Bev Harris now advocating AGAINST open source voting software

[Kelvin Mace]

And using the same tired arguments that Diebold and the Election Center have used in the past.



We at Black Box Voting are leaning against open source code as a solution. Like most computerized voting systems, there are many attack points with open source systems -- and also, there are many different kinds of licenses for open source programs.

With open source, the first hurdle is the licensing -- in other words, just how "open" is the open source? There are big variations in the licensing agreements, with some better than others. A few of the open source licensing agreements really amount to legal viral infections, and end up doing just the opposite of what you want to achieve.

The good points about open source, when it is done CORRECTLY -- which we have not yet seen, with current groups working on this -- is when it is truly open, in a way that is very welcoming of bug fixes and improvements. Once you get past the hurdle of the license, selecting an appropriate set of ethics for you open source endeavor, the next sticky issue is: WHO is doing the code review to determine which code submissions and bug fixes are accepted. This could be quite a playground for fraud, just as the current "certification" system is.

After that -- how often can bug fixes really be implemented? After all, our voting system right now is mired in expensive (and incompetent, or worse) certification systems that take up to a year to complete.

And then -- what is the architecture of the system? I was surprised to hear, upon meeting with the Open Voting Consortium folks this month, that they intend to sell their system (sell, not give) and seem to be looking at putting it into the existing vendors' hardware -- a concept that begins to sound like the old VoteHere nonsense, with a new magic bullet (open source instead of cryptography).

If I were one of the creepy privatized vendors who've been eroding away our electoral rights, I'd infiltrate Open Voting Consortium, cozy up to them, make them think I was going to reform my evil ways (Hah!) and then I'd be in a perfect position to neutralize that threat to my control of elections. Watch out for ES&S, and take some lessons from what ES&S has done so far after cuddling up to Vogue on the AutoMark system.

As Harri Hursti, who was with us at the meeting, said: "If you put your software in my hardware, I own you."

They admitted that this is correct. Hardware can be used to disrupt or corrupt even an honest software functionality.

Other issues that are rather intractible, with open source, are the issues of truly keeping ordinary citizens in control of their own ballot counting. There are many ways to spin and maneuver a computerized system, even one with honest software. Also, all computer-based systems present a moving target, constantly changing -- no sooner do you spot one problem and mobilize the immense effort it takes to tackle it than a switcheroo is pulled and you have to start all over again.

Paper ballots, hand counted at the polling place (NOT centrally counted, for the paper ballot playground for fraud lies in the transportation and central counting methods) -- well, if you get precinct-based hand-counts of the paper ballots, with methodology encouraging as many eyes as possible on the counting, you end up with a fairly stationary target, and one that is difficult to tamper with except on a small localized scale.

Like "VVPAT" -- "Open Source" is not a solution. Very tricky, and absolutely a moving target that no one has put together correctly yet.

Bev Harris
http://www.bbvforums.org/forums/messages/72/6758.html?1119906902

[Spider Jerusalem]

1. Bev Harris is, at best, a flake, and at worst a raving nutter.

Does anyone CARE what she advocates or doesn't, anymore? Especially here?

[havocmom]

3. Yeah, we care about what MOTIVATE$ her. Knowing that is a good thing.

eidited cuz me 'n the keyboard are barely on speaking terms

[Boredtodeath]

4. Well, since larissa with OVC is advocating here for her

I guess we should care.

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=132x1890473#1890501

[Kelvin Mace]

17. Not moi

I just found it one more nail in the coffin.

[Pachamama]

24. Bev who? Computer Voting: Impt. Issue - Bev Harris: Not Impt.

Bev Harris is a scam artist and is possibly the worst thing to happen to the issue of Computer Voting Scandals and Investigations.

She is a hinderance to the cause, not an asset.

Zero Credibility with ANYONE and if there is ever going to be progress made, it has to be made without this woman anywhere near it.

[Kelvin Mace]

26. Oh, I agree

and as I said above, one more nail in her coffin.

[FreedomAngel82]

61. She's also supposed

to be meeting with the Carter/Baker commission. Now we know why!

[havocmom]

2. Guess THEY didn't stop sending her checks. Highest Bidder Bev?

;) and :popcorn:

:hi:

[no name no slogan]

5. LOL! Has she been reading Bill Gates' playbook?

Coming out against "open source" software is like coming out "against" computers. There are so many differences between the various licenses (BSD vs GPL) that even discussing it as a monolithic entity doesn't make any sense.

If not for open source, we wouldn't have the internets, much less modern computing as it exists today.

How much $$$$ did Bev get from MS to put this up?

[Pachamama]

25. Coming out against Open Source is like coming out against Open Government!

As an ex-Microsoftie and someone who knows the company well, the industry well, the technology well, the players well and the issues pretty well, I would say that Bev is defintely reading the Playbook.

