Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bulgaria Passes a Law Requiring Open Source

medium.com

Post reply on HN
Print view View original

41–50 of 89 posts

Re: Bulgaria Passes a Law Requiring Open Source

#41

Post by SyneRyder »

onestone wrote: post #21

I remember the CEO of Information Services JSC (the de-facto Bulgarian monopolist in governement software procurement), prof. Mihail Konstantinov, making the ridiculous claim on TV that "We can't release the source code of the elections counting software. Anyone who has the source can hack into the system, even children know that. If you don't understand that, you should tear your diploma". Glad to see that morons su…

If it makes you feel better, the Australian government said the same thing:

"Ronaldson refused to table any documents relating to the case, stating that publishing the source code could lead to the EasyCount software being hacked. "In relation to the source code for the Senate counting system, I am advised that publication of the software could leave the voting system open to hacking or manipulation," he said. "In addition, I am advised that the AEC classifies the relevant software as commercial-in-confidence as it also underpins the industrial and fee-for-service election counting systems."" [1]

Australia's federal senate vote count software is a Visual Basic application. It was developed when an upgrade to Windows 2000 broke the previous COBOL application. [2]

[1] http://www.zdnet.com/article/government-blocks-aec-source-co...

[2] http://www.itnews.com.au/news/the-tech-behind-was-senate-rec...

Re: Bulgaria Passes a Law Requiring Open Source

#42

Post by bluetomcat »

netcan wrote: post #37
bluetomcat wrote: post #8

You wouldn't know the background motivating this decision unless you have been a frustrated user of the nearly non-functional software of Bulgarian state institutions. Ludicrous amounts of money are paid by the government to a selected niche of companies for developing all kinds of useless websites which barely work under load and have abysmal implementations with blatant security holes. This law can act as a safegua…

I hope it helps, but it doesn't seem like a sure thing on the face of it. To the extent these big, expensive government projects are similar to smaller “dumb-customer” projects, I don’t think this will help. Anything that requires working with a hard to work with organization is “expensive” in one way or another. You need to sell them the project, which could take months or years. You need to figure out what they nee…

Yes, this is mostly about preventing taxpayer rip-off for trivial software. Similar fraud schemes are exploited in almost every infrastructure development project. The government would repave a road with 1/3 of the official budget and the rest would be shared among the officials and shady business owners.

The Bulgarian government is unable to undertake a surveillance project of any substantial scale simply because it lacks the technological expertise.

Re: Bulgaria Passes a Law Requiring Open Source

#43

Post by vladimirralev »

onestone wrote: post #40
vladimirralev wrote: post #39

Earlier quoted context omitted.

The more people insist such verification is possible, the less you should trust them, they don't understand the issues[1]. It might be possible to come up with some provably verifiable scheme but they are very sophisticated and revised often because people still come up with ways to skew them[2]. [1] https://www.youtube.com/watch?v=w3_0x6oaDmI [2] https://evoting.bismark.se/verifiable-electronic-voting/

That YouTube video is full of logical fallacies and wrong claims. And even if such a verification is impossible, I don't think we should reject incremental improvements just because the result is not yet perfect.

This video is a highly cited source on the issue, admittedly aimed at less educated viewers, but quite accurate. There have been no rebuttals since it was posted and there are serious computer scientists putting their name on it. If you want to write a substantial rebuttal, I am sure it will be huge news in the community.

Even the simplest verifiable voting system is so complicated normal people will be confused how to use it and take advantage of it.

Re: Bulgaria Passes a Law Requiring Open Source

#44

Post by onestone »

onestone wrote: post #40
vladimirralev wrote: post #39

Earlier quoted context omitted.

The more people insist such verification is possible, the less you should trust them, they don't understand the issues[1]. It might be possible to come up with some provably verifiable scheme but they are very sophisticated and revised often because people still come up with ways to skew them[2]. [1] https://www.youtube.com/watch?v=w3_0x6oaDmI [2] https://evoting.bismark.se/verifiable-electronic-voting/

That YouTube video is full of logical fallacies and wrong claims. And even if such a verification is impossible, I don't think we should reject incremental improvements just because the result is not yet perfect.

A couple of examples from the first minute of the video:

- A ridiculous example of "electronic voting" is presented - voters download ballot papers, fill them, then email or fax them back. This obviously sucks in multiple ways. Therefore, all kinds of "electronic voting" must be broken.

- Physical voting is very old, therefore it must have become solid and tamper-proof by now. This is not true. Physical voting is vulnerable to all kinds of manipulations, and they do happen on large scales.

The wrong claims continue forward. Just because that dude sounds smart doesn't mean his clip has any value.

