Fox having to pay a substantial damages settlement to Dominion is a just outcome; their amplification of lies about malicious backdoors and rigged elections was contemptible and dangerous.
But we shouldn't conclude from this that US voting systems are perfectly or even adequately protected against attack. While great progress has been made, there's still a great deal of work left to do to make our elections truly secure and robust.
@mattblaze hand marked scantron is the only realistic solution. Allows quick results and a verifiable paper ballot for recounts.
Any *private* non-public source code counting our votes is absolutely undemocratic.
@apenguininspace @mattblaze that's the problem. We don't know.
A paper trail is better than nothing but there's just precious little benefit to having a software program do the voting part.
If they open source their code so it's reviewable, that would be ok...but still overkill for what's needed, simple scan n read.
Next up is the blatant security failure of these *private* machines. Sure they've been improved, but why incorporate the risk if you don't have to?
@pixelpusher220 @apenguininspace Here’s the problem: today’s elections in the US are incredibly complex compared with the rest of the world. We vote on a ton of different races, and it’s simply not feasible in most of the US to tally ballots without automation. But automation is inherently unreliable and insecure.
Risk limiting audits are an efficient way to get the benefits of automation while also assuring against errors or compromises of the tally system.
@mattblaze @apenguininspace yes, scantron is automation.
My issue is unaudited, untested machines running unaudited code. The examples of bad (or basically no) security are legion as any private actor will only do the minimum.
I still posit that the software voting machines provide no significant benefit, let alone when weighed against the increased risks.
Edit: *publicly audited
@SteveBellovin @mattblaze @apenguininspace @pixelpusher220
I’ve seen it. Clever code. He did a second version that was even shorter. It led to some interesting and positive changes in thinking at both NSA and DOE.
A major takeaway is that if you know something about your adversary’s assumptions you can get away with lots of things. Of course, that is also true in stage illusion and confidence games.
And no audit of code of any reasonable size is likely to be 100% certain.
@SteveBellovin @mattblaze @apenguininspace @pixelpusher220
It is not available for public viewing.
Matt Blaze
Pusher Of Pixels (old account)
Jess (short for Jessica)
Steve Bellovin
spaf