This woman has no credibility and shouldn't even get the attention we are giving her here.

She is harmful to the cause....

[no name no slogan]

30. NEWS FLASH: BEV HARRIS COMES OUT AGAINST AIR AND WATER

"You can't just give that stuff away and expect them to be honest" :eyes:

Wow, ex-Microsoftie, huh? One thing I've always liked about Microsoft: I make a decent living cleaning up after 'em. And by the time they get around to version 3.x, the thing works pretty well-- 97.9% of the time.

[Pachamama]

37. I didn't even trust Windows (& most people inside MS too) until 3.1!

Yeah, it was a pretty funny thing to be beta testing internally the products and knowing what was messed up and at the same time concocting the brilliant marketing strategies....

Being a former Kool-Aid drinker is what has allowed me to afford being a stay at home Mommy and not having to work. It's pretty amusing to also watch what goes on in the industry and be glad I only have to deal with kids having melt-downs instead of 30 year olds.... :hi:

[no name no slogan]

51. That's very cool!

After the dot-com meltdown I took a job as a faceless bureaucrat, managing the web site for my state's human services agency. It's not glamourous, and the pay is about 75% of what I made in the private sector; but it is steady employment with decent benefits and a union job, to boot.

I have to do a lot of hand-holding as most of my users are technophobic social workers, but it has it's own rewards. :D

[Boredtodeath]

6. OVC must have kept the money from the teach-ins

Evidently they're not giving it to Bev, huh?

Or they're not generating enough income for Bev to stay on their side.

For Bev, it always comes down to money.

[salin]

50. Didn't she do an OVC forum in the San Jose area a month or two

ago?

Someone came and promoted it - was met with skepticism... responded by saying she had heard about the controversies - and 'wasn't going to take sides' b/c bev had good information and would make for a lively forum. Do I remember that correctly? Was that someone for open source - or am I confusing events? If I am correct - just add the poster (laura was it) to the evergrowing list of willing to be used - while acting in good faith - only to be spat on and spat out later crowd.

[Boredtodeath]

52. Yep, your memory serves you well

But it was Larissa, not Laura..........I think.

[Boredtodeath]

53. Make that LaraOVC n/t

.

[salin]

54. look what I found

there was a better thread.. but I couldn't find it. Note my last post on it - I was polite - but she can't say she wasn't warned....

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=203x347030#348021

[salin]

56. Found what I was looking for

sad, really...

I am honestly not too familiar with the Bev controversy. I'm not really interested in making a judgement about this. OVC and I have done nothing to take sides about it. We want to work with whoever wants to work with OVC and has skills, resources, knowledge, etc to offer. If David Allen or Andy Stephenson wants to put up $2000 in matching funds for OVC, we'd be more than happy to accept it. And, like I said before, they are more than welcome to speak at an event if they are interested and in the area.


From this post http://www.democraticunderground.com/discuss/duboard.php?az=show_mesg&forum=203&topic_id=345036&mesg_id=348190 (and thread)

Bev must be really good - because time and time again she gets folks to team up - they get warned -but are convinced that they are outside of what must just be a disagreement, and she does have 'expertise' so what the heck we'll go forward to work with her...

Except for her libertarian co lawsuiter, has anyone aligned with her not gotten bit?

[Boredtodeath]

58. Nope, not a soul

Just Jim March. Must be some kind of kindred spirit thing, huh?

But, then again, we knew Jim March was only in it for the money - he was at least honest about it.

Bev, on the other hand, works hard to convince herself she's the next pulitizer prize winner. More money in that doncha know?

[Kelvin Mace]

90. I love this

If David Allen or Andy Stephenson wants to put up $2000 in matching funds for OVC

If she got money from Bev, she got our money and quite a few other people's as well.

She is very good at conning people and they just can't believe she as vile as we tell them.

[merh]

7. Well, this is what was heard on Bradblog

Sat Jun-25-05 08:46 PM
BBV meeting with Carter/Baker commission?
I just heard about this on Bradblog. Is this true? According to the show they're not meeting with ordinary citizen's but they are BBV?
http://www.democraticunderground.com/discuss/duboard.php?az=show_topic&forum=104&topic_id=3948840

[Boredtodeath]

8. kick n/t

.

[OldLeftieLawyer]

9. Tell Bev

I want my donation back.

My thinking is that this woman should get no airing at all. Don't feed that monster - just keep her in the shadows and let her rot away.

She's a special kind of parasite. Starve her.

[helderheid]

12. I want my money back too

I hear she frequents freeperville now.

[Stephanie]

32. she certainly does

you can search by poster to retrieve her posts - search for "bev_harris"

[Boredtodeath]

36. No, her Freeper name is BevHarris

No underscore.

