of these files? I'll mirror them myself, and we can play a game of keepaway with Sequoia just like with Diebold.
You would think these guys would disable it after a slashdot posting... They must be busy playing pirated half life 2 demos.
So some government programs work very nicely, while some are a complete mess. How does this make it wrong to question whether putting this in the hands of the government would be a good idea?
Tried it. Didn't work. Anyone else get it?
Java and C# are the easist languages to convert the byte code to source code. Obfuscators work but are easy to break, you get the problem of variable names being: var001, etc (mentioned before).
In fact there are many companies who write Java code who then compile it to byte code then use the decompilars to produce better looking/quality code! It also includes comments. (Source: A professional debugger).
I have the links to the decompiler for C#, it's free and the source code is freely available online. If you are interested just let me know and I can post the URL (it's at work).
that someone out there finds a major hole in the binary and then on voting day, instead of adjusting the polls so that their candidate just wins, adjust it so that its unnaturally high, like three billion to 100. Then national attention will be brought to the insecurities, the code will have to be examined by a whole bunch of people, the election will be delayed and anger many politicians(things happen quick when politicians are angry), and in the best case scenario, open source will be looked at as a viable alternative (the only alternative when dealing with matters such as these). This could be a big win for OS. Just my two cents.
That's quite a relief that it's binary!
c kme
% strings democracy-enforcer.exe | grep http
http://votingHQ/cgi-bin/addvote.cgi?pass=ha
It is ironic that a country like US is struggling to implement Electronic Voting while India which has the second largest population and high illiteracy rate is already using them. In fact they are planning to go all electronic this time. The problem seems to be from that fact that the electronic machines used in india are not fully automated as the ones used here and they are never connected to computers to count the votes
2)Clay tablets take too long to dry. Votes could be changed in the meantime. Pen and paper is better.
3)Pen and paper is too slow to tabulate. We're switching to these cool punch cards.
4)People are apparently too stupid to use punch cards. Long live the touch screen system!
5)These electronic voting boxes can apparently be h4x0r3d by any halfway intelligent three-year-old with a spoon and an old emery board. This system, however, is foolproof...
*pulls out basket full of rocks painted black or white*
Doing my level best to piss off the religious right wing...
It's already in the "hands" of the government. Who picked Diebold?
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I'd be very interested in this software as I live in Riverside County. Anonymous access disabled. If you grabbed it and are willing to send it to me, please send a note to skallest at hotmail dot com Thanks.
Given that ALL militaries are, by definition, owned by the government (except I suppose a handful of mercenary outfits, which simply don't have the resources to design their own fighter jets), that's hardly a compelling argument. Indeed, looking at how much is spent on the military, I think the only lesson to learn there is "even if you've got a horribly inefficient process, if you throw hundreds of billions of dollars at a project, things will get done."
I think your library system is the exception. The library at my university is better than the main branch of the public library in San Francisco, where I grew up. Though the university does have a fair amount of money, it seems unlikely that it's outspending a major US city.
Sure, when you've got a situation like the highway system, where it's simply impossible to establish effective competition, then it is the government's responsibility to step in. But look at how many years it takes to do simple things like demolish on-ramps, and it is easy to see that these are not exactly paragons of efficiency.
I'm sorry, but I have NEVER seen a customer support system worse than the DMV. In San Francisco, there is ONE location, it's only open weekdays, during business hours, and you can't do anything substantive over the phone. When was the last time Microsoft made you take a day off work to drive to the city's "Microsoft Support Center" in order to register your product (or whatever). This is far from isolated, I've called government agencies which simply don't pick up their phones, others pack up and go home a good half an hour before the announced cutoff time for calling (so at 4, rather than 4:30). I am young and healthy enough to not have had substantive dealings with health insurance, but there's no way phone companies are even in the same league as the government institutions I've dealt with.
Now, when it comes to electronic voting, I think the issue is that the wrong people are making the purchases. We, the voters, ought to be the consumers. Diebold et al should have to convince you and me that their voting machines are secure, not some chimp in the local elections office.
"The question of whether a computer can think is no more interesting than that of whether a submarine can swim" -EWD
Ah, but isn't this made easier by the fact that government programs are responsible for the rest of the world's militaries, too?
Jeff
That's right - mod it to five. Nothing insightful about this post, but apparently you get a five if you post more than 3 paragraphs.
Ignorant people treat volume as content. I call it byte-bloat.
Nope, looks like they figured out (on the second try) how to disable anonymous login on an ftp server.
Let's hope this all lands in freenet soon.
Enable 3D printed prosthetics!
