News for hackers. Stuff that matters.
Re:L.A. County gets state approval of new open-source vote-c... by furgooswft13 on Wednesday August 22, 2018 @09:37PM (#17823847)
I hope open source does not become a feel good buzzword for vote tallying security efforts. Nothing precludes open source based voting firmware from being modified before deployment on the machines (and perhaps with less effort as the source code is easily studied). Without end-to-end documentation of the entire build process for the final image, and secure hashing of the binary, open source means nothing. And even then...

> The ballot-counting equipment is part of a broader redesign of Los Angeles County’s voting system, which will include new equipment while relying on a traditional paper ballot

Article is light on details, and it's difficult to tell exactly what this sentence means, but if it means the new software will produce paper ballots that can be verified and observed by humans, that's a good thing at least.

Re:L.A. County gets state approval of new open-source vote-c... by duxup on Wednesday August 22, 2018 @10:45PM (#17824132)
In Minnesota we have a hybrid system where you fill out a paper ballot. The then you feed it through a scanner that indicates that it counted your vote, counts it, and it rolls into a locked box.

The machine and ballots are tied together right there. I really like the system as if all else fails you can get a paper trail and I belive even ID machines.

Re:L.A. County gets state approval of new open-source vote-c... by jfoutz on Wednesday August 22, 2018 @11:59PM (#17824477)
I like this system the best. You can also have another machine that fills out the paper ballots, which can be really helpful for people with disabilities. You still get the option to examine the filled out ballot before turning it in for counting.
Re:L.A. County gets state approval of new open-source vote-c... by voidlogic on Wednesday August 22, 2018 @11:11PM (#17824253)
The machines seem to work well too. I don't know why everyone doesn't do it like we do.
Re:L.A. County gets state approval of new open-source vote-c... by orev on Thursday August 23, 2018 @12:14AM (#17824533)
Because the people in power are terrified that just maybe there actually is some funny business going on and they are benefiting from it (by having been elected), and if they fix the system they will lose the next time around. It’s probably an irrational fear in many ways, but there’s always that little bit of them wondering.

Also, they could have granted long term contracts to existing suppliers, don’t have a budget to replace existing machines, don’t want to make the person who bought them look bad, or even possibly don’t want to say the old machines are bad because it calls into question the integrity of past elections.

Re:L.A. County gets state approval of new open-source vote-c... by duxup on Wednesday August 22, 2018 @11:26PM (#17824323)
Yeah, and I really like a ballot that I touched, I marked up and so forth.
Re:L.A. County gets state approval of new open-source vote-c... by Meai on Thursday August 23, 2018 @07:31AM (#17826319)
That sounds great, this way you can have the machine count the votes for convenience but also let humans count again and if there is any mismatch then we know that there is a problem.
Re:L.A. County gets state approval of new open-source vote-c... by vinay427 on Thursday August 23, 2018 @02:28AM (#17825049)
This was also a thing in Michigan, at least in the precinct where I lived. It seemed to work well.
Re:L.A. County gets state approval of new open-source vote-c... by rident on Thursday August 23, 2018 @05:35AM (#17825852)
I think Wisconsin and North Dakota also have this system.
Re:L.A. County gets state approval of new open-source vote-c... by xroche on Thursday August 23, 2018 @06:50AM (#17826126)
> Without end-to-end documentation of the entire build process for the final image, and secure hashing of the binary, open source means nothing. And even then...

And even then, you need to trust the machine. In many cases, these machines are using terribly old processors (sometimes even using the venerable 68000), and building a corrupted clone could probably be something doable.

The corrupted processor may have a different behavior, depending on the situation, such as the exact time of operation (ie. it would not be detected by random tests before or after an actual vote), or the analysis of people voting (ballot might be modified only during peak hours, to limit detection)

I'm baffled to see that democracies still engage in electronic voting systems.

Re:L.A. County gets state approval of new open-source vote-c... by tonysdg on Friday August 24, 2018 @02:17AM (#17833129)
>And even then, you need to trust the machine.

At the end of the day, it even goes further than that -- you have to trust the people who build the machines.

Ken Thompson said it best in his Turing Award talk: https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...

Re:L.A. County gets state approval of new open-source vote-c... by LMYahooTFY on Thursday August 23, 2018 @08:44AM (#17826738)
Agreed, and when it does inevitably happen, we should remember that it worked.

Because it's open sourced, we can be virtually certain that it's not built into the software, and if it is you need to prove it. Which would fix it, or obsolete it.

Someone will have to ask the security detail handling custody, or one of the other thousands of people who could potentially be involved in trying to rig an election.

It's finally cheap enough to have the transformation of it, from raw compounds into an engineered SoC for tallying votes, livestreamed 24/7 and operated by openly auditable robots.

Convince me that would cost more than one fighter jet.