[Stephanie]

57. You're right - thanks!

Some recent posts:

http://www.freerepublic.com/focus/user-posts?id=100516

[bpilgrim]

10. "when it is done CORRECTLY -- which we have not yet seen" - lol

the server her fucking website is hosted on (APACHE) is OPEN SOURCE and so are most others, bev 'you ignorant slut' :eyes:

she must be thinking of selling the software herself or some seal of approval to the companies that do :evilgrin:

peace

[Norquist Nemesis]

11. When Bev Harris started her campaign

to slam Democrats, and specifically DU, she lost all credibility with me. Just after the election in Nov, I donated when I could ill afford to. The she started her rantings and showed her true colors.

There were questions about her actions months before the election and I tried to make sense of those discussions. I'm not a lawyer so I don't understand things like qui tam (or whatever it is) and how it's significant.

A lot of people donated to Bev Harris. Those dollars demand she be accountable and responsible. At this point, the only things she's served up is a scam.

[Cessna Invesco Palin]

13. Dear Bev,

With open source, the first hurdle is the licensing -- in other words, just how "open" is the open source? There are big variations in the licensing agreements, with some better than others.

In effect, she's saying that advocating open source is bad because it might not... be open source. That's just a bunch of gibberish. You select the proper license for what you want to build. Jesus.

A few of the open source licensing agreements really amount to legal viral infections, and end up doing just the opposite of what you want to achieve.

That's actually a piece of Microsoft propoganda, and I don't even see how it's applicable to voting software, as there's no real interest in re-use of the code in another type of system for financial gain (or at least there shouldn't be.)


Once you get past the hurdle of the license, selecting an appropriate set of ethics for you open source endeavor, the next sticky issue is: WHO is doing the code review to determine which code submissions and bug fixes are accepted. This could be quite a playground for fraud, just as the current "certification" system is.

No. The entire point is that MANY people review the code - anybody can review code or suggest improvements.

After that -- how often can bug fixes really be implemented? After all, our voting system right now is mired in expensive (and incompetent, or worse) certification systems that take up to a year to complete.

That's an argument against computerised voting period - not open source.

I was surprised to hear, upon meeting with the Open Voting Consortium folks this month, that they intend to sell their system (sell, not give) and seem to be looking at putting it into the existing vendors' hardware -- a concept that begins to sound like the old VoteHere nonsense, with a new magic bullet

Well, yeah, actually... that makes a lot of sense. Why would you want to re-invent the hardware when it already works?

If I were one of the creepy privatized vendors who've been eroding away our electoral rights, I'd infiltrate Open Voting Consortium, cozy up to them, make them think I was going to reform my evil ways (Hah!) and then I'd be in a perfect position to neutralize that threat to my control of elections.

I don't even know how to respond to this because it doesn't make any sense. There's no reason a voting system would need to be so hardware-specific that one vendor dicking you around would spoil everything. At best it'd just delay it.


As Harri Hursti, who was with us at the meeting, said: "If you put your software in my hardware, I own you."


That's rather a gross generalization about, well... everything.


They admitted that this is correct. Hardware can be used to disrupt or corrupt even an honest software functionality.

You really don't understand computers at all, do you Bev. Perhaps you should find another hobby.

all computer-based systems present a moving target, constantly changing -- no sooner do you spot one problem and mobilize the immense effort it takes to tackle it than a switcheroo is pulled and you have to start all over again.

The whole point of open source is that immense effort isn't necessary, and with properly refactored code you don't need to "start all over again" as you put it. I don't know where you get "immense" from, but I suspect that you simply plucked it from thin air to prop up an otherwise questionable assertion.

Paper ballots, hand counted at the polling place (NOT centrally counted, for the paper ballot playground for fraud lies in the transportation and central counting methods) -- well, if you get precinct-based hand-counts of the paper ballots, with methodology encouraging as many eyes as possible on the counting, you end up with a fairly stationary target, and one that is difficult to tamper with except on a small localized scale.

Again, this is an argument against computerized voting in general, not open source specifically. This is the same argument she's been making for years, wrapped in a not-particularly-lucid argument about open source.

Like "VVPAT" -- "Open Source" is not a solution. Very tricky, and absolutely a moving target that no one has put together correctly yet.

The fact that it doesn't exist yet has nothing to do with whether or not it's a viable solution. Talk about your straw man argument.

[Boredtodeath]

15. Great responses!

I heard Katherine Wynne whine the other day in a radio interview about experts in the US not working with them - they had to go to Finland to find someone.

Well, perhaps, it could be this kind of behavior why no one will touch the woman and her lunacy?

If you don't say it Bev's way, and do it Bev's way, and send the money flow Bev's way, you are the enemy open to public attacks.

Evidently, this week it's OVC's turn.