I think it's a shame that this software is getting leaked because it throws a significant wrench in the gears of the natural progression of democracy. Although I agree that the paper ballot system works just fine, the bottom line is that computerized voting - if implemented properly - stands to improve elections in terms of accessability of ballots to the electorate, workload for electoral officials and overall cost.
That said, as long as there are elections, there will be people for whom cheating or rigging the results is a very appealing prize. There's a great deal of hand-wringing going on about the leaking of this software, but in the long run, it's not a big deal - the people who run the elections will simply have to come up with some new solution that circumvents the existing problems and, of course, creates new ones.
...Whether my Maker is prepared for the great ordeal of meeting me is another matter.
Churchill
Here's the most recent This Modern World comic by Tom Tomorrow for those of you who are into biting political humor....
-- thinkyhead software and media
lol, yeah that's the one
This sentence no verb
From the features page:
# Proprietary firmware on closed system prevents hacker access
And this couldn't happen in any other way? Security trough obsciourity works perfect in every way, you say?
Not Buzzword 2.0 compliant. Please speak english.
I found a pretty interesting list of the available voting software . At least I thought it was interesting.
Why do we need software to vote? What exactly are the advantages? It is more expensive much less transparent and prone to potentially catastrophic failures and tampering.
SkyNet put it there!
Manipulate the moderator system! Mod someone as "overrated" today.
India has already used EVMs in elections. Last time I heard the entire election in the Kashmir state was done by EVMs with no room for tampering. The technology is simple and effective. Maybe the American government can learn something from the Indians :-)
Maybe I'm over simplifying the issue, but am I the only one that thinks the only way e-voting of any kind is trustworthy is if there is a paper record of the vote?
Why not use an E-Voting machine to generate a paper ballot of some sort that could be read by scanners? More or less like a punch card ballot, but generated by a machine with multiple language support and all that good stuff. People get to _review_ their ballot before they put it in the box (giving them faith in the system), there won't be any hanging chad or bufferfly ballots (the interface would remain as a touchscreen), and most importantly, if you needed to do a recount, you'd have _paper_ records.
I'd trust this a little bit more then some software designed by a corporation with special interests to worry about.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
All of whom should have, in theory, been erased by the invisible hand or otherwise kicked in the pants by the market. But in fact, these beaurocracies are no better than most mediocre government beaurocracies.
How true. Heard a great line a few days ago - something to the effect of "the problem with the invisible hand is that it often isn't there."
Haven't heard any stories about wealthy Californians' homes spared by their hyper-efficient private fire departments this week, either.
So, he quit his mail route?
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
How do you "accidentally" put software on a public FTP server[?]
Trivial:
By FTPing it TO a directory that is read/write for anonymous FTP, rather than read only or login-required.
Easy to do if a company is trying to deliver a copy of an executable to a customer and both the person doing the delivery and the person receiving it aren't on their toes, or if the person receiving it doesn't have enough sysadmin privileges to configure the FTP server and the sysadmin who does isn't cooperative or available.
Not saying this is what happened here, of course.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
I think it's a shame that this software is getting leaked because it throws a significant wrench in the gears of the natural progression of democracy. Although I agree that the paper ballot system works just fine, the bottom line is that computerized voting - if implemented properly - stands to improve elections in terms of accessability of ballots to the electorate, workload for electoral officials and overall cost.
Your posting shows that you believe that the "natural progression of democracy" is to expand the franchise and poll as many people as possible, and you appear to be in favor of this. That is a misunderstanding of the function of elections.
Elections are the mechanism by which a republic is made stable. The elections are intended to model the outcome of a civil war. If the losing side believes that they are a good enough model to predict that they'd ALSO lose the war if they started it, they then refrain from starting it.
To do this they don't need to be perfect. But they DO need to be visibly free of gross corruption, and to selectively poll those people who are likely to fight if a civil war erupted and who care about the issues in question.
You'll notice that, in the US, the franchise has been extended to one group after another, in each case only AFTER the group in question has proven itself capable of organizing mass violence. Starting with landowners and merchants after the revolution, national sufferage was extended to all free males after a couple post-revolutionary incidents, to women after their participation in the bar-burnings of the temperance movement, to blacks (for real) after the civil rights movement degenerated into the mid-'60s urban riots, and to the 18-20 year-olds after the Vietnam protest and associated riots, bombing, and sabotage.
Making it easy to qualify and vote - rather than requiring registration about as hard as going out and hooking up with a militia - means more people who don't really care will vote, skewing the results of the civil-war prediction. It also makes it easier to create fake voters and corrupt the count. Both make the election outcome less believable by the losers, reducing stability.