Re: Bulgaria Passes a Law Requiring Open Source

#45

Post by vladimirralev »

onestone wrote: post #44
onestone wrote: post #40

Earlier quoted context omitted.

That YouTube video is full of logical fallacies and wrong claims. And even if such a verification is impossible, I don't think we should reject incremental improvements just because the result is not yet perfect.

A couple of examples from the first minute of the video: - A ridiculous example of "electronic voting" is presented - voters download ballot papers, fill them, then email or fax them back. This obviously sucks in multiple ways. Therefore, all kinds of "electronic voting" must be broken. - Physical voting is very old, therefore it must have become solid and tamper-proof by now. This is not true. Physical voting is vul…

This "ridiculous" example is very real and famously practised to this day MASSIVELY in many countries [1]. It is the prime example of what most people understand as e-voting. He does address other types of voting as well later, including the "open-source bullet-proof machines".

The guy explicitly says physical voting can be compromised easily too, but it requires much more people and it will exhibit patterns such as location stats, violence or outbursts of whistleblowers and it is more or less contained unless the whole country is on it in which case - good for them anyway. While with e-voting, you could technically be a very small group of people and you can model your fake results to be statistically plausible much better with no patterns.

[1] https://travel.state.gov/content/passports/en/abroad/legal-m...

Re: Bulgaria Passes a Law Requiring Open Source

#46

Post by themartorana »

bluetomcat wrote: post #8

You wouldn't know the background motivating this decision unless you have been a frustrated user of the nearly non-functional software of Bulgarian state institutions. Ludicrous amounts of money are paid by the government to a selected niche of companies for developing all kinds of useless websites which barely work under load and have abysmal implementations with blatant security holes. This law can act as a safegua…

If you have a government sponsored monopoly like that, at least do a half-way decent job. I will never understand getting paid $300k for a static website and being so desperate to squeeze another ounce of profit out of an already absurdly profitable contract that you shoot yourself in the foot by not at least delivering something pretty.

I mean, wow.

Re: Bulgaria Passes a Law Requiring Open Source

#47

Post by bozho »

vladimirralev wrote: post #43
onestone wrote: post #40

Earlier quoted context omitted.

That YouTube video is full of logical fallacies and wrong claims. And even if such a verification is impossible, I don't think we should reject incremental improvements just because the result is not yet perfect.

This video is a highly cited source on the issue, admittedly aimed at less educated viewers, but quite accurate. There have been no rebuttals since it was posted and there are serious computer scientists putting their name on it. If you want to write a substantial rebuttal, I am sure it will be huge news in the community. Even the simplest verifiable voting system is so complicated normal people will be confused how…

http://techblog.bozho.net/why-all-the-fear-in-electronic-vot...

Re: Bulgaria Passes a Law Requiring Open Source

#48

Post by Qantourisc »

bluetomcat wrote: post #27
bozho wrote: post #22

Earlier quoted context omitted.

Actually, we made sure that the e-voting provisions in the new electoral code explicitly require the whole software to be open source. Especially for voting this is mandatory, otherwise there is no trust.

And how do you ensure that the actual deployed code doesn't differ from the one posted on GitHub?

I don't see a way. However this would work: The government machine counts, and prints coupons. These coupons are scanned on a second machine installed from GitHub. At the end of the day both machines print their total count on paper (otherwise we cannot grantee anonymity.) These 2 results are compared and passed along. And then the only guaranteed way to ensure anonymity is to destroy the government machine. Less drastic would be wiping the HDD, but who says there is no hidden ROM ?

Re: Bulgaria Passes a Law Requiring Open Source

#49

Post by bluetomcat »

themartorana wrote: post #46
bluetomcat wrote: post #8

You wouldn't know the background motivating this decision unless you have been a frustrated user of the nearly non-functional software of Bulgarian state institutions. Ludicrous amounts of money are paid by the government to a selected niche of companies for developing all kinds of useless websites which barely work under load and have abysmal implementations with blatant security holes. This law can act as a safegua…

If you have a government sponsored monopoly like that, at least do a half-way decent job. I will never understand getting paid $300k for a static website and being so desperate to squeeze another ounce of profit out of an already absurdly profitable contract that you shoot yourself in the foot by not at least delivering something pretty. I mean, wow.

The predetermined companies chosen to execute these projects have never operated in real market conditions and they employ underpaid, demotivated people. No competent programmer would ever want to work there. Most of these companies are actually ill-transformed former communist enterprises which started importing and selling hardware in the 1990s, doing the occasional state software project when it comes up.
Post reply on HN