[Cessna Invesco Palin]

18. Actually, it's because Bev is dumb.

Stupid, actually. Big stupid. I knew this straight away when, back in the day, she started posting what she called "suspect" code snippets to DU. The bits of code were, in fact, completely benign and would only appear "suspect" to someone without software experience. She, on the other hand, claimed that her computer expert assistants had identified these fragments for inspection. This led me to believe (and say here on DU) that she was full of shit, and I took a lot of crap for saying that, way back when.

[Boredtodeath]

20. Actually, SAIC and RABA proved otherwise

And, while Bev Harris has done great harm to this issue, much of what she did in the beginning bore fruit confimed by computer security experts.

You are wrong to condemn that activity as it has been proven time and again.

You are not wrong to condemn what she has done to, and with, that data by whoring it into a scam.

[Cessna Invesco Palin]

27. SAIC and RABA did not confirm any of Bev's specifics.

Because her specifics were all wrong, at least every one she brought to the attention of DU with regards to specific code was wrong. Getting rid of unverifiable, incorrectly networked electronic voting is good. On the other hand, I think paper ballots are a terrible solution to the problem and are just as fruitful an area for fraud as unsecure electronic voting. I'm all for secure electronic voting. It IS possible.

[Boredtodeath]

33. Then you are going against common business practices

Standard business practice requires, not only auditability, but backup documentation to prove the accountability of a process.

When a CPA audits a set of business records, he audits the documentation as well as the computer results.

When the IRS audits a person or business, they audit the records and receipts as well as the total figures.

To do otherwise would mean no audit had been performed. To eliminate this practice for voting is the direct opposite of what we expect and consider good business practice.

And SAIC and RABA did, indeed, confirm a lot of Bev's early work. You can allege otherwise, but the facts prove otherwise.

[Cessna Invesco Palin]

42. Name a single instance...

...where any of the allegedly malicious code fragments was actually shown to be a security risk.

SAIC showed broad-based security and architecture concerns, not maliciousness as Bev alleged here many, many times during her incoherent rants that were accompanied by code snippets where she'd managed to create something akin to the Bible Code with her interperatations of hex numbers.

Standard business practice requires, not only auditability, but backup documentation to prove the accountability of a process.

That's not was I was intending to say. of course I'm for auditability and backup documentation. I'm just not for going back to paper ballots counted by humans.

[Boredtodeath]

47. No one is advocating going backwards

I'm just not for going back to paper ballots counted by humans.

We're advocating for an auditable system. Using PAPER records to audit the computer totals.

HAND COUNTED PAPER BALLOTS TO CONFIRM THE ELECTION RESULTS. You know, standard business practice - true auditing.

When you submit an expense report, you submit the receipts and the accounting clerk adds those receipts to confirm your totals. You know, auditing.

[Kelvin Mace]

82. Amazing how far they

have to go to find someone who hasn't learned of her reputation.

[Occulus]

23. One *tiny* quibble

"They admitted that this is correct. Hardware can be used to disrupt or corrupt even an honest software functionality."

Actually, this is correct. You can see it in the fight between NVidia and ATI. Some games made for/developed on ATI cards do not perform as well on NV cards, and vice-versa. It's a very minor difference, effectively, but it is there.

Another example would be the DRM chips intended for the next generation of motherboards. These would cripple software intended to make copies of protected material, like DVDs.

Hey, even a broken clock is right twice a day.

[Boredtodeath]

28. And Doug Jones and Dan Wallach have advocated

Open source software which will run on ANY hardware as the only intelligent approach for years.

Counties should be able to purchase old, used computers to run the software on - under Windows, Linux and/or Mac to save the expense of the hardware. In fact, the Diebold Touchscreens are using some of the oldest, slowest hardware still manufactured.

[Cessna Invesco Palin]

44. Oldest, slowest, and most reliable.

Kind of like the space shuttle. :)

Hell, even Diebold gets some things right.

[endarkenment]

59. shuttle designed and built 20 years ago.

That is why it is using 20 yr old technology. hardware reliability has done nothing but increase over the last 20 years. software reliability is another story, but mostly it is the increase in complexity that has caused the perceived decrease in software reliability.

Open source voting machine software might enable clever external hacks - but these machines should never be 'online'. Open source voting machine software will make it vanishingly difficult for the machine vendor to be in cahoots with any political party, as the many eyes will quickly find the fraudulent hooks bells and whistles inserted to enable election fraud.

Personally I think there is little or no case for using anything other than optical scan paper ballots. If governments want to waste taxpayer dollars on fancy computers to mark up the paper ballots they should explain to their constituents why this makes sense.

[Cessna Invesco Palin]

43. Right.

You could design hardware to make software fail. I think Bev was trying to say that you could design hardware to change the vote totals, which is insane and wrong.

My point about the vendor issue is still correct, though. There will always be someone willing to sell compatible hardware for something as large as a statewide voting system.