Exposing defects in the counting mechanism - especially defects that can lead to massive fraud - may destabilize things temporarily. But it will lead either to fixing the defects or to immediate destabilization of a potentially corrupt and unrepresentative government - followed by fixing the defects if (as is likely) the post-war population also opts for a republic. Either will lead to government that is more representative of the peoples' will and thus more stable.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
... but I get a little nervous when I look at a brochure for voting booths with product lines named "Edge" and "Advantage."
What's next? The "Backdoor" line?
examples of government programs and agencies working and working well.
Which ones? The only good service I've recieved from government organizations was when I dealt with the tax collectors (property tax, mainly).
Our, poor, terribly innefficient government programs are responsible for creating the world's best military.
Like other people have said, $5,000,000,000 gets contractors riled up like nothing else. You should see the $2,000,000 contracts (a typcial pork-barrel domain), where the inefficiency is often sinful in proportion.
The Interstate Highway system makes cross country travel effecient and quick
Interstates were originally a defense system. They work extremely well for long-distance point-to-point travel. However, you fail to mention that the 16-lane highways around our cities still grind to a halt during rush hour. Cities are not scaling well, and the money that keeps getting thrown into the highways system is a dead end measure. How many acres are consumed by those 16-lane highways that could be put towards real estate or parks?
But I can tell you that the service of the DMV and even the IRS looks positively stellar compared to any number of private entitities -- several health insurance companies, Sprint, Microsoft Customer support, and the hosting company I called last week (no, not some dinky provider either -- I'm talking freakin' Interland here).
Companies who have a sound business model tend to have very good customer support. I have good support experiences more often than not, usually the bad experiences come from companies hanging on by a string (my ISP, for example). Health insurance companies have to meet such a mind-swimmingly large set of regulations that they can't provide good support (just wading through medical bills and getting questions answered is nearly impossible). Phone companies are regulated monopolies and don't have an incentive for good support, although I think they've picked up speed now that cable companies and ISPs are beginning to compete in the telephone markets. Microsoft simply has no incentive for good support at all (monopoly, monopoly, monopoly) and they will only improve as Linux, Sun JDS, etc. start eating at their bottom line.
Our beloved commercial driven-to-efficiency-by-the-market companies have produced an absolute steaming heap of bovine excrement when it comes to an e-voting product.
No, they have produced shit through a politically-corrupt deal. Don't confuse business and politics, here.
Healthcare article at Kuro5hin
Between this, and the Diebold fiasco it would seem a good idea for an open source/Linux project to write a secure voting system. With many governments opening up to the idea of open source, it might just fly (and make for fair elections too).
Mundus vult decipi, ergo decipiatur...
*Very informative* articles by Votescam.com
http://votescam.com/chap1.html (1 of 5 chapters)
Technological excerpts:
"Nothing was said in the press about the secretly programmed computer chips inside the "Shouptronic" Direct Recording Electronic (DRE) voting machines in Manchester, the state's largest city.
These 200-pound systems were so easily tampered with that the integrity of the results they gave -- and George Bush was the beneficiary of their tallies -- will forever be in doubt. Consider these points:
1. The "Shouptronic" was purchased directly from a company whose owner, Ransom Shoup, had been twice convicted of vote fraud in Philadelphia.
2. It bristled with telephone lines that made it possible for instructions from the outside to be telephoned into the machine without anyone's dear knowledge.
3. It completely lacked an "audit trail," an independent record that could be checked in case the machine "broke down" or its results were challenged.
4. Roy G. Saltman, of the federal Institute for Computer Sciences and Technology, called the Shouptronic "much more risky" than any other computerized tabulation system because "You are fundamentally required to accept the logical operation of the machine, there is no way to do an independent check."
A year later, in June of 1989, Robert J. Naegele, who had investigated all computerized voting systems for New York State, warned: "The DRE (which the Shouptronic was) is still at least a year and possibly two away from what I would consider a marketable product. The hardware problems are relatively minor, but the software problems are conceptual and really major".
A source close to Gov. Sununu insists that Sununu knew from his perspective as a politician, and his expertise as a computer engineer, that the Shouptronic was prime for tampering."
Those are the sorts of things that governments seem to be best at: things where it's worthwhile to overpay, because the end result is important enough that all you care about is that it works. (Not to say that governments don't mess that up, too, but if all you measure them on is "Does it work, eventually" they don't do so badly.)
He decided to just watch the government, and kind of scale it down to size, and run his life that way. --Laurie Anderson
There are lots of ways to create auditable trails for e-voting, but they aren't interested in offering the feature. Why not? I conclude it's because the lack of auditing is precisely the point. That's hos Diebold plans to "deliver" Ohio.