[DS9Voy]

101. Actually

Sometimes Nvidia and ATI HARDWARE is not at fault. A few years ago it was discovered Nvidia and ATI drivers added registry entries that caused graphics quality to lower when certain specific games (used for benchmarking frequently) were executed. An article exposing this fraud simple renamed Quake3.exe to Quakesomething.exe, and the FPS changed SIGNIFIGANTLY.

There are, of course, differences between the hardware. Certain things are optimized between the different hardware. Some earlier Nvidia hardware only supports some DirectX 9 functionality, for example, while ATI at the same time had full DX 9 support. This is legit competition between the two - and generally while they are playing on the same field there is indeed a legit difference in performance between the ATI and Nvidia hardware.

Hardware DRM you are entirely right on.

[high density]

46. Yeah, Bev always writes like she's an expert...

...but instead it's clear that she's very ignorant or just a conspiracy theorist when it comes to talking about computers.

[Stephanie]

93. Here's the pertinent quote:

If I were one of the creepy privatized vendors who've been eroding away our electoral rights, I'd infiltrate Open Voting Consortium, cozy up to them, make them think I was going to reform my evil ways (Hah!) and then I'd be in a perfect position to neutralize that threat to my control of elections.

Projection, no doubt. I think she is a mole.

[geek tragedy]

14. Why does anyone still pay attention to that scheming schizo? eom

[flyarm]

16. SHES A WHORE WHO GOT MY MONEY FOR HER SCAM! N/T

[KittyWampus]

19. Shouldn't Bev Be In Jail For Tax Fraud?

[Junkdrawer]

21. Is she arguing for "Paper ballots, hand counted" and that...

Open Source software, by itself, is not a solution? :shrug:

Because if she is, I'd agree.

[Eric J in MN]

35. "Paper ballots, hand counted at the polling place." -Bev Harris

In the original post.

[Boredtodeath]

40. But her statements argue AGAINST open source

and ONLY hand counted paper ballots.

While BOTH should be implemented.

[Kelvin Mace]

85. No,

She starts her comments with "We at Black Box Voting are leaning against open source code as a solution."

Pretty clear cut, there are NO qualifiers.

[Walt Starr]

22. Looks to me like she's been bought by Microsoft

Plain and simple, she's parroting Microsoft FUD. Look to recent donations. Of course, I say that tongue in cheek as I remember a little something about a failure to disclose financial information.

[lateo]

29. She has some good points...

She has obviously done her homework...that doesn't mean she isn't nuttier than a Planters factory though.

[bpilgrim]

41. no she doesn't

not in regards to open source, she hasn't a clue.

peace

[Pawel K]

62. She has a very good clue

it looks like she got educated. that doesn't mean I am defending the type of person she is but open source software will not fix any of the problems we had and will leave the system open to any kid with an internet connection.

[bpilgrim]

66. what you said doesn't relate to real world experience

the open source industry is flourishing and noted to be secure and feature rich due to its open nature.

guess what runs most websites on the planet... APACHE which is open source.

her comments about open source are pure FUD and is what MS often says, a company that fears open source to its core because they can not compete with it.

peace

[Pawel K]

74. Can you read my reply on #73.

MS not wanting open source is part of protecting their investment. However, opening the source to windows would create more problems than it would stop. Imagine all the security exploits found in the last decade of windows; you'd be able to mulitply that by millions if this was open source.

[Kelvin Mace]

87. Could you point them out?

[lateo]

109. Sure...

"there are many attack points with open source systems"

This statement is true. Let me preface my comments with this statement.

I own a technical consulting business. We use Microsoft Windows and Open Source solutions for our customers. I am also the Communications Officer for a chapter of ISSA in my state. I think ALL manifestations of Electronic Voting are stupid. Put it on paper. I don't agree with Bev but I do believe she did her homework.

http://www.issa.org/

There are many attack points on OSS just as there are in proprietary systems like MS Windows. It is debatable as to which is worse and I'm not taking sides. However, if I was forced to accept Electronic Voting I would prefer to have it on OSS. That doesn't mean it is a good idea though.


"there are many different kinds of licenses for open source programs."

Another true statement. Yet one I don't really think disqualifies OSS from being developed into a EV platform.

[Eric J in MN]

31. She's right. The software in the machine on Election Day

isn't necessarily the same software people were given to review.

Counting paper ballots at the precinct is the important test.

[WilliamPitt]

34. "Hardware can be used to disrupt or corrupt...

...even an honest software"

Wow.

*shaking head*

[Eric J in MN]

38. She's right.

Even if the software for the vote-counting is legit in itself, hardware drivers can rig the results.

[Boredtodeath]

39. Actually, that's true

The firmware in a computer can contain software and libraries which cause the hardware (disks, modems, etc.) to do something not contained in the software.

Firmware = chips installed on the computer motherboard or other hardware devices.

[high density]

45. So you verify what was written to the device after you write to it

The firmware is going to have to be pretty damn complicated to futz with data files written to disk or memory (and leave them in a useful state) unless they just want to randomly corrupt the data. Any decent testing should expose bugs and tampering, whether software or hardware related. A layer of encryption would make tampering even more complicated at the hardware level.

[Boredtodeath]

48. And a DLL can be invoked to change the firmware AFTER

You tested for bugs and tampering.

[DS9Voy]

104. Why have flashable chips?

The system boards BIOS will have to be flashable. While most are these days, I'd wonder why you'd have a flashable chip in a voting machine.

You also have to remember that most flashable BIOS chips are NOT very large in the memory department, and are usually written in PURE machine code.

In other words - you'd be VERY cramped to write any kind of code that (reliably) alters vote totals.

You also have to remember that dynamic flashing on top of executable code (read: an operating system or say voting software) can significantly increase the likelihood of a bad flash thus killing the system entirely. Assuming every voting machine was dynamicly flashing the BIOS you would think at least a few would be randomly dead by now and someone would have wondered why.

[VOX]

49. She needs to log some serious basket-weaving time.

All the inconsistencies point to someone needing professional help.

[RetroLounge]

55. Bev Harris is a nobody who never was...

Fuck her and her scam.

RL

[Pawel K]

60. Sorry to say Harris is right

you can not have open source election software; it would be open to an attack from any 13 year old kiddie with an internet connection. Open source also doesn't mean it will fix any of the problems we had with accountability as they can let you view the source for one thing and then compile another to use in the system. What we need is paper ballots, simple as that.

[bpilgrim]

68. thats NOT true - open source software runs MOST of the www

though i am an advocate of a paper trail since i don't think in todays digital age, computers are going to go away and we must find a balanced, TRANSPARENT, solution that can be VERIFIED.

remember there is NO perfect solution as even ballot boxes can be stuffed.

peace

[Pawel K]

73. No offense but do you have any programming knowledge?

Yes, the www is run mostly on open source; that is why you see so many problems with hacking. Every message board that is run in open source mode (PHP, Perl, ASP, etc) has had critical security holes that had to be addressed instantly. How open source works is it allows you to go through the entire code looking for bugs. Yes, this can be a good thing but mostly it isn't. If you find a bug or security issue you do not have to tell anyone, you simply eploit the system without anyone ever finding out about. That is also only one of the problems. When you have the source to a program that program needs to be compiled before it can be used in a voting machine; there is no way to prevent someone from modifying the source before they compile it, making it impossible to track such changes. I recommend you read up a little on programming and how it works; I am not saying this as a put down but you simply have to understand that this will only create more problems but it also will not fix any of the issues we had in 04. Paper ballots are the only way to go.

[bpilgrim]

76. thats what i do for a living

"Yes, the www is run mostly on open source; that is why you see so many problems with hacking."

BS - every bit of software ever made has problems it's how quickly they are fixed that counts and where open source EXCELS.

"How open source works is it allows you to go through the entire code looking for bugs. Yes, this can be a good thing but mostly it isn't. If you find a bug or security issue you do not have to tell anyone, you simply eploit the system without anyone ever finding out about."

not true. as soon as you exploit it, it is noticed, by the legions using it and fixed, has been working great thus far.

"When you have the source to a program that program needs to be compiled before it can be used in a voting machine; there is no way to prevent someone from modifying the source before they compile it, making it impossible to track such changes."

thats why you have a paper trail and checksums

"I recommend you read up a little on programming and how it works;"

lol

visit my site...
http://media.GlobalFreePress.com

peace

[Pawel K]

88. Don't mean to sound like a dick but you installing a simple gallery script

doesn't make you an expert. BY just installing that script you opened yourself up to about a quater million of security exploits (okay, that number is obviously inflated but you get my point):

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=coppermine+gallery+security

Nice site by the way.

:toast:

[bpilgrim]

91. i'm sure you can't help it

running that site on my own server with a custom apache, mysql, php and perl (LAMP) is more than just installing a php script.

and if any site is a target for (RW) hackers that one is and it's still up and running.

BTW: i write my own code, too, and i've been writing web code since 95 ;->

peace

[Pawel K]

94. Well I must give you props, your site passed some basic security checks

:)

But I digress. You say you write your own code; which would you say is more secure?

[Solon]

72. LOL, look at stats between IIS and Apache and get back to me. n/t

[Pawel K]

75. Sure, here you go

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=Apache+security+hole

Now imagine a security exploit for rigging an election found with a simple google search.

And if you are interested in comparisons here is IIS:

http://www.google.com/search?hl=en&lr=&biw=868&q=IIS+security+hole (about half the security hole results)

By the way, I run about 10 web servers and wouldn't trade Apache for anything else; but you have to understand that I have to update this stuff on a regular basis to avoid public exploits. I am also aware there are thousands of other exploits there just waiting to be used that nobody knows about yet.