That reason why Database Technologies (DBT) was given the job of "scrubbing" felons from the Florida voting rolls was not that they were cheap (500 times more than the company they replaced) nor that they were efficient. Katherine Harris several times shifted the standards to INCREASE the error rate. False positives are a good thing when you are trimming likely Democratic voters, which was the point. (Race was identified, names munged. They were intentionally careless about getting names correctly, so the wrong people were scrubbed, but race was 100% on the money for each entry.) The error rate of 89% was just fine: and resulted in handing Bush the state. Sort of. It took other shenannigans to get the 500 vote margin.
Some Republicans have already proven they like monkeying with elections to gain power. Two of the 3 main e-voting vendors have strong partisan, Republican ties. This is a problem for believers in democracy, Democrats, and principled Republicans.
This is for Entropy users:
SSK@THn_MFmAqoGeXk9COwwSiFp6PAvBCMA/bbv/2//
I love all the squabble that preceeded the California recall about every county needing to be upgraded to these new voting machines lest the "poor" be disenfranchised.
I guess the idea was that we all should be disenfranchised equally.
There was an explosive factory near where I live that was surrounded by a fire, but was spared by its private fire department.
"We have got to make Stan understand the importance of voting, because he'll definitely vote for our guy." - South Park
and because we spend almost 10 times as much as the second highest military spender. Just because you have a better military doesn't mean its more efficient if you spend 10 times as much.
"We have got to make Stan understand the importance of voting, because he'll definitely vote for our guy." - South Park
But its just a $200,965 guess =)
a sp ?txtName=Diebold
http://www.opensecrets.org/softmoney/softcomp1.
Personally I think this should automatically disqualify them, but I guess I don't really understand the system that well.
The market needs a large number of buyers and sellers to function properly. A small number of sellers is an Oligopoly and is more common, but in this case there is a small number of buyers(government buys them but I dont know anyone who uses them for personal use.
"We have got to make Stan understand the importance of voting, because he'll definitely vote for our guy." - South Park
http://www.opensecrets.org/softmoney/softcomp1.asp ?txtName=Diebold
Better at what? Oh, you mean, better at very specific, academic things that interest you? Or better at providing a vast range of services to a vast range (read: everyone who comes in, without exception) of people with a vast range of interests?
In fairness, I've never been to SF, so maybe their library really does suck, but I doubt it. I suspect that, as is usually the case, the academic library*, in not being obliged to make the attempt to be all things to all people, has the luxury of doing an exceptional job at being a few things to a few people. Which really gets to the heart of the question of why there both kinds of libraries exist.
phatty 2x4
* Especially with the kinds of resources a large university has; if you're talking about a state U with more than about 25,000 students, I wouldn't bet money on your suspicion that they don't have a major urban public library's resources. Never underestimate the cheapness of municipal authorities, even in the People's Republic of San Francisco.
Nice things are nicer than nasty ones.
Diebold needs to upgrade to FTP.ID.10-T. This would most definitely stop such idiotic mistakes on the part of the people using their systems. Stupid.
No, actually I meant that it has a better selection of books, both in narrow diciplines, as well as items of popular interest. Moreover, the catalogue is VASTLY easier to search. Sure, the university library (my university has fewer than 7,000 students, for the record) is focused on certain academic diciplines, but even in areas where it is not focused, it still does a better job. The reason that both exist is simply that public libraries do an inadequate job at just about every task.
"The question of whether a computer can think is no more interesting than that of whether a submarine can swim" -EWD
why the hell was this modded "-1 Troll"?!? isn't this a valid freenet link??
I agree that these proposed paperless systems are no good. I am not confident that the various state governments will listen to our concerns, when Diebold keeps assuring them that "everything is fine". But I do know a good way for everyone here to "vote" against such a system: use an absentee ballot. What do you think would happen if, say, 50% of the voters submitted absentee ballots? Think of that mound of paper they would have to count (presumably by hand)! Maybe that would get their attention.
quality lockpicking book for sale at http://cafeshops.com/hackingtexts
From the article;
Sequoia makes a point of stating that its system is much more secure than the Diebold system, since it doesn't rely on Microsoft software.
Their website reads: "While Diebold relies on a Microsoft operating system that is well known and understood by computer hackers, Sequoia's AVC Edge runs on a proprietary operating system that is designed solely for the conduct of elections."
In fact, the system uses WinEDS, or Election Database System for Windows. WinEDS runs on top of the Microsoft Windows operating system.
The system also appears to use Microsoft Data Access Components, which was found in the WinEDS folder on the server.
Nice to see standards of honesty and integrity upheld by a company in such a sensitive position. hell, I'd trust them with my vote!
times like this, I'm glad I'm not actually an American, though