[bpilgrim]

77. lol

first hit dated...
Apache Security Advisory. Release Date: Tuesday, January 6 1998 Topic: Possible

the www is run, securely on APACHE.

psst... pass the word ;->

peace

[Pawel K]

80. No, the internet is not ran securely

I've been running large web sites on the internet for around 6 years; trust me when I tell you, it is not secure. If you ever installed a simple open soruce message board on your web site you would know that.

But lets forget all that for a second, do you actually know what good having open source will do?

[Solon]

81. Difference in reporting...

Microsoft has SUED people for independently reporting bugs and security exploits before, you think they would allow anyone to tell you about a security risk before they tried to fix it first? Sometimes this is months after they, not you, know of the exploit. Apache has no such restrictions in reporting, once a security vulnerability is found, it is reported, widely, on the net, and fixed as soon as possible, which type of reporting do you prefer?

[Pawel K]

83. I prefer Microsoft's method

what you just said is exactly the point, open source code gets exploits reported on all the time. That means how to access those exploits is available on the net through a simple google search. Meaning if a new security exploit is found today everyone will know about it leaving a system very open if it isn't updated almost instantly. On the internet it isn't such a huge deal as the www is so vast; but with a limited election system this would cause huge problems almost instantly.

[bpilgrim]

92. so do the hackers

:evilgrin:

peace

[Pawel K]

95. As far as I know the hackers love to have the information right out there

for anyone to see.

But you are missing the point. A bug is found, hacker exploits it on a few hundred systems and problem is patched.

Election day with open source voting machines. Hacker finds exploit, election is fixed before problem could be patched and bye bye democracy.

[Kelvin Mace]

98. Hardly!

This would assume that:

1) All voting machines are on-line and accessible

or

2) An army of conspirators manage to infiltrate the 3000+ counties across the nation and have physical access to the machines.

I can only speak for my own efforts, but the move is to keep these systems OFF-LINE, ruling out the first possibility.

As to the second possibility, it strains credulity that this could occur.

OS allows for voting software to be devloped and de-bugged in plain sight, something that is not happening right now.

[Pawel K]

102. When something becomes available online you do not need direct

access to any machine. A voter before they vote hears of an exploit, there isn't enough time to patch it and thousands of machines become a problem.

My simple point is that no matter what you do to a machine it will always have bugs you can exploit (especially when you have access to the source). The bottom line is we should never trust any machine; they should all have a paper trail.

[Kelvin Mace]

106. And how do they exploit the bug?

Isn't it going to be a bit obvious when they whip out a laptop/PDA and start plugging cables into the voting machine with everybody watching?

Also, while I am concerned about the possibility of tampering with the code, I am MUCH more concerned with shoddy code screwing things up. You can argue about the relative security of Windows vs. Linux, but as far as robustness is concerned, it's Linux hands down.

To clarify, I am NOT advocating (and never have), OS as the "be all and end all" solution.

OS + paper ballot + robust physical security + auditing + chain of custody = a system that can be relied upon.

If any of the variables are missing, then the deals off.

[Pawel K]

112. This has gone a little too far, so the bottom line is no matter what kind

of system you got it will never be secure without a paper trail. Lets just leave it at that since I think we are all for the same thing here. But understand, open soruce will fix almost none of the problems we had in 04.

[fla nocount]

63. Harris brought out BBV, wore it out and made it a dead issue.

Maybe she's Black Ops.

[loudsue]

64. Kickin' the thread -- still kickin' myself for ever believing in her....

:kick::kick::kick::kick:

[salvorhardin]

65. I'm another who says she's right on this

Although once again, I really wish she'd get competent professionals to go over her stuff before she releases it. In particular, this statement really irked me...

just how "open" is the open source? There are big variations in the licensing agreements, with some better than others. A few of the open source licensing agreements really amount to legal viral infections, and end up doing just the opposite of what you want to achieve.

Viral infections? I think I've heard this one before. Does Microsoft's lawyer work for BBV?


Also, this little statement pissed me off...

I was surprised to hear, upon meeting with the Open Voting Consortium folks this month, that they intend to sell their system (sell, not give) and seem to be looking at putting it into the existing vendors' hardware -- a concept that begins to sound like the old VoteHere nonsense, with a new magic bullet (open source instead of cryptography).

Oh, heaven forbid someone actually make some money for putting in long hours other than Bev Harris.


But when all is said and done she is right.

As Harri Hursti, who was with us at the meeting, said: "If you put your software in my hardware, I own you."

And she even credited the person who put the thought in her head this time.


I love computers. I love technology. This is one place they clearly do not belong, at least not beyond the level of technology required to make paper. Voting is for humans. Let the humans do the counting.

[theearthisround]

67. Why is open source better than paper ballots?

:shrug:

[bpilgrim]

69. it's not an either or but BOTH

when computers are used, and they are only growing in use, we must have TRANSPARENCY (open source) and a PAPER TRAIL for accountability (verifiable audit)

peace

[theearthisround]

71. I agree, but should we be forced to use computers?

Our "public servants" should be listening to our demands. Instead they're listen to big business who's pouring money into their coffers for these e-voting machines. (open source or not) Our "public servants" should be the ones forced to compromise AGAINST their paymasters demands. They are OUR public servants NOT big business's!

[Kelvin Mace]

108. No one's forcing a computer only solution

around here. Elections officals are, because it hides their mistakes.

Computer's can help make the count more accurate, IF AND ONLY IF, they have a paper ballot that records their vote and that ballot is reviwed by the voter.

[yowzayowzayowza]

70. What a flaming pantload.

Don't think I'd trust Bev's recommendation on a keyboard these days.

[Tommymac]

78. Bev Harris is a Thief.

She stole my money I gave in good faith back in November 04. Promised results...but lied.

She is nothing but a fraud. Or perhaps a Rovian deep plant. She has set back the effort to reform the vote by years ..perhaps years we don't have.

She can kiss my white ass if she ever expects to gain credibility again with me.

Sorry for the rant.

[anarchy1999]

79. Oh no, not again! It keeps coming back like a bad "Jason" movie.

Please everyone, please. Make it stop!

[Darwins Finch]

84. As a lifelong software developer...

...I have to say that open source software is the only software you can fully trust. There's nothing mystical about open source, it just means you can see what goes into the product, and from there figure out what it does.

Think about it this way:

- Are you comfortable buying food from the store that you don't know the ingredients of?
- Do you take medicine without knowing what's in it?
- Would you listen to news that never gave attributions or cited its sources?
- Can you trust any large corporation to operate ethically without oversight?

You shouldn't do any of these things, any more than you should trust your vote (and your future) to unknown digital machinations. The purported danger of "open source exploits" is nothing compared to the actual danger of both closed source exploits and closed source secrets.

But if you're okay with these things, as a certain "expert" seems to be, then go right ahead. Though if you do, you may eventually find you're a malnourished, sick, uninformed and unemployed citizen of a dictatorship. :)

[bpilgrim]

103. excellent post

I am a web developer (10 years or 15 years writing code in gen) and I'm of the same opinion.

welcome to DU :toast:

peace

[Kazak]

86. Didn't she used to be loved on DU? I'm so confused...

What happened?

:shrug:

[Kelvin Mace]

89. UH, she hasn't been loved here for quite a while

You need to check here to see why:

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=203x340188

[Buzzcook]

96. "Didn't she used to be loved on DU? I'm so confused..."

She was more than loved. Her folloers were fanatical to such a degree that to call them Bev-Bots was an understatement. Even the most innocuos questioning was greated with enough flames to warrent a 4 alarm responce.
Love is a pallid weak little word compared to the devotion of BBB's following.

[bunny planet]

97. Please don't remind me that this nutbar narcissistic personality disorder

poster child is still out there. She is a crazymaker, nothing more, nothing less.

[Kelvin Mace]

100. Seems I touched a nerve with the post.

I'm kind of surprised this one generated so much heat.

[bunny planet]

105. Not your fault. She is just a very disturbed person. Don't like to see her

get anymore attention that's all.

[Kelvin Mace]

107. Thanks

I didn't feel flamed, just surpised. I posted because it amazed me she was now burning this bridge.

[Rex]

99. I never trusted her.

When she posted about the SS visits and FBI 'fishing expeditions', I thought it sounded, well, fishy. Some people will sell out their country for money and power, Bev is one of these individuals.

[Eric J in MN]

110. Kick for PAPER BALLOTS PUBLICLY HAND COUNTED.

NT

[Festivito]

111. Seems she's saying PAPER BOLLOTS counted BY HAND. Best? No.

Hnnd counting ALL ballots is tedious, and not perfect either. She goes over point by point problems with computer counting, but ignores problems with hand counting. WHERE'S HER HEAD?

I think electronic ballot printing and reading are possible, BUT MUST include mandatory random and selected checks every election using a readable human double check.

Every Bev computer code point is true BUT worse on proprietary systems.

Anything can be attacked.
Anything can be licensed.
Either is open to liars reviewing code and commiting fraud.
Either must implement changes.
Either must be certified taking the same time.
Each must deal with system architecture.
Any group of programmers can be infiltrated. Open will be seen.
The hardware can undermine counting on either software, it must be tested.

[LightningFlash]

113. Bev Harris wreckes the movement.

Fire her ass from any hearings with Baker-Carter commission.

:thumbsdown:

[Kelvin Mace]

114. If they have done their homework

they will know she has LOTS of problems.

[AX10]

115. Bev Harris is a bimbo. Nothing more than an opportunistic...

nut-case. She must be getting paid very well by the GOP/Rove.